fix: address code review findings across 11 reviews

- install.sh: make checksum verification fail-closed (exit on
  missing SHA256SUMS/checksum/tool unless AGENTSVIEW_SKIP_CHECKSUM=1)
- release.sh: use ${1:-} for set -u safety, remove unused gh check
- changelog.sh: handle no-tag repos (include root commit), quote
  $RANGE to prevent word-splitting
- export.go: fix toggle CSS selector to match actual DOM structure
  (use ~ combinator through header element)
- Heatmap.svelte: replace flex centering with margin:0 auto on SVG
  to preserve scroll origin on narrow viewports
- update.go: mark cache-only UpdateInfo so CLI re-fetches full
  metadata for installs; surface rollback errors on failed install

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: wesm

cmd/agentsview/update.go

@@ -58,6 +58,19 @@ func runUpdate(args []string) {
 		if *check {
 			return
 		}
+		// Cache-only results lack download metadata; re-fetch.
+		if info.NeedsRefetch() {
+			info, err = update.CheckForUpdate(
+				version, true, dataDir,
+			)
+			if err != nil {
+				log.Fatalf("checking for updates: %v", err)
+			}
+			if info == nil {
+				fmt.Println("Up to date.")
+				return
+			}
+		}
 	} else {
 		fmt.Printf(
 			"Update available: %s -> %s",

frontend/src/lib/components/analytics/Heatmap.svelte

@@ -277,12 +277,11 @@
   .heatmap-scroll {
     overflow-x: auto;
     padding-bottom: 4px;
-    display: flex;
-    justify-content: center;
   }
 
   .heatmap-svg {
     display: block;
+    margin: 0 auto;
   }
 
   .day-label, .month-label {

internal/server/export.go

@@ -460,7 +460,8 @@ main { max-width: 900px; margin: 0 auto; padding: 16px; }
   color: var(--text-primary);
   cursor: pointer; font-size: 11px;
 }
-.toggle-input:checked + .toggle-label {
+#thinking-toggle:checked ~ header label[for="thinking-toggle"],
+#sort-toggle:checked ~ header label[for="sort-toggle"] {
   background: var(--accent-blue); color: #fff;
   border-color: var(--accent-blue);
 }

internal/update/update.go

@@ -50,6 +50,15 @@ type UpdateInfo struct {
 	Size           int64
 	Checksum       string
 	IsDevBuild     bool
+	// cacheOnly is set when the info came from cache and lacks
+	// download metadata. The caller must re-fetch for installs.
+	cacheOnly bool
+}
+
+// NeedsRefetch returns true when the info came from cache
+// and lacks the download URL/checksum needed for an install.
+func (u *UpdateInfo) NeedsRefetch() bool {
+	return u.cacheOnly
 }
 
 // findAssets locates the platform binary and checksums file.
@@ -288,7 +297,12 @@ func installBinaryTo(srcPath, dstPath string) error {
 	}
 
 	if err := copyFile(srcPath, dstPath); err != nil {
-		_ = os.Rename(backupPath, dstPath)
+		if restoreErr := os.Rename(backupPath, dstPath); restoreErr != nil {
+			return fmt.Errorf(
+				"install: %w (rollback also failed: %v)",
+				err, restoreErr,
+			)
+		}
 		return fmt.Errorf("install: %w", err)
 	}
 
@@ -645,10 +659,14 @@ func checkCache(
 	latestVersion := strings.TrimPrefix(cached.Version, "v")
 
 	if isDevBuild {
+		// Cache only records the version, not full asset metadata.
+		// Return nil so the caller re-fetches with full info when
+		// an install (not just --check) is needed.
 		return &UpdateInfo{
 			CurrentVersion: currentVersion,
 			LatestVersion:  cached.Version,
 			IsDevBuild:     true,
+			cacheOnly:      true,
 		}, true
 	}
 

scripts/changelog.sh

@@ -19,17 +19,22 @@ if [ -n "$START_TAG" ] && [ "$START_TAG" != "-" ]; then
 else
     PREV_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
     if [ -z "$PREV_TAG" ]; then
-        FIRST_COMMIT=$(git rev-list --max-parents=0 HEAD)
-        RANGE="$FIRST_COMMIT..HEAD"
+        RANGE=""
         echo "No previous release found. Generating changelog for all commits..." >&2
     else
         RANGE="$PREV_TAG..HEAD"
         echo "Generating changelog from $PREV_TAG to HEAD..." >&2
     fi
 fi
 
