Skip to main content

Install an SDK

There is one SDK per language, and each one covers the whole platform — Agents, Functions, Serverless, Secrets, MemoryStore, VectorDB, Pub/Sub and MCP servers are all in the same package. There is nothing to install per service.

LanguagePackageImport as
Python 3.8+crusoe-ai-platform 0.1.0crusoe_ai_platform
TypeScript / Node.js 18+@crusoe-ai/platform 0.1.0@crusoe-ai/platform
Go 1.18+www.codyhill.net/sdk/go/platform v0.1.0platform

All three come from your platform's own site — the same place platformctl is downloaded from, served over the same TLS, with checksums published the same way.

What this is not​

During the private beta these packages are not published anywhere public, and that is deliberate rather than an oversight:

  • Not on PyPI. Asking pip to install crusoe-ai-platform by name will not find it. If a package by that name ever does appear on PyPI before we announce it, it is not ours — do not install it.
  • Not on npm. The same is true of @crusoe-ai/platform. Only the scoped tarball served from your platform's own site is ours.
  • Not on the public Go module proxy. proxy.golang.org has never seen this module and cannot: it only serves modules whose paths resolve publicly.
  • There is no public repository. No GitHub organisation, no public mirror, nothing to clone. Source access comes from your platform contact.

Everything below installs from a URL on your own platform's domain. Nothing on this page reaches a public index.

warning

Do not paste any of these packages' names into a public registry search and install what comes back. A private package name that is not registered publicly is a name anyone else can register. Install only from the URLs on this page, and only after the checksum matches.

Where the files live​

Everything is under /sdk/ on your platform's www host, beside the CLI's /cli/ — but with one directory per language, and a checksums.txt inside each one covering the files beside it. There is no /sdk/checksums.txt and no single file listing all three languages; a command that fetches the wrong directory's list finds no matching line and fails rather than passing you the wrong hash.

Python — /sdk/python/​

FileWhat it is
https://www.codyhill.net/sdk/python/crusoe_ai_platform-0.1.0-py3-none-any.whlthe wheel — what you install
https://www.codyhill.net/sdk/python/crusoe_ai_platform-0.1.0.tar.gzthe source distribution
https://www.codyhill.net/sdk/python/crusoe-ai-platform-python-source.zipthe source tree, for reading
https://www.codyhill.net/sdk/python/checksums.txtSHA-256 of the three files above, in sha256sum format

TypeScript — /sdk/typescript/​

FileWhat it is
https://www.codyhill.net/sdk/typescript/crusoe-ai-platform-0.1.0.tgzthe npm tarball — what you install
https://www.codyhill.net/sdk/typescript/crusoe-ai-platform-typescript-source.zipthe source tree, for reading
https://www.codyhill.net/sdk/typescript/checksums.txtSHA-256 of the two files above

Go — /sdk/go/ and /goproxy/​

The Go module is not a file you download. go get speaks the module-proxy protocol, so the module is served under /goproxy/, and /sdk/go/ holds only the source zip.

PathWhat it is
https://www.codyhill.net/sdk/go/crusoe-ai-platform-go-source.zipthe source tree, for reading
https://www.codyhill.net/sdk/go/checksums.txtSHA-256 of that zip — and of nothing else
https://www.codyhill.net/goproxythe Go module proxy; set it as GOPROXY and let the toolchain do the rest

The proxy endpoints themselves are the ones the toolchain asks for, and the module path — hostname included — is part of every one of them:

https://www.codyhill.net/goproxy/www.codyhill.net/sdk/go/platform/@v/list
https://www.codyhill.net/goproxy/www.codyhill.net/sdk/go/platform/@v/v0.1.0.info
https://www.codyhill.net/goproxy/www.codyhill.net/sdk/go/platform/@v/v0.1.0.mod
https://www.codyhill.net/goproxy/www.codyhill.net/sdk/go/platform/@v/v0.1.0.zip
https://www.codyhill.net/goproxy/www.codyhill.net/sdk/go/platform/@latest

The domain appears twice in each of those, and that is not a typo: the first is the host you are asking, the second is part of the module path, which begins with a hostname. @latest is served too, so a go get ...@latest resolves instead of 404ing.

You do not fetch these by hand. They are listed because @v/list is a useful way to see which versions exist, and because a 404 from go get is easier to read when you know which of the five it was.

Every URL on this page is written against your own platform's domain, the one you use for the console and these docs. If you are reading this at docs.<your domain>, the SDK files are on www.<your domain> — the same host that serves the CLI.

The examples below use sha256sum, which is present on Linux. On macOS use shasum -a 256 in its place; the arguments are the same.

