Remove gh runtime download dependency

README.md

@@ -65,7 +65,7 @@ VM. When the agent exits, you review the diff and accept or reject each file.
 - Linux with KVM support (`/dev/kvm` must be accessible), or macOS with Hypervisor.framework (Apple Silicon)
 - [Go 1.26+](https://go.dev/dl/)
 - [Task](https://taskfile.dev/) (task runner)
-- [GitHub CLI (`gh`)](https://cli.github.com/) (for downloading pre-built runtime artifacts)
+- [curl](https://curl.se/) (for downloading pre-built runtime artifacts)
 - An API key for your agent (e.g. `ANTHROPIC_API_KEY` for Claude Code)
 
 ### Install from Release

Taskfile.yaml

@@ -124,24 +124,24 @@ tasks:
     cmds:
       - |
         mkdir -p internal/infra/vm/runtimebin
-        gh release download {{.GOMICROVM_VERSION}} --repo stacklok/go-microvm --dir internal/infra/vm/runtimebin/ --clobber --pattern 'go-microvm-runtime-*.tar.gz'
         archive=""
         for os in "{{.HOST_OS}}" "{{.HOST_OS_ALT}}"; do
           for arch in "{{.HOST_ARCH}}" "{{.HOST_ARCH_ALT}}"; do
             candidate="internal/infra/vm/runtimebin/go-microvm-runtime-${os}-${arch}.tar.gz"
-            if [ -f "$candidate" ]; then
+            url="https://github.com/stacklok/go-microvm/releases/download/{{.GOMICROVM_VERSION}}/go-microvm-runtime-${os}-${arch}.tar.gz"
+            if curl --fail --location --retry 3 --output "$candidate" "$url"; then
               archive="$candidate"
               break 2
             fi
+            rm -f "$candidate"
           done
         done
         if [ -z "$archive" ]; then
-          echo "no runtime archive found in internal/infra/vm/runtimebin"
-          ls -1 internal/infra/vm/runtimebin/go-microvm-runtime-*.tar.gz || true
+          echo "no runtime archive available for {{.HOST_OS}}/{{.HOST_ARCH}}"
           exit 1
         fi
         tar -xzf "$archive" -C internal/infra/vm/runtimebin/ --strip-components=1
-        rm -f internal/infra/vm/runtimebin/go-microvm-runtime-*.tar.gz
+        rm -f "$archive"
 
   fetch-firmware:
     desc: Download pre-built go-microvm firmware from GitHub Release
@@ -150,24 +150,24 @@ tasks:
     cmds:
       - |
         mkdir -p internal/infra/vm/runtimebin
-        gh release download {{.GOMICROVM_VERSION}} --repo stacklok/go-microvm --dir internal/infra/vm/runtimebin/ --clobber --pattern 'go-microvm-firmware-*.tar.gz'
         archive=""
         for os in "{{.HOST_OS}}" "{{.HOST_OS_ALT}}"; do
           for arch in "{{.HOST_ARCH}}" "{{.HOST_ARCH_ALT}}"; do
             candidate="internal/infra/vm/runtimebin/go-microvm-firmware-${os}-${arch}.tar.gz"
-            if [ -f "$candidate" ]; then
+            url="https://github.com/stacklok/go-microvm/releases/download/{{.GOMICROVM_VERSION}}/go-microvm-firmware-${os}-${arch}.tar.gz"
+            if curl --fail --location --retry 3 --output "$candidate" "$url"; then
               archive="$candidate"
               break 2
             fi
+            rm -f "$candidate"
           done
         done
         if [ -z "$archive" ]; then
-          echo "no firmware archive found in internal/infra/vm/runtimebin"
-          ls -1 internal/infra/vm/runtimebin/go-microvm-firmware-*.tar.gz || true
+          echo "no firmware archive available for {{.HOST_OS}}/{{.HOST_ARCH}}"
           exit 1
         fi
         tar -xzf "$archive" -C internal/infra/vm/runtimebin/ --strip-components=1
-        rm -f internal/infra/vm/runtimebin/go-microvm-firmware-*.tar.gz
+        rm -f "$archive"
 
   test:
     desc: Run unit tests

docs/DEVELOPMENT.md

@@ -6,7 +6,7 @@
 - [Task](https://taskfile.dev/) (task runner)
 - [golangci-lint](https://golangci-lint.run/)
 - [goimports](https://pkg.go.dev/golang.org/x/tools/cmd/goimports)
-- [GitHub CLI (`gh`)](https://cli.github.com/) (for `task build` to download pre-built runtime artifacts)
+- [curl](https://curl.se/) (for `task build` to download pre-built runtime artifacts)
 
 For running VMs:
 - Linux with KVM support, or macOS with Hypervisor.framework (Apple Silicon)

docs/MACOS.md

@@ -30,7 +30,7 @@ The default build embeds the go-microvm runtime into `bbox`:
 task build
 ```
 
-This downloads the pinned runtime artifacts via `gh` and produces a self-contained
+This downloads the pinned runtime artifacts via `curl` and produces a self-contained
 `bin/bbox` (pure Go, no CGO) that does not depend on Homebrew `libkrun`.
 
 Firmware (`libkrunfw`) is not embedded. It is downloaded at runtime and cached