@@ -97,19 +97,19 @@ fi
 
 # Check if sha256sum or shasum is available (for checksum verification)
 HAS_CHECKSUM_TOOL=false
-CHECKSUM_CMD=""
+CHECKSUM_CMD=()
 if command -v sha256sum &> /dev/null; then
     HAS_CHECKSUM_TOOL=true
-    CHECKSUM_CMD="sha256sum"
+    CHECKSUM_CMD=(sha256sum)
 elif command -v shasum &> /dev/null; then
     HAS_CHECKSUM_TOOL=true
-    CHECKSUM_CMD="shasum -a 256"
+    CHECKSUM_CMD=(shasum -a 256)
 fi
 
 if [ "$SKIP_CHECKSUM" = false ] && [ "$HAS_CHECKSUM_TOOL" = false ]; then
-    print_warning "Neither sha256sum nor shasum is available. Checksum verification will be skipped."
-    print_warning "To suppress this warning, use --skip-checksum flag."
-    SKIP_CHECKSUM=true
+    print_error "Neither sha256sum nor shasum is available. Cannot verify binary integrity."
+    print_info "Install sha256sum or shasum and retry."
+    exit 1
 fi
 
 # Determine OS and architecture
@@ -527,63 +527,90 @@ fi
 # Download and verify checksums if not skipped
 if [ "$SKIP_CHECKSUM" = false ]; then
     print_info "Downloading checksums file..."
-    CHECKSUMS_DOWNLOADED=false
-    
-    for attempt in $(seq 1 $MAX_RETRIES); do
-        if curl -L -f --connect-timeout 15 --max-time 60 -o "$CHECKSUMS_PATH" "$CHECKSUMS_URL" 2>/dev/null; then
-            CHECKSUMS_DOWNLOADED=true
-            print_success "Checksums file downloaded successfully"
-            break
-        else
-            if [ "$attempt" -eq "$MAX_RETRIES" ]; then
-                print_warning "Failed to download checksums file after $MAX_RETRIES attempts"
-                print_warning "Checksum verification will be skipped for this version."
-                print_info "This may occur for older releases that don't include checksums."
-                break
-            else
+    download_checksums_with_retry() {
+        local url="$1"
+        for attempt in $(seq 1 $MAX_RETRIES); do
+            if curl -L -f --connect-timeout 15 --max-time 60 -o "$CHECKSUMS_PATH" "$url" 2>/dev/null; then
+                print_success "Checksums file downloaded successfully"
+                return 0
+            fi
+            if [ "$attempt" -lt "$MAX_RETRIES" ]; then
                 print_warning "Checksum download attempt $attempt failed. Retrying in 2s..."
                 sleep 2
             fi
-        fi
-    done
-    
-    # Verify checksum if we downloaded it successfully
-    if [ "$CHECKSUMS_DOWNLOADED" = true ]; then
-        print_info "Verifying binary checksum..."
-        
-        # Determine the expected filename in the checksums file
-        EXPECTED_FILENAME="$PLATFORM"
-        if [ "$OS_NAME" = "windows" ]; then
-            EXPECTED_FILENAME="${PLATFORM}.exe"
-        fi
-        
-        # Extract the expected checksum from the checksums file (exact filename match on field 2)
-        EXPECTED_CHECKSUM=$(awk -v f="$EXPECTED_FILENAME" '$2 == f {print $1}' "$CHECKSUMS_PATH")
-        
-        if [ -z "$EXPECTED_CHECKSUM" ]; then
-            print_warning "Checksum for $EXPECTED_FILENAME not found in checksums file"
-            print_warning "Checksum verification will be skipped."
-        else
-            # Compute the actual checksum of the downloaded binary
-            ACTUAL_CHECKSUM=$($CHECKSUM_CMD "$STAGED_BINARY_PATH" | awk '{print $1}')
-            
-            if [ "$ACTUAL_CHECKSUM" = "$EXPECTED_CHECKSUM" ]; then
-                print_success "Checksum verification passed!"
-                print_info "Expected: $EXPECTED_CHECKSUM"
-                print_info "Actual:   $ACTUAL_CHECKSUM"
+        done
+        return 1