Python​

Install​

Download, verify, then install — three commands, so that nothing is installed before the checksum has been checked:

curl -fsSLO https://www.codyhill.net/sdk/python/crusoe_ai_platform-0.1.0-py3-none-any.whl
curl -fsSL  https://www.codyhill.net/sdk/python/checksums.txt | grep crusoe_ai_platform-0.1.0-py3-none-any.whl | sha256sum -c -
pip install ./crusoe_ai_platform-0.1.0-py3-none-any.whl

The second command prints crusoe_ai_platform-0.1.0-py3-none-any.whl: OK and exits non-zero if it does not. If it fails, stop: delete the file and try the download again rather than installing it.

Note the /python/ in both URLs. checksums.txt lives beside the files it covers, so the list you fetch has to come from the same directory as the download — /sdk/checksums.txt is not a file, and /sdk/typescript/checksums.txt has no line for a wheel.

What to expect​

pip reports Successfully installed crusoe-ai-platform-0.1.0 along with its dependencies (urllib3, python-dateutil, pydantic, typing-extensions), which come from wherever pip normally gets packages for you. Only the SDK itself is served by us.

The hyphens in crusoe-ai-platform and the underscores in the filename are the same name: a wheel filename is the distribution name normalised, and pip show crusoe-ai-platform prints the hyphenated form.

Confirm it imports:

python -c "import crusoe_ai_platform; print(crusoe_ai_platform.__version__)"
0.1.0

Verify the checksum​

The sha256sum -c - step above is the verification, and it happens before pip is invoked at all.

To do it in one command instead — useful in a Dockerfile, where three steps is three layers — pip verifies a hash given in the URL fragment of a direct reference and refuses the download if it does not match:

pip install "https://www.codyhill.net/sdk/python/crusoe_ai_platform-0.1.0-py3-none-any.whl#sha256=<the hash from checksums.txt>"

Paste the real hash in place of <the hash from checksums.txt>; a fragment that does not match is a hard failure, but a fragment that is absent is no check at all.

note

pip install --require-hashes is stricter still, but it applies to the whole requirements file: every transitive dependency must also be pinned to an exact version with a hash. That is a reasonable thing to adopt across a project, and a frustrating thing to discover halfway through installing one package.

TypeScript / Node.js​

Install​

curl -fsSLO https://www.codyhill.net/sdk/typescript/crusoe-ai-platform-0.1.0.tgz
curl -fsSL  https://www.codyhill.net/sdk/typescript/checksums.txt | grep crusoe-ai-platform-0.1.0.tgz | sha256sum -c -
npm install ./crusoe-ai-platform-0.1.0.tgz

The tarball is named crusoe-ai-platform-0.1.0.tgz, without the scope. That is npm pack of @crusoe-ai/platform: it drops the leading @ and turns the / into a -. The package you install is still the scoped one, and that is the name you import.

What to expect​

npm adds "@crusoe-ai/platform": "file:crusoe-ai-platform-0.1.0.tgz" to your package.json and records the dependency in package-lock.json. Keep the tarball next to package.json and commit it, or re-download and re-verify it in CI — a file: dependency whose file is missing is an install that fails on somebody else's machine.

The tarball ships compiled JavaScript in dist/; installing it runs no build step. Check that the JavaScript is actually there:

node -e "console.log(Object.keys(require('@crusoe-ai/platform')).length + ' exports')"

Any number greater than zero means the package resolved and loaded. Cannot find module '@crusoe-ai/platform/dist/index.js' means the tarball was packed without being built — report it rather than working around it, because a rebuilt tarball will have a different checksum and /sdk/typescript/checksums.txt will be republished with it.

Verify the checksum​

The sha256sum -c - step above. npm has no equivalent of pip's URL fragment, so do not shorten this to npm install https://.../crusoe-ai-platform-0.1.0.tgz — that fetches and installs with nothing checking what arrived.

Go​

Install​

Run this from inside your module (the directory with your go.mod):

GOPROXY="https://www.codyhill.net/goproxy,$(go env GOPROXY)" \
GONOSUMDB="www.codyhill.net/*" \
go get www.codyhill.net/sdk/go/platform@v0.1.0

Then import it:

import platform "www.codyhill.net/sdk/go/platform"

Why those two settings, and why as a prefix​

Both variables are written in front of the command, not exported. They apply to this one go get and to nothing else — not to your shell afterwards, not to your other projects, not to your colleagues. That is the whole point of writing them this way, and it is worth understanding what each one does before you decide to make either of them permanent.

GOPROXY tells the toolchain where to fetch modules from. The default is the public proxy, which does not have this module. Prepending our proxy — and $(go env GOPROXY) keeps whatever you already had, whether that is the public proxy or your company's — means this one module comes from us and every other dependency you have continues to resolve exactly as it did before. The Go toolchain tries each entry in turn and moves on to the next when a proxy answers 404 or 410, so nothing is lost by putting ours first.

