v26.09.4

arcli 26.09.4 adds arcli sample: load a real public dataset into your own Arc instead of writing one synthetic point and wondering what Arc is for.

Added

• arcli sample load citibike downloads a month of NYC Citi Bike trips (31 files, 39.4 MiB, 1,003,770 rows), verifies every file against the published SHA-256, imports it, and prints two queries worth running against what just landed. It creates the target database if it does not exist, and takes about three seconds against a local Arc once the files are down.
• arcli sample list shows the published datasets, one row per dataset and month. arcli sample show citibike gives the details, licence and time window; -o json adds every file URL and checksum, so the data can be fetched without arcli and imported with arcli import parquet.
• --month, --database and --measurement override the manifest's defaults. --download-only fetches and verifies without importing and needs no Arc connection at all; --download-dir keeps the Parquet somewhere durable instead of a temp directory.
• Interrupted downloads resume: a file already present with a matching checksum is not fetched again, and a file whose checksum does not match is re-downloaded once before the command fails rather than importing data that does not match the manifest.
• If the target measurement already holds rows, load says so and asks before adding more, so a second run cannot silently double the counts the printed queries report. --yes skips that prompt; a non-interactive shell refuses rather than hanging.

Privacy

• The sample datasets come from samples.basekick.net, and these are the only arcli commands that contact a Basekick-controlled host. Every other command still talks solely to the Arc servers you configured.
• Those requests carry the same User-Agent and Arcli-Installation-Id as any other arcli request, and the existing opt-outs apply unchanged (DO_NOT_TRACK=1, or send_installation_id = false in the config file). They never carry your token, your Arc endpoint, or anything about your data.
• The README's Privacy section previously said arcli never contacts Basekick or any third party. That is no longer true, and it now describes what is actually sent, including that fetching a file over the internet reveals your IP address and the file requested to whoever serves it.
• arcli sample show <dataset> -o json prints every file URL and SHA-256, so anyone who would rather not fetch from us can download the data another way and use arcli import parquet.

Notes

• Importing requires an admin token when the Arc server has authentication enabled; the check runs before anything is downloaded rather than failing on the first file.
• Downloads run four at a time and stop as soon as one fails, so a build the sample host does not recognise costs a handful of requests instead of a full dataset of them.

Changelog

• 62fd212: feat(sample): arcli sample {list,show,load} for real datasets (#26) (@xe-nvdk)

---

Install

Homebrew	brew install basekick-labs/tap/arcli
Debian / Ubuntu	sudo dpkg -i arcli_26.09.4_amd64.deb (or _arm64.deb)
RHEL / Fedora	sudo rpm -i arcli-26.09.4-1.x86_64.rpm (or .aarch64.rpm)
Arch	sudo pacman -U arcli-26.09.4-1-x86_64.pkg.tar.zst (or -aarch64)
Docker	docker run --rm ghcr.io/basekick-labs/arcli:26.09.4 --version
Go	go install github.com/basekick-labs/arcli/cmd/arcli@latest (builds main; Go does not accept CalVer tags for this module path)

Every archive carries a SPDX SBOM (*.sbom.json); checksums.txt covers all archives, packages and SBOMs and is signed keylessly with cosign:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/Basekick-Labs/arcli/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt

v26.09.3

arcli 26.09.3 makes the token optional for Arc servers that run without authentication.

Changed

• A connection no longer needs a token. arcli config create --name lab --endpoint http://lab:8000 (no --token), --endpoint URL alone, and ARC_ENDPOINT alone are all accepted; arcli then sends no Authorization header, which is what an Arc with auth.enabled = false expects. config create and config update --token "" print a note that such a profile only works against a server without authentication, and config list / config current show the token as (none).
• A token without an endpoint (--token alone, ARC_TOKEN alone) is still an error: it names no server.
• arcli ping against a server that does require a token, from a connection that has none, now says so (server requires a token but this connection has none) instead of quoting a bare 401.