+    }
+
+    if ! download_checksums_with_retry "$CHECKSUMS_URL"; then
+        if [ -n "$FALLBACK_CHECKSUMS_URL" ] && [ "$CHECKSUMS_URL" != "$FALLBACK_CHECKSUMS_URL" ]; then
+            print_warning "Failed to download checksums from latest redirect URL. Retrying with resolved tag URL ($LATEST_TAG)."
+            CHECKSUMS_URL="$FALLBACK_CHECKSUMS_URL"
+            if download_checksums_with_retry "$CHECKSUMS_URL"; then
+                CHECKSUMS_DOWNLOADED=true
             else
-                print_error "Checksum verification failed!"
-                print_error "Expected: $EXPECTED_CHECKSUM"
-                print_error "Actual:   $ACTUAL_CHECKSUM"
-                print_error "The downloaded binary may be corrupted or tampered with."
-                print_info "To skip checksum verification, use: ./install-gh-aw.sh $VERSION --skip-checksum"
-                exit 1
+                CHECKSUMS_DOWNLOADED=false
             fi
+        else
+            CHECKSUMS_DOWNLOADED=false
+        fi
+        if [ "$CHECKSUMS_DOWNLOADED" = false ]; then
+            print_error "Failed to download checksums file after $MAX_RETRIES attempts"
+            print_error "Cannot verify binary integrity. Installation aborted."
+            print_info "Check that $CHECKSUMS_URL is available and retry."
+            print_info "For older releases without checksums.txt, prefer a release with checksums or explicitly use --skip-checksum (disables integrity verification; corrupted or tampered binaries may be executed)."
+            exit 1
         fi
-        
-        # Clean up checksums file
-        rm -f "$CHECKSUMS_PATH"
     fi
+
+    print_info "Verifying binary checksum..."
+
+    EXPECTED_FILENAME="$PLATFORM"
+    if [ "$OS_NAME" = "windows" ]; then
+        EXPECTED_FILENAME="${PLATFORM}.exe"
+    fi
+
+    # Require exactly one well-formed SHA256 entry for the exact release asset.
+    if ! EXPECTED_CHECKSUM=$(awk -v f="$EXPECTED_FILENAME" '
+        $2 == f {
+            count++
+            if (NF != 2 || length($1) != 64 || $1 !~ /^[0-9a-fA-F]+$/) {
+                invalid = 1
+            }
+            checksum = tolower($1)
+        }
+        END {
+            if (count != 1 || invalid) {
+                exit 1
+            }
+            print checksum
+        }
+    ' "$CHECKSUMS_PATH"); then
+        print_error "Missing or malformed checksum for $EXPECTED_FILENAME in checksums file."
+        print_error "Cannot verify binary integrity. Installation aborted."
+        print_info "Use a release with exactly one valid SHA256 checksum for $EXPECTED_FILENAME."
+        exit 1
+    fi
+
+    if ! CHECKSUM_OUTPUT=$("${CHECKSUM_CMD[@]}" "$STAGED_BINARY_PATH"); then
+        print_error "Failed to compute binary checksum. Installation aborted."
+        exit 1
+    fi
+    ACTUAL_CHECKSUM=$(printf '%s\n' "$CHECKSUM_OUTPUT" | awk '{print tolower($1)}')
+
+    if [[ "$ACTUAL_CHECKSUM" =~ ^[0-9a-f]{64}$ ]] && [ "$ACTUAL_CHECKSUM" = "$EXPECTED_CHECKSUM" ]; then
+        print_success "Checksum verification passed!"
+        print_info "Expected: $EXPECTED_CHECKSUM"
+        print_info "Actual:   $ACTUAL_CHECKSUM"
+    else
+        print_error "Checksum verification failed!"
+        print_error "Expected: $EXPECTED_CHECKSUM"
+        print_error "Actual:   $ACTUAL_CHECKSUM"
+        print_error "The downloaded binary may be corrupted or tampered with. Installation aborted."
+        exit 1
+    fi
+
+    rm -f "$CHECKSUMS_PATH"
 else
     print_warning "Checksum verification skipped (--skip-checksum flag used)"
 fi
 