GONOSUMDB switches off the public checksum-database lookup, and only for module paths that start with www.codyhill.net/. Every other module you build is still checked against sum.golang.org as usual. This is needed because sum.golang.org is a public, append-only transparency log of public modules; it has no record of this module and cannot be given one without publishing the module path publicly, which is exactly what the private beta is avoiding. The lookup would fail, and the build would stop.

warning

You may see GOSUMDB=off suggested for private modules. Do not use it here. It disables the checksum database for every module in that command, including all of your other dependencies, and if it ends up in a shell profile or a CI image it quietly weakens every Go build that runs there. GONOSUMDB above is scoped to one prefix, so even pasted somewhere permanent it cannot affect anything else.

GOPRIVATE is the other common suggestion, and it does not work here: it sets GONOPROXY as well, which forces a direct fetch and defeats the proxy on the line above.

If you would rather not repeat the prefix, go env -w GOPROXY=... GONOSUMDB='www.codyhill.net/*' writes the settings to your Go environment file deliberately, and go env -u GOPROXY GONOSUMDB removes them again.

What to expect​

go get adds the requirement to your go.mod and two lines to your go.sum — one for the module, one for its go.mod. Nothing is written outside your module and the shared module cache.

What verifies the Go download​

There is no h1: value published for you to compare against. /sdk/go/checksums.txt covers the Go source zip sitting beside it and nothing else — the module go get fetches is served by the proxy under /goproxy/, not as a file in that directory, so it has no line in any checksums list. If you go looking for one, you will not find it, and this page is not going to send you looking.

Turning off the checksum-database lookup does not leave the download unverified. Two things check it, and neither needs a number published on a web page:

  • TLS to your own platform's host. GOPROXY above is an https:// URL on www.<your domain> — the same host, and the same certificate, that serves the CLI archives and install.sh. The module arrives over that connection or it does not arrive. Nothing here falls back to plaintext, and nothing here fetches from a third party — the second GOPROXY entry is only ever reached for your other dependencies, because ours answers for this module.
  • go.sum, from the first fetch onwards. The first successful fetch records the module's h1: hash in your go.sum. Commit that file. From then on, every build, on every machine and in CI, fails if the bytes ever differ. That is per-project pinning, and for a module only you use it is stronger than a public log: the value is yours, recorded from your own first fetch, rather than one we could republish out from under you.

If you want to see the hash before you commit it, go mod download -json www.codyhill.net/sdk/go/platform@v0.1.0 prints it in a Sum field — the same value go get records. That tells you what you are about to pin. It is not a comparison against anything we publish, because we publish nothing to compare it with.

Source zips, for reading rather than installing​

Plain zips of each SDK's source are published in each language's own directory, and each one is listed in the checksums.txt beside it:

FileContentsListed in
https://www.codyhill.net/sdk/python/crusoe-ai-platform-python-source.zipthe Python SDK source tree/sdk/python/checksums.txt
https://www.codyhill.net/sdk/typescript/crusoe-ai-platform-typescript-source.zipthe TypeScript SDK source tree/sdk/typescript/checksums.txt
https://www.codyhill.net/sdk/go/crusoe-ai-platform-go-source.zipthe Go SDK source tree/sdk/go/checksums.txt

Each unpacks into a single top-level directory named after the zip, so they can be unpacked side by side.

They exist so you can read the code, diff two versions, put it in front of a security review, or vendor it into a monorepo that builds everything from source.

They are not the install path, and the difference is not pedantic:

  • The TypeScript zip contains src/ and no dist/ — it has never been built, so nothing can require it until you build it yourself with a matching TypeScript.
  • The Go zip is a directory snapshot, not a module zip. go get cannot consume it; only the proxy serves the form the toolchain accepts.
  • Nothing you install from a zip matches the hash recorded in your go.sum or package-lock.json, so a project that installs from source is a project whose dependency is no longer pinned to anything anybody published.

Use the packages above to install. Use the zips to read.

What changes at general availability​

We intend to publish all three SDKs to the public registries — PyPI, npm and the public Go module proxy — when the platform leaves private beta. We are not giving a date for that here.

What we can say now:

  • The names do not change. crusoe-ai-platform, @crusoe-ai/platform, and the crusoe_ai_platform import stay exactly as they are, so code written against the beta SDK keeps compiling.
  • The Go module path is the one thing that may move. It is tied to a hostname, and if the published path differs from the one you are using, that is a go.mod edit and a find-and-replace on imports. We will publish the change rather than let you discover it.
  • Until then, this page is the only supported source. If these names turn up on a public index before we announce the move, the packages behind them are not ours.
  • Checksum verification does not go away. The registries have their own integrity mechanisms and you should keep using them; go.sum and package-lock.json are the same files doing the same job.

Next steps​

This page is where the install and verification commands live. If another page shows a different one, the commands here are the ones to use.