feat: use get.agent-vault.dev short URL and add anonymous install beacon

.env.example

@@ -47,3 +47,9 @@
 # where TIER ∈ AUTH | PROXY | AUTHED | GLOBAL
 # and KNOB ∈ RATE | BURST | WINDOW | MAX | CONCURRENCY. Example:
 # AGENT_VAULT_RATELIMIT_PROXY_BURST=50
+
+# Installer (install.sh only — not read by the server or CLI binary).
+# Set to any non-empty value to disable the anonymous install/upgrade beacon.
+# Must be passed to `sh`, not `curl`:
+#   curl -fsSL https://get.agent-vault.dev | AGENT_VAULT_NO_TELEMETRY=1 sh
+# AGENT_VAULT_NO_TELEMETRY=1

docs/installation.mdx

@@ -13,11 +13,19 @@ Agent Vault ships as a single binary that acts as both a server and CLI client.
     Works for both fresh installs and upgrades (backs up your database before upgrading).
 
     ```bash
-    curl -fsSL https://raw.githubusercontent.com/Infisical/agent-vault/main/install.sh | sh
+    curl -fsSL https://get.agent-vault.dev | sh
     ```
 
     Supports macOS (Intel + Apple Silicon) and Linux (x86\_64 + ARM64).
 
+    <Note>
+      On a successful install the script sends an anonymous ping (OS, architecture, version — nothing else) so we can count installs for the launch. Opt out by placing `AGENT_VAULT_NO_TELEMETRY=1` in front of `sh`, not `curl`:
+
+      ```bash
+      curl -fsSL https://get.agent-vault.dev | AGENT_VAULT_NO_TELEMETRY=1 sh
+      ```
+    </Note>
+
   </Tab>
   <Tab title="Docker">
     No build tools required. Pull the image and run:
@@ -73,7 +81,7 @@ cosign verify-blob \
     Re-run the same install command — the script detects your existing installation, stops the running server, backs up your database, and installs the latest version:
 
     ```bash
-    curl -fsSL https://raw.githubusercontent.com/Infisical/agent-vault/main/install.sh | sh
+    curl -fsSL https://get.agent-vault.dev | sh
     ```
 
     Restart the server afterward:

docs/reference/cli.mdx

@@ -968,3 +968,11 @@ Manage the master password that wraps the data encryption key (DEK). All command
     Print the version and build information.
   </Accordion>
 </AccordionGroup>
+
+## Installer
+
+The [`install.sh`](https://github.com/Infisical/agent-vault/blob/main/install.sh) script (`curl -fsSL https://get.agent-vault.dev | sh`) is not part of the `agent-vault` binary but reads one environment variable:
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `AGENT_VAULT_NO_TELEMETRY` | (unset) | When set to any non-empty value, skips the anonymous install/upgrade beacon (OS, architecture, version — nothing else). Must be placed in front of `sh`, not `curl`: `curl -fsSL https://get.agent-vault.dev \| AGENT_VAULT_NO_TELEMETRY=1 sh`. |

docs/self-hosting/environment-variables.mdx

@@ -28,6 +28,14 @@ Master password resolution order:
   Never put `AGENT_VAULT_MASTER_PASSWORD` in Dockerfiles, committed `.env` files, or shell history. Use secret management features of your deployment platform (e.g., `fly secrets set`, Docker secrets, or your CI/CD provider's secret store).
 </Warning>
 
+## Installer
+
+Read by [`install.sh`](https://github.com/Infisical/agent-vault/blob/main/install.sh) only — not by the server or the CLI binary.
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `AGENT_VAULT_NO_TELEMETRY` | (unset) | When set to any non-empty value, skips the anonymous install/upgrade beacon that reports OS, architecture, and version. Must be placed in front of `sh`, not `curl`: `curl -fsSL https://get.agent-vault.dev \| AGENT_VAULT_NO_TELEMETRY=1 sh`. |
+
 ## Email SMTP configuration
 
 Configure SMTP to enable Agent Vault to send emails for verification codes, vault invites, and notifications.