Changelog

• 1c64abf: feat(config): token optional for Arc servers with auth.enabled = false (@xe-nvdk)

---

Install

Homebrew	brew install basekick-labs/tap/arcli
Debian / Ubuntu	sudo dpkg -i arcli_26.09.3_amd64.deb (or _arm64.deb)
RHEL / Fedora	sudo rpm -i arcli-26.09.3-1.x86_64.rpm (or .aarch64.rpm)
Arch	sudo pacman -U arcli-26.09.3-1-x86_64.pkg.tar.zst (or -aarch64)
Docker	docker run --rm ghcr.io/basekick-labs/arcli:26.09.3 --version
Go	go install github.com/basekick-labs/arcli/cmd/arcli@latest (builds main; Go does not accept CalVer tags for this module path)

Every archive carries a SPDX SBOM (*.sbom.json); checksums.txt covers all archives, packages and SBOMs and is signed keylessly with cosign:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/Basekick-Labs/arcli/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt

v26.09.2

arcli 26.09.2 is a small correctness release.

Fixed

• arcli db drop and arcli config delete now behave like every other destructive command: a declined confirmation ends with Error: aborted, and a stdin that is not a terminal is refused with Error: confirmation required but stdin is not a terminal; pass --yes; both exit 1 and nothing is deleted. Previously they printed Aborted. and exited 0, so a script could not tell a refused drop from a successful one. Pass --yes to skip the prompt, as before. (arcli#23)

Changelog

• 440913c: fix(db,config): declined or non-terminal prompt on db drop / config delete exits 1 (#23) (@xe-nvdk)

---

Install

Homebrew	brew install basekick-labs/tap/arcli
Debian / Ubuntu	sudo dpkg -i arcli_26.09.2_amd64.deb (or _arm64.deb)
RHEL / Fedora	sudo rpm -i arcli-26.09.2-1.x86_64.rpm (or .aarch64.rpm)
Arch	sudo pacman -U arcli-26.09.2-1-x86_64.pkg.tar.zst (or -aarch64)
Docker	docker run --rm ghcr.io/basekick-labs/arcli:26.09.2 --version
Go	go install github.com/basekick-labs/arcli/cmd/arcli@latest (builds main; Go does not accept CalVer tags for this module path)

Every archive carries a SPDX SBOM (*.sbom.json); checksums.txt covers all archives, packages and SBOMs and is signed keylessly with cosign:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/Basekick-Labs/arcli/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt

v26.09.1

arcli 26.09.1 is the first release of the Arc command-line client: one binary that replaces the curl calls operators used to hand-craft against Arc's HTTP API.

Versioning follows Arc's CalVer (YY.0M.PATCH, tagged v26.09.1; the deb / rpm / Arch packagers normalise their version field to 26.9.1). arcli 26.x talks to Arc 26.06 and later. Go's module rules do not accept a CalVer tag for this module path, so go install …@latest builds main; the packages, Homebrew and Docker are the release channels.

What's in the box

• Connections: named profiles in ~/.arcli/config.toml (mode 0600), one active, overridable per command with -c, --endpoint/--token, or ARC_* env vars. --token-stdin keeps tokens out of shell history.
• Query and write: arcli query (table / json / csv / arrow, --estimate), arcli write (line protocol, MessagePack pass-through, validated JSON → MessagePack), arcli import csv|lp|parquet|tle.
• Admin: databases, measurements, API tokens (auth token create|rotate|revoke|…, auth whoami), retention policies, continuous queries, scheduler, predicate delete, backup create|restore|…, cluster, compaction, logs, ping.
• Operator ergonomics: shell completion that knows your connection names, man pages, y/N prompts with --yes on destructive commands, ctrl-C cancels the request and exits 130 (SIGTERM: 143) with a reminder that the server keeps going, tokens are redacted everywhere except the two commands whose job is to print a new one.
• arcli never contacts Basekick or any third party. Every request goes to the Arc server you configured. Requests carry the arcli version and OS/architecture and, once a config file exists, a random installation id (Arcli-Installation-Id, minted by the first config create). Arc's own opt-out telemetry may report that id with its instance id, so Basekick can count how many CLI installations talk to how many Arc servers; the same id is sent to every server you use, so it links them. Opt out with DO_NOT_TRACK=1 or send_installation_id = false. Nothing else is stored or sent.

