fix(cli): update standalone installs through the verified installer
Summary
Fixes #1963.
agent-relay update always used npm, causing standalone installs to fail without npm or update a separate copy that their launcher did not use.
- Detect standalone installs and run the installer for the selected version.
- Require SHA-256 verification, validate the launcher, and preserve previous CLI/broker binaries if installation fails.
- Prevent standalone updates from falling back to npm or installing the optional ACP bridge.
- Report temporary-directory failures clearly.
- Preserve npm updates and non-zero failure exits.
Test Plan
- 7 focused updater tests passed.
- 180 installer checks passed.
- CLI build, lint, and formatting checks passed.
- Isolated execution test reproduced the original bug and verified the fix.
- Full CI and Cloud proof pending.
RelayFlow Proof
- Change type:
bugfix - RelayFlow case:
1963-standalone-update
Screenshots
N/A
![View with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v3.svg)
![Autofix with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg)
Need help on this PR? Tag @codesmith-bot with what you need.
[!NOTE]
Medium Risk
Changes affect install/update paths, binary verification, and privileged write safety; failures roll back but incorrect edge-case handling could block updates or leave version skew.
Overview
agent-relay update now upgrades standalone installs through the pinned install.sh path (AGENT_RELAY_INSTALL_STANDALONE_ONLY=1) instead of npm install -g, detecting install dir (including legacy paths and symlinks) and preserving a custom AGENT_RELAY_BIN_DIR only when PATH’s first agent-relay launcher targets this install.
The installer gains a strict standalone update mode: mandatory published SHA-256, CLI version must match the requested release, broker and launcher must verify, no npm fallback or optional ACP bridge, and clearer errors when temp dirs are unwritable. Launcher writes use destination-local temps with check_privileged_directory for root installs, and overlapping launcher/binary directories are rejected.
CI runs privileged atomic install tests in an isolated Docker container; atomic installer tests and CLI/RelayFlow coverage exercise rollback and failure paths.
Reviewed by Cursor Bugbot for commit b360e00898299ddc7d217c16e3106942a765924c. Bugbot is set up for automated code reviews on this repo. Configure here.