@@ -85,6 +85,10 @@ async function run() {
 
   await sendOtlpSpan.sendJobConclusionSpan(spanName, { startMs });
 
+  if (getActionInput("JOB_NAME") === "conclusion") {
+    await require("./send_otlp_session_logs.cjs").sendSessionLogs();
+  }
+
   if (endpoints) {
     core.info("[otlp] conclusion span export attempted");
   }
 
@@ -19,7 +19,7 @@ const { createAuthenticatedGitHubClient } = require("./handler_auth.cjs");
 const { getMessages } = require("./messages_core.cjs");
 const { sanitizeContent } = require("./sanitize_content.cjs");
 const { MAX_COMMENT_LENGTH, MAX_COMMENT_INPUT_LENGTH, MAX_MENTIONS, MAX_LINKS, enforceCommentLimits } = require("./comment_limit_helpers.cjs");
-const { renderSizedReport } = require("./report_size.cjs");
+const { fitMarkdownBody } = require("./report_size.cjs");
 const { createDiscussionComment, resolveTopLevelDiscussionCommentId } = require("./github_api_helpers.cjs");
 const { logStagedPreviewInfo } = require("./staged_preview.cjs");
 const { ERR_CONFIG, ERR_NOT_FOUND } = require("./error_codes.cjs");
@@ -839,7 +839,7 @@ async function main(config = {}) {
     // Enforce max limits again after adding footer and metadata
     // Length and mention limits include metadata; only agent content counts toward the link limit.
     try {
-      processedBody = renderSizedReport(report, MAX_COMMENT_LENGTH).body;
+      processedBody = fitMarkdownBody(report, { maxLength: MAX_COMMENT_LENGTH });
       enforceCommentLimits(processedBody, { maxLinks, linkBody });
     } catch (error) {
       const errorMessage = getErrorMessage(error);
 
