agent-relay 3.2.21 → 4.0.0

package/packages/telemetry/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,OAAO,EAEL,cAAc,EAKf,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAEV,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AA8DrB,wBAAgB,aAAa,CAAC,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,IAAI,CAsB1E;AAED,wBAAgB,KAAK,CAAC,CAAC,SAAS,kBAAkB,EAChD,KAAK,EAAE,CAAC,EACR,UAAU,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAChC,IAAI,CAWN;AAED,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAa9C;AAED,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B,wBAAgB,SAAS,IAAI;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAQA"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,OAAO,EAEL,cAAc,EAKf,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAoB,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AA8D3F,wBAAgB,aAAa,CAAC,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,IAAI,CAsB1E;AAED,wBAAgB,KAAK,CAAC,CAAC,SAAS,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,IAAI,CAWrG;AAED,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAa9C;AAED,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B,wBAAgB,SAAS,IAAI;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAQA"}

package/packages/telemetry/dist/client.js

@@ -57,7 +57,7 @@ function showFirstRunNotice() {
     console.log('');
     console.log('Agent Relay collects anonymous usage data to improve the product.');
     console.log('Run `agent-relay telemetry disable` to opt out.');
-    console.log('Learn more: https://agent-relay.com/telemetry');
+    console.log('Learn more: https://agentrelay.dev/telemetry');
     console.log('');
     markNotified();
 }

package/packages/telemetry/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,YAAY,EACZ,eAAe,EACf,SAAS,GACV,MAAM,aAAa,CAAC;AAMrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,IAAI,MAAM,GAAmB,IAAI,CAAC;AAClC,IAAI,WAAW,GAA4B,IAAI,CAAC;AAChD,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,SAAS,eAAe,CAAC,QAAgB;IACvC,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,OAAO,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,eAAe,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;YAClE,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO;QACL,mBAAmB,EAAE,UAAU,EAAE;QACjC,EAAE,EAAE,OAAO,CAAC,QAAQ;QACpB,UAAU,EAAE,EAAE,CAAC,OAAO,EAAE;QACxB,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,IAAI,WAAW,EAAE;QAAE,OAAO;IAE1B,IAAI,eAAe,EAAE,EAAE,CAAC;QACtB,YAAY,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,YAAY,EAAE,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAoC,EAAE;IAClE,IAAI,WAAW;QAAE,OAAO;IACxB,WAAW,GAAG,IAAI,CAAC;IAEnB,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QACjC,kBAAkB,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,kBAAkB,EAAE;QAAE,OAAO;IAElC,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IACzC,IAAI,CAAC,aAAa;QAAE,OAAO;IAE3B,MAAM,GAAG,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE;QACzC,IAAI,EAAE,aAAa,CAAC,IAAI;QACxB,OAAO,EAAE,EAAE;QACX,aAAa,EAAE,KAAK;QACpB,YAAY,EAAE,KAAK,EAAE,uDAAuD;KAC7E,CAAC,CAAC;IAEH,WAAW,GAAG,qBAAqB,EAAE,CAAC;IACtC,WAAW,GAAG,cAAc,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,KAAK,CACnB,KAAQ,EACR,UAAiC;IAEjC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW;QAAE,OAAO;IAEpD,MAAM,CAAC,OAAO,CAAC;QACb,UAAU,EAAE,WAAW;QACvB,KAAK;QACL,UAAU,EAAE;YACV,GAAG,WAAW;YACd,GAAG,UAAU;SACd;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,IAAI,CAAC;QACd,WAAW,GAAG,IAAI,CAAC;QACnB,WAAW,GAAG,IAAI,CAAC;QACnB,WAAW,GAAG,KAAK,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B,MAAM,UAAU,SAAS;IAMvB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,OAAO;QACL,OAAO,EAAE,kBAAkB,EAAE;QAC7B,aAAa,EAAE,eAAe,EAAE;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,YAAY,EACZ,eAAe,EACf,SAAS,GACV,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,IAAI,MAAM,GAAmB,IAAI,CAAC;AAClC,IAAI,WAAW,GAA4B,IAAI,CAAC;AAChD,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,SAAS,eAAe,CAAC,QAAgB;IACvC,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,OAAO,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,eAAe,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;YAClE,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO;QACL,mBAAmB,EAAE,UAAU,EAAE;QACjC,EAAE,EAAE,OAAO,CAAC,QAAQ;QACpB,UAAU,EAAE,EAAE,CAAC,OAAO,EAAE;QACxB,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,IAAI,WAAW,EAAE;QAAE,OAAO;IAE1B,IAAI,eAAe,EAAE,EAAE,CAAC;QACtB,YAAY,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,YAAY,EAAE,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAoC,EAAE;IAClE,IAAI,WAAW;QAAE,OAAO;IACxB,WAAW,GAAG,IAAI,CAAC;IAEnB,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QACjC,kBAAkB,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,kBAAkB,EAAE;QAAE,OAAO;IAElC,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IACzC,IAAI,CAAC,aAAa;QAAE,OAAO;IAE3B,MAAM,GAAG,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE;QACzC,IAAI,EAAE,aAAa,CAAC,IAAI;QACxB,OAAO,EAAE,EAAE;QACX,aAAa,EAAE,KAAK;QACpB,YAAY,EAAE,KAAK,EAAE,uDAAuD;KAC7E,CAAC,CAAC;IAEH,WAAW,GAAG,qBAAqB,EAAE,CAAC;IACtC,WAAW,GAAG,cAAc,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,KAAK,CAA+B,KAAQ,EAAE,UAAiC;IAC7F,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW;QAAE,OAAO;IAEpD,MAAM,CAAC,OAAO,CAAC;QACb,UAAU,EAAE,WAAW;QACvB,KAAK;QACL,UAAU,EAAE;YACV,GAAG,WAAW;YACd,GAAG,UAAU;SACd;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,IAAI,CAAC;QACd,WAAW,GAAG,IAAI,CAAC;QACnB,WAAW,GAAG,IAAI,CAAC;QACnB,WAAW,GAAG,KAAK,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B,MAAM,UAAU,SAAS;IAMvB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,OAAO;QACL,OAAO,EAAE,kBAAkB,EAAE;QAC7B,aAAa,EAAE,eAAe,EAAE;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC"}

