odek

▸ 01 · install

Prebuilt binary, SHA-256 checked, then ~/.local/bin. If odek version is not found, add that directory to PATH.

OS=$(uname -s | tr '[:upper:]' '[:lower:]')
ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
ASSET="odek-${OS}-${ARCH}"
TMP=$(mktemp -d)
curl -fsSL -o "${TMP}/${ASSET}" \
  "https://github.com/BackendStack21/odek/releases/latest/download/${ASSET}"
curl -fsSL -o "${TMP}/checksums.txt" \
  "https://github.com/BackendStack21/odek/releases/latest/download/checksums.txt"
if command -v sha256sum >/dev/null; then
  (cd "${TMP}" && grep "  ${ASSET}$" checksums.txt | sha256sum -c -)
else
  (cd "${TMP}" && grep "  ${ASSET}$" checksums.txt | shasum -a 256 -c -)
fi
mkdir -p "${HOME}/.local/bin"
install -m 755 "${TMP}/${ASSET}" "${HOME}/.local/bin/odek"
rm -rf "${TMP}"
export PATH="${HOME}/.local/bin:${PATH}"
odek version

copied — paste in a terminal. if odek: command not found, add ~/.local/bin to PATH.

Later, odek upgrade self-updates from GitHub Releases the same way (SHA-256 verified).

TAG=$(git ls-remote --tags --sort=-v:refname \
  https://github.com/BackendStack21/odek.git \
  | awk '!/\^\{\}$/ {sub("refs/tags/", "", $2); print $2; exit}')
TMP=$(mktemp -d)
git clone --depth 1 --branch "${TAG}" \
  https://github.com/BackendStack21/odek.git "${TMP}/odek"
(cd "${TMP}/odek" && go install -ldflags "-X main.version=${TAG}" ./cmd/odek)
rm -rf "${TMP}"
export PATH="$(go env GOPATH)/bin:$PATH"
odek version

▸ 02 · configure

odek init --global writes ~/.odek/config.json (mode 0600) and refuses to overwrite without --force. Built-in ids: deepseek (what init scaffolds), openai, anthropic, gemini, zai, kimi — plus any OpenAI-compatible gateway. This walkthrough edits the scaffold for z.ai:

odek init --global

{
  "provider": "zai",
  "model": "glm-5.3-flash",
  "providers": {
    "zai": {
      "api_key": "${ZAI_API_KEY}",
      "base_url": "https://api.z.ai/api/coding/paas/v4"
    }
  },
  "llm": {
    "request_timeout_seconds": 300,
    "stream_idle_timeout_seconds": 300
  }
}

That base_url is the GLM Coding Plan. Pay-as-you-go uses https://api.z.ai/api/paas/v4. Model ids for your plan are on the z.ai dashboard.

Store the key in ~/.odek/secrets.env so it never lands in shell history.

cat > ~/.odek/secrets.env <<'EOF'
ZAI_API_KEY=sk-your-zai-key-here
EOF
chmod 600 ~/.odek/secrets.env

Priority: ~/.odek/secrets.env → ~/.odek/config.json → ./odek.json → ODEK_* env → CLI flags. A project ./odek.json cannot set provider, providers, llm, or keys. Env keys follow the provider (DEEPSEEK_API_KEY, OPENAI_API_KEY, ANTHROPIC_API_KEY, …). Full table: PROVIDERS.md.

▸ 03 · sandbox

Tool execution runs inside an isolated Docker container by default for odek run, odek continue, odek repl, and odek serve. No Docker? Opt out before the first run:

export ODEK_NO_SANDBOX=1     # add to ~/.zshrc / ~/.bashrc
# or per-run:
odek run --no-sandbox "..."

Unsandboxed runs warn loudly. ODEK_REQUIRE_SANDBOX=1 makes them fatal instead. Full model: SANDBOXING.md.

▸ 04 · first run

You should see glm-5.3-flash in the run header and a short ReAct trace: think → act → answer.

odek run "List the Go files in this directory and count their total lines"

illustration glm-5.3-flash · think → act → answer

odek repl

Web UI — streams tokens, tools, and approvals. It binds 127.0.0.1:8080 and prints a token URL. Open that URL; a bare http://127.0.0.1:8080 loads the chrome but cannot connect.

odek serve
# → http://127.0.0.1:8080/?token=…

▸ 05 · if it breaks

▸ next

The page is the short path. Depth lives in the docs.

• bodek optional TUI — Bubble Tea client for odek serve
• full guide GETTING_STARTED — source install, bodek, GLM reference
• cheatsheet every command and flag, one page
• config five-layer chain, every field
• cli run, serve, telegram, schedule, upgrade
• providers deepseek, openai, anthropic, gemini, zai, kimi
• sandbox Docker isolation and the opt-out
• security approvals, untrusted content, injection defenses
• web ui odek serve — token URL, WebSocket, inspector