# Installing Reckon Graph Reckon Graph is a local code-intelligence engine, CLI, and single-tool MCP gateway. npm is the primary cross-platform distribution. Every persistent installation must resolve one stable `reckon` executable from interactive shells, Git hooks, and MCP clients. ## Support and evidence | Installer or manager | Command | Current status | | --- | --- | --- | | npm without a Node manager | `npm install --global --ignore-scripts reckon-graph@` | Verified by the packed-consumer gate on macOS/Linux | | mise npm backend | `mise use --global npm:reckon-graph@` | Executable gate provided; release verification requires the published version | | Volta | `volta install reckon-graph@` | Guidance from Volta's tool-shim contract; not release-gated in this repository | | nvm | select Node 24+, then use the npm command | Guidance; globals belong to the selected Node installation | | fnm | select Node 24+, then use the npm command | Guidance; globals belong to the selected Node installation | | asdf | select Node 24+, then use the npm command | Guidance; globals belong to the selected Node installation | | pnpm | `pnpm add --global --ignore-scripts reckon-graph@` | Executable gate provided; release verification requires the published version | | Bun | `bun add --global --ignore-scripts reckon-graph@` | Executable gate provided; release verification requires the published version | | approved npm-compatible registry | use the npm command with approved registry configuration | Same artifact; registry authentication/promotion is organization-owned | | P&T GHES release asset | download the exact `.tgz` from `Enterprise-Apps/reckon-graph`, verify SHA-256, then use the npm command with the local file | Live for 0.3.0; each newer version requires separate channel verification, and Windows named-client certification remains open | | Homebrew | `brew install reckon-graph/tap/reckon` | Tap is live for 0.3.0; each newer formula must match the release tarball SHA-256 and pass its lifecycle gate | “Guidance” is not a compatibility claim. The repository records the manager version, command, package version, platform, and result when a release gate is actually run. The executable harness is `npm run test:package-managers -- npm pnpm bun`. Registry-backed release checks use `RECKON_SMOKE_PUBLISHED_VERSION= npm run test:package-managers -- mise volta`; they intentionally refuse to substitute a local tarball for a published manager-owned tool. ## Exact npm installation Node.js 24 or newer is required: ```bash npm install --global --ignore-scripts reckon-graph@0.4.3 reckon --version reckon doctor ``` `0.4.3` is the version prepared by this change and becomes installable only after the separately authorized npm publication step. Replace it with the exact published release being deployed. Exact versions make rollbacks and manager comparisons reproducible. A bare `reckon-graph` resolves the registry's `latest` tag and is less reproducible. The package does not use an install lifecycle script to detect package managers. It cannot intercept a package-manager command before it is installed, and a postinstall heuristic would neither fix PATH ownership nor prove which manager will execute the command later. Reckon's verified CPU path does not require dependency lifecycle scripts. Preserve `--ignore-scripts`. The `boolean@3.2.0` warning is upstream transitive debt in the local embedding runtime, not a direct runtime call. The `check:dependency-deprecations` gate alerts when upstream movement makes removal safe; ineffective overrides are not shipped. ## mise Use mise's npm backend so the executable is owned by one stable mise shim: ```bash mise use --global npm:reckon-graph@ mise which reckon reckon --version ``` The current mise npm backend uses an embedded installer by default, blocks unreviewed lifecycle scripts, and applies a low-download policy to an unlocked tool. A reviewed first install may require the package-specific `allow_low_downloads` setting; a locked tool does not. Do not disable the policy globally. Reckon does not need lifecycle scripts. Verify the same shim both outside a repository and inside repositories that pin different Node versions: ```bash mise which reckon reckon --version cd /path/to/node-24-project && reckon --version cd /path/to/node-26-project && reckon --version ``` ## Volta Volta installs package binaries behind shims and pins each tool to the default Node engine in effect when the tool is installed: ```bash volta install reckon-graph@ volta which reckon reckon --version ``` Verify it inside a project with a different `volta.node` pin. The package tool should remain available with its own pinned engine. This repository labels Volta as guidance until that executable test is recorded for the release. ## nvm, fnm, and asdf These managers select a Node installation. npm globals belong to that selected installation, so changing Node versions can make `reckon` disappear: ```bash nvm use 24 npm install --global --ignore-scripts reckon-graph@ ``` Use the equivalent `fnm use` or `asdf` selection before installing. Install Reckon for each Node version used by your repositories, use the manager's documented package-migration facility, or choose a manager-owned tool shim such as mise/Volta. nvm documents `--reinstall-packages-from` for migration. ## pnpm and Bun Persistent global installs are: ```bash pnpm add --global --ignore-scripts reckon-graph@ bun add --global --ignore-scripts reckon-graph@ ``` Confirm the manager's global binary directory is on PATH (`pnpm bin -g` or `bun pm bin -g`). Temporary runners such as `npx`, `pnpm dlx`, and `bunx` are not supported for initialized repositories because later hooks and MCP clients need a stable executable. ## Approved npm-compatible registries Organizations may promote the unchanged npm artifact through an approved npm-compatible registry. Configure the registry and credentials through the package manager's normal user or CI configuration, never in this repository: ```bash npm install --global --ignore-scripts reckon-graph@ ``` Public/package documentation intentionally does not name internal registry hosts. `reckon doctor` reports the configured channel without printing credentials. P&T engineers without GitHub SaaS access should use the authenticated GHES release-asset procedure in [`PT-ACCESS-RECOMMENDATION.md`](PT-ACCESS-RECOMMENDATION.md). It installs the same digest-verified npm tarball without cloning source. ## Homebrew Reckon uses a Formula, not a Cask: it is an npm CLI and does not ship a standalone application bundle. The formula consumes the published npm tarball, verifies SHA-256, depends on Node, installs under Homebrew `libexec`, and disables unnecessary dependency scripts. Install a certified release from the public Reckon tap: ```bash brew install reckon-graph/tap/reckon ``` A version is not called Homebrew-supported until the corresponding published npm tarball passes version, MCP initialize/tools-list, `init`, `status`, `query`, `repair`, and uninstall smoke tests. The tap is `reckon-graph/homebrew-tap`; the formula and attached release evidence must identify the exact source commit and tarball digest. The authoritative live formula is maintained in `reckon-graph/homebrew-tap`. The repository-local `packaging/homebrew/reckon-graph.rb` is a historical candidate fixture and must not be promoted or used to certify a newer release. For a release gate, download the live tap's version-specific formula, verify its URL and digest against the exact release tarball, and pass that file explicitly to `scripts/homebrew-formula-smoke.sh`. The harness builds and installs the formula, runs the lifecycle test block, uninstalls it, and verifies Homebrew no longer owns the formula. It refuses to replace an existing installation. ## Initialize, upgrade, and uninstall ```bash reckon init reckon status --deep reckon doctor ``` Upgrade with the manager that owns the executable: ```bash npm install --global --ignore-scripts reckon-graph@ mise use --global npm:reckon-graph@ volta install reckon-graph@ brew update && brew upgrade reckon ``` Uninstall: ```bash npm uninstall --global reckon-graph mise uninstall npm:reckon-graph volta uninstall reckon-graph brew uninstall reckon ``` Uninstalling the package does not silently delete repository indexes or user configuration. Remove those explicitly only after reviewing their paths.