docs/self-hosting/local.mdx

@@ -8,11 +8,19 @@ description: "Install and run Agent Vault on Linux or macOS using the install sc
 Auto-detects your OS and architecture, downloads the latest release, and installs. Works for both fresh installs and upgrades.
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/Infisical/agent-vault/main/install.sh | sh
+curl -fsSL https://get.agent-vault.dev | sh
 ```
 
 Supports macOS (Intel + Apple Silicon) and Linux (x86\_64 + ARM64).
 
+<Note>
+  On a successful install the script sends an anonymous ping (OS, architecture, version — nothing else) so we can count installs for the launch. Opt out by placing `AGENT_VAULT_NO_TELEMETRY=1` in front of `sh`, not `curl`:
+
+  ```bash
+  curl -fsSL https://get.agent-vault.dev | AGENT_VAULT_NO_TELEMETRY=1 sh
+  ```
+</Note>
+
 Verify the installation:
 
 ```bash
@@ -114,9 +122,17 @@ See the [CLI reference](/reference/cli#ca) for all `agent-vault ca fetch` flags.
 Re-run the same install command — the script detects your existing installation, stops the running server, backs up your database, and installs the latest version:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/Infisical/agent-vault/main/install.sh | sh
+curl -fsSL https://get.agent-vault.dev | sh
 ```
 
+<Note>
+  On a successful upgrade the script sends the same anonymous ping (OS, architecture, version). Opt out by placing `AGENT_VAULT_NO_TELEMETRY=1` in front of `sh`, not `curl`:
+
+  ```bash
+  curl -fsSL https://get.agent-vault.dev | AGENT_VAULT_NO_TELEMETRY=1 sh
+  ```
+</Note>
+
 Restart the server afterward:
 
 ```bash

install.sh

@@ -2,10 +2,14 @@
 set -e
 
 # Agent Vault installer
-# Usage: curl -fsSL https://raw.githubusercontent.com/Infisical/agent-vault/main/install.sh | sh
+# Usage: curl -fsSL https://get.agent-vault.dev | sh
 #
 # Supports: macOS (Intel + Apple Silicon), Linux (amd64 + arm64)
 # Works for both fresh install and upgrade.
+#
+# Privacy: on successful install, sends an anonymous ping with OS, arch,
+# and version only — no identifiers, no IP retention. Opt out with:
+#   curl -fsSL https://get.agent-vault.dev | AGENT_VAULT_NO_TELEMETRY=1 sh
 
 REPO="Infisical/agent-vault"
 INSTALL_DIR="/usr/local/bin"
@@ -156,7 +160,7 @@ main() {
     INSTALLED_VERSION="$(agent-vault version 2>/dev/null || echo "")"
     if [ -z "$INSTALLED_VERSION" ]; then
         warn "Could not verify installed binary."
-        if [ -n "$EXISTING_VERSION" ]; then
+        if [ -n "$BACKUP_FILE" ]; then
             warn "A database backup was saved at: ${BACKUP_FILE}"
         fi
         error "Installation may have failed. Check that ${INSTALL_DIR} is in your PATH."
@@ -167,7 +171,9 @@ main() {
 
     if [ -n "$EXISTING_VERSION" ] && [ "$EXISTING_VERSION" != "unknown" ]; then
         info "Upgraded from ${EXISTING_VERSION}"
-        info "Database backup: ${BACKUP_FILE}"
+        if [ -n "$BACKUP_FILE" ]; then
+            info "Database backup: ${BACKUP_FILE}"
+        fi
     fi
 
     if [ "$SERVER_WAS_RUNNING" = true ]; then
@@ -176,6 +182,16 @@ main() {
         info "Run 'agent-vault server' to start it again."
         info "Database migrations (if any) will run automatically on startup."
     fi
+
+    # Anonymous completion beacon. No PII, no identifiers.
+    # Opt out: AGENT_VAULT_NO_TELEMETRY=1
+    if [ -z "$AGENT_VAULT_NO_TELEMETRY" ]; then
+        EVENT="install"
+        if [ -n "$EXISTING_VERSION" ] && [ "$EXISTING_VERSION" != "unknown" ]; then
+            EVENT="upgrade"
+        fi
+        curl -fsS -m 3 "https://get.agent-vault.dev/ok?os=${OS}&arch=${ARCH}&v=${LATEST}&event=${EVENT}" >/dev/null 2>&1 || true
+    fi
 }
 
 main "$@"

web/src/pages/Register.tsx

@@ -63,7 +63,7 @@ function InviteOnlyNotice() {
   );
 }
 
-const INSTALL_COMMAND = "curl -fsSL https://raw.githubusercontent.com/Infisical/agent-vault/main/install.sh | sh";
+const INSTALL_COMMAND = "curl -fsSL https://get.agent-vault.dev | sh";
 
 function CommandBlock({ command }: { command: string }) {
   const [copied, setCopied] = useState(false);