package/packages/telemetry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-relay/telemetry",
-  "version": "3.2.21",
+  "version": "4.0.0",
   "description": "Anonymous telemetry for Agent Relay usage analytics",
   "type": "module",
   "main": "dist/index.js",

package/packages/telemetry/src/client.ts

@@ -15,11 +15,7 @@ import {
   isDisabledByEnv,
   loadPrefs,
 } from './config.js';
-import type {
-  CommonProperties,
-  TelemetryEventName,
-  TelemetryEventMap,
-} from './events.js';
+import type { CommonProperties, TelemetryEventName, TelemetryEventMap } from './events.js';
 import { getPostHogConfig } from './posthog-config.js';
 
 let client: PostHog | null = null;
@@ -75,7 +71,7 @@ function showFirstRunNotice(): void {
   console.log('');
   console.log('Agent Relay collects anonymous usage data to improve the product.');
   console.log('Run `agent-relay telemetry disable` to opt out.');
-  console.log('Learn more: https://agent-relay.com/telemetry');
+  console.log('Learn more: https://agentrelay.dev/telemetry');
   console.log('');
 
   markNotified();
@@ -105,10 +101,7 @@ export function initTelemetry(options: { showNotice?: boolean } = {}): void {
   anonymousId = getAnonymousId();
 }
 
-export function track<E extends TelemetryEventName>(
-  event: E,
-  properties?: TelemetryEventMap[E]
-): void {
+export function track<E extends TelemetryEventName>(event: E, properties?: TelemetryEventMap[E]): void {
   if (!client || !commonProps || !anonymousId) return;
 
   client.capture({

package/packages/trajectory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-relay/trajectory",
-  "version": "3.2.21",
+  "version": "4.0.0",
   "description": "Trajectory integration utilities (trail/PDERO) for Relay",
   "type": "module",
   "main": "dist/index.js",
@@ -22,7 +22,7 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@agent-relay/config": "3.2.21"
+    "@agent-relay/config": "4.0.0"
   },
   "devDependencies": {
     "@types/node": "^22.19.3",

