One binary.
Seven modules.

▸ 01 · install

One line. Checksum-verified prebuilt binary, then ~/.local/bin (or /usr/local/bin). If odek version is not found, add that directory to PATH.

curl -fsSL https://odek.21no.de/install.sh | sh

copied — paste in a terminal. The installer refuses to install anything it cannot verify against the release checksums.

Later, odek upgrade self-updates from GitHub Releases the same way (SHA-256 verified). The script is readable here — pipe-to-sh should always be a choice, not a habit.

OS=$(uname -s | tr '[:upper:]' '[:lower:]')
ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
ASSET="odek-${OS}-${ARCH}"
TMP=$(mktemp -d)
curl -fsSL -o "${TMP}/${ASSET}" \
  "https://github.com/BackendStack21/odek/releases/latest/download/${ASSET}"
curl -fsSL -o "${TMP}/checksums.txt" \
  "https://github.com/BackendStack21/odek/releases/latest/download/checksums.txt"
if command -v sha256sum >/dev/null; then
  (cd "${TMP}" && grep "  ${ASSET}$" checksums.txt | sha256sum -c -)
else
  (cd "${TMP}" && grep "  ${ASSET}$" checksums.txt | shasum -a 256 -c -)
fi
mkdir -p "${HOME}/.local/bin"
install -m 755 "${TMP}/${ASSET}" "${HOME}/.local/bin/odek"
rm -rf "${TMP}"
export PATH="${HOME}/.local/bin:${PATH}"
odek version

TAG=$(git ls-remote --tags --sort=-v:refname \
  https://github.com/BackendStack21/odek.git \
  | awk '!/\^\{\}$/ {sub("refs/tags/", "", $2); print $2; exit}')
TMP=$(mktemp -d)
git clone --depth 1 --branch "${TAG}" \
  https://github.com/BackendStack21/odek.git "${TMP}/odek"
(cd "${TMP}/odek" && go install -ldflags "-X main.version=${TAG}" ./cmd/odek)
rm -rf "${TMP}"
export PATH="$(go env GOPATH)/bin:$PATH"
odek version

▸ 02 · configure

Initialize once, then choose your provider below. odek init --global creates ~/.odek/config.json with restricted permissions and refuses to overwrite an existing configuration without --force.

odek init --global

Merge the selected example into ~/.odek/config.json, preserving your other settings. Keep API keys in ~/.odek/secrets.env.

{
  "provider": "deepseek",
  "model": "deepseek-flash",
  "providers": {
    "deepseek": {
      "api_key": "${DEEPSEEK_API_KEY}"
    }
  }
}

DEEPSEEK_API_KEY=your-api-key-here

{
  "provider": "zai",
  "model": "glm-5.3-flash",
  "providers": {
    "zai": {
      "api_key": "${ZAI_API_KEY}",
      "base_url": "https://api.z.ai/api/coding/paas/v4"
    }
  },
  "llm": {
    "request_timeout_seconds": 300,
    "stream_idle_timeout_seconds": 300
  }
}

ZAI_API_KEY=your-api-key-here

{
  "provider": "openai",
  "model": "gpt-5.6-luna",
  "providers": {
    "openai": {
      "api_key": "${OPENAI_API_KEY}"
    }
  }
}

OPENAI_API_KEY=your-api-key-here

{
  "provider": "openrouter",
  "model": "openai/gpt-4o",
  "providers": {
    "openrouter": {
      "api_key": "${OPENROUTER_API_KEY}",
      "format": "openai",
      "base_url": "https://openrouter.ai/api/v1"
    }
  }
}

OPENROUTER_API_KEY=your-api-key-here

Open ~/.odek/secrets.env in your editor and add or update the selected key entry. Replace the placeholder with your actual key, preserve any other entries, then restrict file permissions:

chmod 600 ~/.odek/secrets.env

Provider settings belong in your global configuration. A project ./odek.json cannot set providers, endpoints, or keys. The examples reference key variables explicitly, including OPENROUTER_API_KEY for the custom provider. More options: PROVIDERS.md.

▸ 03 · sandbox

Tool execution runs inside an isolated Docker container by default for odek run, odek continue, odek repl, and odek serve. No Docker? Opt out before the first run:

export ODEK_NO_SANDBOX=1     # add to ~/.zshrc / ~/.bashrc
# or per-run:
odek run --no-sandbox "..."

Unsandboxed runs warn loudly. ODEK_REQUIRE_SANDBOX=1 makes them fatal instead. Full model: SANDBOXING.md.

▸ 04 · first run

You should see your configured model in the run header and a short ReAct trace: think → act → answer.

odek run "List the Go files in this directory and count their total lines"

illustration your model · think → act → answer

odek repl

Web UI — streams tokens, tools, and approvals. It binds 127.0.0.1:8080 and prints a token URL. Open that URL; a bare http://127.0.0.1:8080 loads the chrome but cannot connect.

odek serve
# → http://127.0.0.1:8080/?token=…

▸ 05 · if it breaks

▸ next

The page is the short path. Depth lives in the docs.

• bodek optional TUI — Bubble Tea client for odek serve
• full guide GETTING_STARTED — source install, bodek, GLM reference
• cheatsheet every command and flag, one page
• config five-layer chain, every field
• cli run, serve, telegram, schedule, upgrade
• providers deepseek, openai, anthropic, gemini, zai, kimi
• sandbox Docker isolation and the opt-out
• security approvals, untrusted content, injection defenses
• web ui odek serve — token URL, WebSocket, inspector