@@ -0,0 +1,169 @@
+"use strict";
+
+const ADD_LABELS_OBJECT_ONLY_FIELD_DESC = "Labels to add. Each label must be an object matching the configured item schema; plain string label names are not permitted. Labels must exist in the repository.";
+
+const OBJECT_SCHEMA_KEYS = new Set(["type", "properties", "required", "additionalProperties", "title", "description", "$comment"]);
+const PROPERTY_SCHEMA_KEYS = new Set(["type", "enum", "const", "title", "description", "$comment", "default", "examples"]);
+
+/**
+ * @param {unknown} value
+ * @returns {value is Record<string, unknown>}
+ */
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+/**
+ * @param {unknown} value
+ * @param {unknown} type
+ * @returns {boolean}
+ */
+function matchesType(value, type) {
+  if (type === undefined) return true;
+  const types = Array.isArray(type) ? type : [type];
+  return types.some(candidate => {
+    switch (candidate) {
+      case "array":
+        return Array.isArray(value);
+      case "object":
+        return isRecord(value);
+      case "integer":
+        return typeof value === "number" && Number.isInteger(value);
+      case "number":
+        return typeof value === "number" && Number.isFinite(value);
+      case "null":
+        return value === null;
+      case "boolean":
+        return typeof value === "boolean";
+      case "string":
+        return typeof value === "string";
+      default:
+        return false;
+    }
+  });
+}
+
+/**
+ * @param {string} fieldName
+ * @param {unknown} schema
+ * @returns {{value: unknown} | null}
+ */
+function buildAddLabelsExampleValue(fieldName, schema) {
+  if (!isRecord(schema) || Object.keys(schema).some(key => !PROPERTY_SCHEMA_KEYS.has(key))) {
+    return null;
+  }
+
+  const type = schema.type;
+  let value;
+  if (Object.prototype.hasOwnProperty.call(schema, "const")) {
+    value = schema.const;
+    if (Array.isArray(schema.enum) && !schema.enum.some(candidate => Object.is(candidate, value))) {
+      return null;
+    }
+  } else if (Array.isArray(schema.enum)) {
+    value = schema.enum.find(candidate => matchesType(candidate, type));
+    if (value === undefined) return null;
+  } else {
+    switch (type) {
+      case "boolean":
+        value = true;
+        break;
+      case "integer":
+      case "number":
+        value = 0;
+        break;
+      case "string":
+        value = fieldName === "name" ? "bug" : fieldName === "rationale" ? "Why this label applies" : "value";
+        break;
+      default:
+        return null;
+    }
+  }
+
+  return matchesType(value, type) ? { value } : null;
+}
+
+/**
+ * @param {unknown} itemSchema
+ * @returns {Record<string, unknown> | null}
+ */
+function getAddLabelsObjectSchema(itemSchema) {
+  if (!isRecord(itemSchema)) return null;
+  if (itemSchema.type === "object") return itemSchema;
+  if (Array.isArray(itemSchema.oneOf)) {
+    return itemSchema.oneOf.find(schema => isRecord(schema) && schema.type === "object") ?? null;
+  }
+  return null;
+}
+
+/**
+ * Build the schema-derived required fields and an example only when all required values
+ * can be inferred without violating declared schema constraints.
+ * @param {unknown} itemSchema
+ * @returns {{required: string[], fields: string[], example: string | null} | null}
+ */
+function buildAddLabelsObjectShape(itemSchema) {
+  const objectSchema = getAddLabelsObjectSchema(itemSchema);
+  if (!objectSchema) return null;
+
+  const schemaKeys = Object.keys(objectSchema);
+  const safeObjectSchema = schemaKeys.every(key => OBJECT_SCHEMA_KEYS.has(key));
+  const properties = isRecord(objectSchema.properties) ? objectSchema.properties : {};
+  const required = Array.isArray(objectSchema.required) ? objectSchema.required.filter(field => typeof field === "string") : [];
+  /** @type {string | null} */
+  let example = null;
+
+  if (safeObjectSchema && required.length > 0) {
+    const exampleValue = Object.create(null);
+    let canBuildExample = true;
+    for (const field of required) {
+      if (!Object.prototype.hasOwnProperty.call(properties, field)) {
+        canBuildExample = false;
+        break;
+      }
+      const fieldValue = buildAddLabelsExampleValue(field, properties[field]);
+      if (!fieldValue) {
+        canBuildExample = false;
+        break;
+      }
+      exampleValue[field] = fieldValue.value;
+    }
+    if (canBuildExample) example = JSON.stringify(exampleValue);
+  }
+
+  return {
+    required,
+    fields: Object.keys(properties),
+    example,
+  };
+}
+
+/**
+ * Build accurate object-only guidance for the generated add_labels labels field.
+ * @param {unknown} itemSchema
+ * @returns {string}
+ */
+function buildAddLabelsObjectOnlyFieldDesc(itemSchema) {
+  const shape = buildAddLabelsObjectShape(itemSchema);
+  if (!shape) return ADD_LABELS_OBJECT_ONLY_FIELD_DESC;
+
+  const guidance = [];
+  if (shape.required.length > 0) {
+    guidance.push(`Required fields: ${shape.required.join(", ")}.`);
+  } else {
+    guidance.push("No required fields are declared by the configured item schema.");
+    if (shape.fields.length > 0) {
+      guidance.push(`Available fields: ${shape.fields.join(", ")}.`);
+    }
+  }
+  if (shape.example) {
+    guidance.push(`Example: [${shape.example}].`);
+  }
+
+  return `Labels to add. Each label must be an object matching the configured item schema; plain string label names are not permitted. ${guidance.join(" ")} Labels must exist in the repository.`;
+}
+
+module.exports = {
+  buildAddLabelsObjectOnlyFieldDesc,
+  buildAddLabelsObjectShape,
+};
Original file line number	Diff line number	Diff line change
`@@ -85,6 +85,10 @@ async function run() {`
`85`	`85`
`86`	`86`	`await sendOtlpSpan.sendJobConclusionSpan(spanName, { startMs });`
`87`	`87`
	`88`	`+ if (getActionInput("JOB_NAME") === "conclusion") {`
	`89`	`+ await require("./send_otlp_session_logs.cjs").sendSessionLogs();`
	`90`	`+ }`
	`91`	`+`
`88`	`92`	`if (endpoints) {`
`89`	`93`	`core.info("[otlp] conclusion span export attempted");`
`90`	`94`	`}`