-COMMITS=$(git log $RANGE --pretty=format:"- %s (%h)" --no-merges)
-DIFF_STAT=$(git diff --stat $RANGE)
+if [ -n "$RANGE" ]; then
+    COMMITS=$(git log "$RANGE" --pretty=format:"- %s (%h)" --no-merges)
+    DIFF_STAT=$(git diff --stat "$RANGE")
+else
+    COMMITS=$(git log --pretty=format:"- %s (%h)" --no-merges)
+    EMPTY_TREE=$(git hash-object -t tree /dev/null)
+    DIFF_STAT=$(git diff --stat "$EMPTY_TREE" HEAD)
+fi
 
 if [ -z "$COMMITS" ]; then
     echo "No commits since last release" >&2

scripts/install.sh

@@ -68,15 +68,17 @@ verify_checksum() {
     local filename="$3"
 
     if [ ! -f "$checksums_file" ]; then
-        warn "Checksum file not available, skipping verification"
-        return 0
+        if [ "${AGENTSVIEW_SKIP_CHECKSUM:-0}" = "1" ]; then
+            warn "Checksum file not available, skipping verification (AGENTSVIEW_SKIP_CHECKSUM=1)"
+            return 0
+        fi
+        error "Checksum file not available. Set AGENTSVIEW_SKIP_CHECKSUM=1 to bypass."
     fi
 
     local expected
     expected=$(awk -v f="$filename" '{gsub(/^\*/, "", $2); if ($2==f) {print $1; exit}}' "$checksums_file")
     if [ -z "$expected" ]; then
-        warn "No checksum found for $filename, skipping verification"
-        return 0
+        error "No checksum found for $filename in SHA256SUMS"
     fi
 
     local actual
@@ -85,8 +87,7 @@ verify_checksum() {
     elif command -v shasum &>/dev/null; then
         actual=$(shasum -a 256 "$file" | cut -d' ' -f1)
     else
-        warn "No sha256 tool available, skipping verification"
-        return 0
+        error "No sha256 tool available. Install coreutils or set AGENTSVIEW_SKIP_CHECKSUM=1 to bypass."
     fi
 
     if [ "$expected" != "$actual" ]; then
@@ -124,11 +125,8 @@ install_from_release() {
         return 1
     fi
 
-    if download "${base_url}/SHA256SUMS" "$tmpdir/SHA256SUMS" 2>/dev/null; then
-        verify_checksum "$tmpdir/release.tar.gz" "$tmpdir/SHA256SUMS" "$filename"
-    else
-        warn "WARNING: Could not download SHA256SUMS -- integrity not verified"
-    fi
+    download "${base_url}/SHA256SUMS" "$tmpdir/SHA256SUMS" 2>/dev/null || true
+    verify_checksum "$tmpdir/release.tar.gz" "$tmpdir/SHA256SUMS" "$filename"
 
     info "Extracting..."
     tar -xzf "$tmpdir/release.tar.gz" -C "$tmpdir"

scripts/release.sh

@@ -3,7 +3,7 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
-VERSION="$1"
+VERSION="${1:-}"
 EXTRA_INSTRUCTIONS="${2:-}"
 
 if [ -z "$VERSION" ]; then
@@ -30,11 +30,6 @@ if ! git diff-index --quiet HEAD --; then
     exit 1
 fi
 
-if ! command -v gh &> /dev/null; then
-    echo "Error: gh CLI is required. Install from https://cli.github.com/"
-    exit 1
-fi
-
 # Generate changelog
 CHANGELOG_FILE=$(mktemp)
 trap 'rm -f "$CHANGELOG_FILE"' EXIT