Install

tidy has not had its first tagged release yet. Until it does, build the command from source with cargo. The install script and the prebuilt binaries below describe how it will work, and will start answering the moment a release is tagged.

From source

Building needs a Rust toolchain. It takes a few minutes the first time.

$ cargo install --git https://github.com/lukeed/tidy tidy_cli

Or from a clone of the repository:

$ git clone https://github.com/lukeed/tidy
$ cd tidy
$ cargo install --path crates/tidy_cli

Either way the binary is called tidy, and lands in ~/.cargo/bin.

npm

The tidyrs package is the Node API, not the command. It ships a native addon for your platform as an optional dependency, so nothing is compiled on install.

$ npm install --save-dev tidyrs

import { format } from "tidyrs";

format("<p   >hi</p>", { filepath: "index.html" });
//=> "<p>hi</p>\n"

It has no bin, so npx tidy does not work. Use the command from source, above.

Install script

$ curl -fsSL https://tidy.lukeed.com | sh

The script detects your platform, downloads the matching archive from the latest GitHub release, checks its SHA-256, and installs it to ~/.local/bin. The same URL in a browser shows the home page; curl gets the script, because the server answers on the user agent.

Read it before you run it:

$ curl -fsSL https://tidy.lukeed.com/install.sh | less

Two environment variables change what it does:

$ TIDY_INSTALL=/usr/local/bin curl -fsSL https://tidy.lukeed.com | sh

Prebuilt binaries

Each release on GitHub will carry an archive per platform, with a .sha256 beside it:

The Linux builds link against musl, so they run on any distribution and inside a scratch container.

Verified installs

Every release carries packslip.sigstore.json, a packslip manifest. It is signed by the release workflow's own identity, with no long-lived key, and it states each archive's digest, platform and the executables inside it.

That lets an installer verify what it downloads instead of trusting a file name or a checksum served beside the binary:

$ packslip install github.com/lukeed/tidy

mise reads the same manifest through its packslip backend:

$ mise use -g packslip:github.com/lukeed/tidy

To check an archive you already have:

$ packslip verify github.com/lukeed/tidy

The install script above checks the .sha256 published beside each archive, which catches a truncated download, not a hostile one — a POSIX shell cannot verify a signature. Where it matters, install through packslip or mise, which can.

Check it works

$ tidy --version
$ echo '<p   >hi</p>' | tidy --stdin-filepath index.html

The second command prints <p>hi</p>. If the shell cannot find tidy, the install directory is not on your PATH:

$ export PATH="$HOME/.local/bin:$PATH"

Add that to your shell profile to make it stick. For a cargo install, the directory is ~/.cargo/bin.

Next

• CLI — every flag.
• Configuration file — tidy.json, and where it is looked for.
• CI — failing a build on unformatted files.