package/packages/user-directory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-relay/user-directory",
-  "version": "3.2.21",
+  "version": "4.0.0",
   "description": "User directory service for agent-relay (per-user credential storage)",
   "type": "module",
   "main": "dist/index.js",
@@ -22,7 +22,7 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@agent-relay/utils": "3.2.21"
+    "@agent-relay/utils": "4.0.0"
   },
   "devDependencies": {
     "@types/node": "^22.19.3",

package/packages/utils/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-relay/utils",
-  "version": "3.2.21",
+  "version": "4.0.0",
   "description": "Shared utilities for agent-relay: logging, name generation, command resolution, update checking",
   "type": "module",
   "main": "dist/cjs/index.js",
@@ -112,7 +112,7 @@
     "vitest": "^3.2.4"
   },
   "dependencies": {
-    "@agent-relay/config": "3.2.21",
+    "@agent-relay/config": "4.0.0",
     "compare-versions": "^6.1.1"
   },
   "publishConfig": {

package/scripts/postinstall.js

@@ -10,6 +10,7 @@
  */
 
 import { execSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { createRequire } from 'node:module';
 import https from 'node:https';
 import path from 'node:path';
@@ -164,6 +165,74 @@ function getPackageVersion(pkgRoot) {
   }
 }
 
+/**
+ * Verify SHA-256 checksum of a downloaded file.
+ * Downloads a checksums file from the same release directory and verifies.
+ * Returns true if verified, false if checksums file not found (graceful fallback).
+ * Throws if checksums file exists but verification fails.
+ */
+async function verifyChecksum(filePath, downloadUrl) {
+  const checksumUrl = downloadUrl.replace(/\/[^/]+$/, '/checksums.sha256');
+  const binaryName = path.basename(downloadUrl);
+
+  try {
+    const checksumContent = await new Promise((resolve, reject) => {
+      const fetchWithRedirects = (url, remaining = 5) => {
+        const chunks = [];
+        const request = https.get(url, res => {
+          if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+            if (remaining <= 0) { res.resume(); reject(new Error('Too many redirects fetching checksums')); return; }
+            res.resume();
+            fetchWithRedirects(new URL(res.headers.location, url).toString(), remaining - 1);
+            return;
+          }
+          if (res.statusCode !== 200) {
+            res.resume();
+            reject(new Error(`Checksums file not available (HTTP ${res.statusCode})`));
+            return;
+          }
+          res.on('data', chunk => chunks.push(chunk));
+          res.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
+          res.on('error', reject);
+        });
+        request.on('error', reject);
+      };
+      fetchWithRedirects(checksumUrl);
+    });
+
+    // Parse checksums file (format: "<hash>  <filename>" per line)
+    const expectedHash = checksumContent
+      .split('\n')
+      .map(line => line.trim())
+      .filter(line => line.endsWith(binaryName))
+      .map(line => line.split(/\s+/)[0])[0];
+
+    if (!expectedHash) {
+      warn(`No checksum entry found for ${binaryName} in checksums file`);
+      return false;
+    }
+
+    const fileBuffer = fs.readFileSync(filePath);
+    const actualHash = createHash('sha256').update(fileBuffer).digest('hex');
+
+    if (actualHash !== expectedHash) {
+      throw new Error(
+        `Checksum mismatch for ${binaryName}: expected ${expectedHash}, got ${actualHash}`
+      );
+    }
+
+    info(`Checksum verified for ${binaryName}`);
+    return true;
+  } catch (err) {
+    if (err.message.includes('Checksum mismatch')) {
+      throw err; // Re-throw verification failures — this is a supply chain risk
+    }
+    // Checksums file not available — log warning but allow installation
+    warn(`Checksum verification skipped for ${binaryName}: ${err.message}`);
+    return false;
+  }
+}
+
 /**
  * Download a file via HTTPS, following redirects
  * Uses only built-in https module (no deps)
@@ -341,6 +410,7 @@ async function installBrokerBinary() {
 
