Install Runrail Desktop on Windows, macOS, or Linux.

Windows desktop

ZIP + PowerShell.

$expected = ((Get-Content .\runrail-desktop-v1.zip.sha256) -split '\s+')[0]
$actual = (Get-FileHash .\runrail-desktop-v1.zip -Algorithm SHA256).Hash
if ($actual -ne $expected) { throw "Runrail archive checksum mismatch" }
Expand-Archive .\runrail-desktop-v1.zip .
cd .\runrail-local-v1
node .\install.mjs
& "$env:LOCALAPPDATA\Runrail\bin\runrail.cmd" doctor --json
& "$env:LOCALAPPDATA\Runrail\bin\runrail-desktop.cmd"

The checksum mismatch check stops before extraction. Running the installer through Node avoids a PowerShell script execution-policy dependency on first use. The packaged install.ps1 wrapper remains available for managed environments and package lifecycle verification. The installer verifies every package file, creates the isolated Python environment, and adds Runrail Desktop to the Start Menu. The current Windows package is a Paid Alpha preview and is not yet vendor-signed, so SmartScreen may warn.

macOS desktop

ZIP + Applications.

shasum -a 256 -c runrail-desktop-v1.zip.sha256
unzip runrail-desktop-v1.zip
cd runrail-local-v1
./install.sh
# Run the exact nextCommands.doctor value printed by the installer.
open "$HOME/Applications/Runrail Desktop.app"

The checksum command stops before extraction when the archive does not match. The installer adds Runrail Desktop to your Applications directory. The current local bundle is checksum-verified but not yet Apple-notarized.

Linux and WSL2

TAR.GZ + desktop menu.

sha256sum -c runrail-local-v1.tar.gz.sha256
tar -xzf runrail-local-v1.tar.gz
cd runrail-local-v1
./install.sh
# Run the exact nextCommands.doctor and nextCommands.desktop values
# printed by the installer.

Linux receives a desktop-menu launcher. WSL2 uses the Windows host browser and prints the private loopback session URL if automatic launch is unavailable. The portable archive is checksum verified but is not yet signed by a Linux distribution repository.

Shared requirements

Local runtimes only.

Windows, macOS, Linux, or WSL2; Node.js 20+; Python 3.11+ with venv; and Git. No DeepSeek key is required. Repository review stays local; the subscriber service is contacted only for browser-authorized device enrollment and bounded entitlement renewal metadata.

First five minutes

Verify, enroll, then prove the workflow.

# These use "runrail" as shorthand only when binDirOnPath is true.
# Otherwise use the exact matching value from installer JSON nextCommands.
runrail doctor --json
runrail license request --json

# Select the generated public request in the subscriber console,
# download its single-use ticket, then:
runrail license enroll \
  --ticket /absolute/path/to/ticket.json \
  --json

runrail license --json
runrail sample --json
runrail desktop

The installer never edits PATH or shell profiles. Its JSON result reports binDirOnPath and prints exact full-path nextCommands whenever shorthand is unavailable. The public enrollment request contains a device public key, installation fingerprint, nonce, and proof of possession. It contains no private key, repository data, task text, or subscriber credential. After enrollment, Runrail creates a disposable local Git fixture and sends it through the real candidate-review path. The sample needs no repository choice or model-provider key and never applies source.

Bounded entitlement

Subscription metadata, never repository content.

The signed device lease grants subscription access only and cannot run a command, approve a patch, or apply source. There is no background daemon. When renewal is due, Runrail may make one bounded device-signed request containing entitlement metadata only. Normal review data, source, diffs, paths, tasks, verifier output, and model input are never sent to Veyact.

The guided sample then produces candidate.patch, audit.json, REVIEW.md, ROLLBACK.md, and review.html. It proves the installed review and export path is working; it does not prove semantic correctness or run project tests.

Candidate-branch review

Preflight an existing AI branch.

runrail review --repo /path/to/clean-repo \
  --base main \
  --candidate ai/candidate-change \
  --verifier python-compile \
  --json

Runrail checks bounded Git paths and diff limits, rejects secret-like and binary additions, compiles tracked Python syntax without importing project code, and exports local decision evidence.

No model required

Recommend the next review step offline.

runrail recommend \
  --audit /absolute/path/to/review/audit.json \
  --json

The default provider is Runrail's deterministic policy. It sends nothing, needs no API key, and cannot run a command, change a patch, approve a merge, or apply source.

Safe removal

Uninstall the app, keep your evidence.

# Windows PowerShell
node .\uninstall.mjs

# macOS, Linux, or WSL2
./uninstall.sh

The packaged uninstall.ps1 wrapper remains available for managed Windows environments. The uninstaller verifies Runrail's ownership record before removing the managed release, command launchers, and OS application entry. It refuses missing, changed, or symlinked ownership surfaces and preserves the local workspace and exported audit evidence by default.

Interrupted update

Recover before uninstalling.

If an update is interrupted, rerun the checksum-verified installer from the extracted package. It restores the prior verified release from the fixed backup before attempting a new install. Uninstall refuses to run while that recovery backup exists.

The installer does not edit shell profiles or add directories to PATH. When the launcher directory is not already available, its JSON result prints the full doctor and desktop commands to use.