Install

See the table at the bottom of these notes. Packages and the Homebrew formula install completions and man pages for you.

Re-cut

v26.09.1 was re-cut on 2026-09-07 UTC, before anyone had installed it, to add the installation id described above. The tag moved and every asset, image and the Homebrew formula were replaced; two checksums.txt files therefore carry valid signatures for this tag, and the one on this page is the current one.

What's Changed

• feat(query,write): HTTP wire adapter + query/write commands + 4 output formats (PR2) by @xe-nvdk in #1
• feat(db,measurement): db admin + measurement listing (PR3) by @xe-nvdk in #2
• feat(import): bulk file imports for csv / lp / parquet / tle (PR4) by @xe-nvdk in #3
• chore: rename arcctl to arcli by @xe-nvdk in #4
• feat(auth): token admin, whoami, ping, config update (PR5) by @xe-nvdk in #5
• feat(cluster,compaction): cluster inspection + node removal, compaction observe/trigger (PR6) by @xe-nvdk in #6
• feat(retention,cq): retention policies, continuous queries, scheduler status (PR7) by @xe-nvdk in #7
• feat(delete,backup): predicate delete, full backup and restore (PR8) by @xe-nvdk in #8
• feat(write,query,logs): msgpack/json writes, query --estimate, logs, import stats, signal-aware root (PR9) by @xe-nvdk in #9
• feat(release): shell completion, build metadata in --version, gendocs, distroless image (PR10a) by @xe-nvdk in #10
• feat(release): GoReleaser pipeline with deb/rpm/Arch packages, Homebrew tap, GHCR image, cosign (PR10b) by @xe-nvdk in #11
• chore(ci): bump actions/checkout from 5 to 7 by @dependabot[bot] in #14
• chore(ci): bump docker/setup-buildx-action from 3.12.0 to 4.3.0 by @dependabot[bot] in #13
• chore(ci): bump docker/login-action from 3.7.0 to 4.6.0 by @dependabot[bot] in #15
• chore(ci): bump anchore/sbom-action/download-syft from 0.24.0 to 0.24.2 by @dependabot[bot] in #16
• chore(ci): bump sigstore/cosign-installer from 3.9.1 to 4.1.2 by @dependabot[bot] in #12
• fix(release): token probe must not fail on a PAT without an expiration header by @xe-nvdk in #17
• fix(release): brew token via .Env; version wording by @xe-nvdk in #18
• feat(config): installation id header for Arc-side telemetry correlation by @xe-nvdk in #19

---

Install

Homebrew	brew install basekick-labs/tap/arcli
Debian / Ubuntu	sudo dpkg -i arcli_26.09.1_amd64.deb (or _arm64.deb)
RHEL / Fedora	sudo rpm -i arcli-26.09.1-1.x86_64.rpm (or .aarch64.rpm)
Arch	sudo pacman -U arcli-26.09.1-1-x86_64.pkg.tar.zst (or -aarch64)
Docker	docker run --rm ghcr.io/basekick-labs/arcli:26.09.1 --version
Go	go install github.com/basekick-labs/arcli/cmd/arcli@latest (builds main; Go does not accept CalVer tags for this module path)

Every archive carries a SPDX SBOM (*.sbom.json); checksums.txt covers all archives, packages and SBOMs and is signed keylessly with cosign:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/Basekick-Labs/arcli/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt

New Contributors

• @xe-nvdk made their first contribution in #1
• @dependabot[bot] made their first contribution in #14

Full Changelog: https://github.com/Basekick-Labs/arcli/commits/v26.09.1