       try {
         await downloadBinary(downloadUrl, targetPath);
+        await verifyChecksum(targetPath, downloadUrl);
         fs.chmodSync(targetPath, 0o755);
         resignBinaryForMacOS(targetPath);
         success(`Downloaded broker binary for ${os.platform()}-${os.arch()}`);
@@ -348,6 +418,8 @@ async function installBrokerBinary() {
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         warn(`Failed to download broker binary: ${message}`);
+        // Clean up partial/untrusted download
+        try { fs.unlinkSync(targetPath); } catch { /* ignore */ }
       }
     }
   }
@@ -414,6 +486,7 @@ async function installDashboardBinary() {
   try {
     fs.mkdirSync(path.dirname(targetPath), { recursive: true });
     await downloadBinary(downloadUrl, targetPath);
+    await verifyChecksum(targetPath, downloadUrl);
     fs.chmodSync(targetPath, 0o755);
     resignBinaryForMacOS(targetPath);
     success('Downloaded dashboard-server binary');
@@ -421,6 +494,7 @@ async function installDashboardBinary() {
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     info(`Dashboard binary not available (${message}) — will use npx fallback`);
+    try { fs.unlinkSync(targetPath); } catch { /* ignore */ }
     return false;
   }
 }
@@ -468,6 +542,7 @@ async function installRelayAcpBinary() {
   try {
     fs.mkdirSync(path.dirname(targetPath), { recursive: true });
     await downloadBinary(downloadUrl, targetPath);
+    await verifyChecksum(targetPath, downloadUrl);
     fs.chmodSync(targetPath, 0o755);
     resignBinaryForMacOS(targetPath);
     success('Downloaded relay-acp binary');
@@ -475,6 +550,7 @@ async function installRelayAcpBinary() {
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     info(`relay-acp binary not available (${message}) — Zed integration requires manual install`);
+    try { fs.unlinkSync(targetPath); } catch { /* ignore */ }
     return false;
   }
 }
@@ -676,7 +752,7 @@ function patchAgentTrajectories() {
     await storage.save(trajectory);`;
 
   if (!content.includes(optionNeedle) || !content.includes(createNeedle)) {
-    warn('agent-trajectories CLI format changed, skipping patch');
+    warn('agent-trajectories CLI format changed, skipping patch (expected needle not found)');
     return;
   }
 
@@ -684,10 +760,51 @@ function patchAgentTrajectories() {
     .replace(optionNeedle, optionReplacement)
     .replace(createNeedle, createReplacement);
 
+  // Verify the patch produced exactly the expected changes (no double-application or corruption)
+  if (updated === content) {
+    warn('agent-trajectories patch produced no changes, skipping write');
+    return;
+  }
+
   fs.writeFileSync(cliPath, updated, 'utf-8');
   success('Patched agent-trajectories to record agent on trail start');
 }
 
+function patchRelayauthCoreExports() {
+  const pkgRoot = getPackageRoot();
+  const packageJsonPath = path.join(pkgRoot, 'node_modules', '@relayauth', 'core', 'package.json');
+
+  try {
+    const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+    const rootExport = packageJson?.exports?.['.'];
+
+    if (!rootExport || typeof rootExport !== 'object' || Array.isArray(rootExport)) {
+      warn('@relayauth/core exports format changed, skipping require() compatibility patch');
+      return;
+    }
+
+    if (rootExport.require === './dist/index.js' && rootExport.default === './dist/index.js') {
+      info('@relayauth/core already supports require()');
+      return;
+    }
+
+    packageJson.exports['.'] = {
+      ...rootExport,
+      require: rootExport.require ?? './dist/index.js',
+      default: rootExport.default ?? './dist/index.js',
+    };
+
+    fs.writeFileSync(packageJsonPath, `${JSON.stringify(packageJson, null, 2)}\n`, 'utf-8');
+    success('Patched @relayauth/core package exports for require() compatibility');
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      info('@relayauth/core not installed, skipping require() compatibility patch');
+    } else {
+      warn(`Failed to patch @relayauth/core package exports: ${err.message}`);
+    }
+  }
+}
+
 function logPostinstallDiagnostics(hasBrokerBinary, sqliteStatus, linkResult) {
   // Workspace packages status (for global installs)
   if (linkResult && linkResult.needed) {
@@ -742,6 +859,9 @@ async function main() {
   // Ensure trail CLI captures agent info on start
   patchAgentTrajectories();
 
+  // Make the published @relayauth/core package work with CommonJS require()
+  patchRelayauthCoreExports();
+
   // Always install dashboard dependencies (needed for build)
   installDashboardDeps();