Three ways in. They end at the same place — a URL with a token in it — and none of them needs sudo.

curl -fsSL https://raw.githubusercontent.com/andreaderuvo/argus/master/install.sh | bash
argus --allow-write

Everything it does, all of it:

What it does not do: touch anything outside your home, use sudo, install a system package, add a repository, or start anything in the background unless you ask. There is nothing to consent to, which is why it does not ask — a curl | bash that cannot prompt (its standard input is the script) and asks anyway is theatre.

• Run the same line again to update. The code is replaced, the virtual environment refreshed, and ~/.config/argus — your token, your devices, your journal — is not touched.
• Copies of the commands go stale; links do not. The installer's argus-say and argus-mcp are launchers that run the installed code, and sessions Argus starts get its tools/ first on their PATH — none of that needs updating. A command you copied by hand (cp tools/argus-say ~/bin/) does: a pull moves the repository on and leaves the copy where it was. Argus looks for them — on the PATH, in ~/.local/bin, ~/bin and beside its own Python — and says so at start (OLD … in the banner), once in a notice, and in Alt+V, each with the ln -sf line that replaces it by a link, and Link them to this Argus to do it for all of them (the old file is kept beside it as <name>.argus-old-<time>). Prefer a link from the start: ln -s ~/argus/tools/argus-say ~/.local/bin/argus-say.
• … | bash -s -- --service also writes a systemd user service (running Argus with --allow-write, restarted on failure) and starts it. It stops when you log out unless lingering is on: sudo loginctl enable-linger $USER. Without systemd (macOS) it says so and installs the rest.
• … | bash -s -- uninstall takes the code and the launcher away and leaves your configuration, because a token you may still have on three phones is not the uninstaller's to throw away.
• --dir puts it somewhere else; --version v0.1.0 installs one release exactly; --branch next follows an unreleased branch (development only — a release archive is checked against its SHA256SUMS, a branch is not); --source . installs a checkout. The same as environment variables: ARGUS_DIR, ARGUS_BIN, ARGUS_VERSION, ARGUS_BRANCH, ARGUS_SOURCE.

It is checked on every change, on Linux and macOS, by installing into an empty home, starting it, listing a real tmux session through the API, updating in place, and uninstalling.

For Windows-through-WSL, or for anyone who would rather not install Python:

git clone https://github.com/andreaderuvo/argus && cd argus
ARGUS_UID=$(id -u) ARGUS_GID=$(id -g) docker compose up -d
docker compose logs            # the URL with the token is in here

Those two variables are not called UID and GID for a reason worth one sentence: bash makes UID readonly, so UID=$(id -u) docker compose up fails with "readonly variable" — which is what this page said to type until CI pointed at it.

This container is a way to get the runtime, not a sandbox. Argus's whole job is to attach to the tmux sessions and read the files of the machine it runs on, so it has to be handed that machine, and docker-compose.yml spells out each thing it needs and why:

One caveat before it bites: tmux's client and server speak a versioned protocol. The image ships Debian's tmux, and a host running a much older or newer one can be refused — mount your own binary over the image's (- /usr/bin/tmux:/usr/bin/tmux:ro) or install natively, which cannot have the problem at all.

The container listens on 8090, published on 127.0.0.1 only. ARGUS_PORT=8100 docker compose up -d publishes it on another port when 8090 is taken (the link printed in docker compose logs still says 8090 — that is the port inside the container). It serves your home (--root $HOME, which replaces roots) and shares ~/.config/argus — the token, devices, preferences — with a native install on the same machine.

Rather pull than build? Every release is also an image, ghcr.io/andreaderuvo/argus: swap build: . for the image: line commented out in docker-compose.yml.

git clone https://github.com/andreaderuvo/argus && cd argus
pip install -r requirements.txt
python3 -m app.main --allow-write        # prints a URL with a token in it

Open the URL it prints. On first run it writes ~/.config/argus/config.yaml with a fresh 64-character token; that file is the only credential and is never in the repository.

--qr prints a QR code to photograph with a phone. Settings → Open on another device shows the same code from inside the app.

Optional, and worth it. The Argus plugin makes Claude Code or Codex say what it is doing (a turn started, finished, waiting for you) and gives it tools to use Argus: ask you something, ring you, start another agent, open a desk.

Claude Code   /plugin marketplace add andreaderuvo/argus
              /plugin install argus@argus
Codex         codex plugin marketplace add andreaderuvo/argus
              codex plugin add argus@argus

No plugin? Settings → Let your agents ring wires the hooks of Claude Code, Codex and Gemini instead.

The thing you look at runs in a browser, so that side is any operating system with one. The server side is a different question, and the honest answer is short: tmux is a Unix program and there is no native Windows build of it.

Linux and macOS are checked on every change; WSL is Linux and is not separately tested.

argus --help is the authority — it is on the machine and cannot be out of date, and a test fails if a flag ever ships without its sentence. The same list, to read here:

• Python 3.11+ — the PTY bridge uses os.login_tty
• tmux — any recent version
• Optional: pandoc (Word documents), pdftotext from poppler (searching PDFs). Without them those files still open, they are just plainer.

No build step, no database, no bundler: the frontend is plain ES modules and the dependencies are vendored.

Everything is a key in ~/.config/argus/config.yaml (or $XDG_CONFIG_HOME/argus/config.yaml), made with a fresh token the first time Argus runs. A few also have a flag for one run (listen, roots, tmux_socket as --socket, allow_write, allow_proxy, include_mounts as --mounts, drop_keep_days); the rest are only keys.

The installer's --service does this for you. By hand:

[Unit]
Description=Argus
After=network.target

[Service]
ExecStart=%h/.local/bin/argus --allow-write
Restart=on-failure
RestartSec=3

[Install]
WantedBy=default.target

(%h/.local/bin/argus is what the installer puts there; from a checkout use the Python that has its dependencies — /path/to/python3 -m app.main with WorkingDirectory=/path/to/argus. Leave out --allow-write for a read-only Argus.)

Save as ~/.config/systemd/user/argus.service, then:

systemctl --user enable --now argus
sudo loginctl enable-linger $USER      # or it stops at your last logout

The GitHub mark in the top bar opens this wiki, the repository and the landing page. On a phone narrower than 560px it is not in the header: the same links are in Settings → About Argus. The documentation is meant to be one tap from wherever you are, rather than something to go and look for.