fix: address review findings

- install.sh: verify SHA-256 checksum before installing binary
- install.sh: fallback to ~/.local/bin if /usr/local/bin not writable
- install.sh: use sed instead of grep for POSIX-safe JSON parsing
- release.yml: remove jq dependency, parse release ID with sed
- llm: make temperature configurable via --llm-temperature / LLM_TEMPERATURE
- llm: add WithTemperature builder method on Client
- llm: omit temperature from request when zero (uses server default)

install.sh

@@ -6,7 +6,18 @@ set -euo pipefail
 
 GITEA_URL="${GITEA_URL:-https://gitea.weiker.me}"
 REPO="rodin/review-bot"
-INSTALL_DIR="${INSTALL_DIR:-/usr/local/bin}"
+INSTALL_DIR="${INSTALL_DIR:-}"
+
+# Determine install directory with fallback
+if [ -z "$INSTALL_DIR" ]; then
+  if [ -w /usr/local/bin ]; then
+    INSTALL_DIR="/usr/local/bin"
+  else
+    INSTALL_DIR="${HOME}/.local/bin"
+    mkdir -p "$INSTALL_DIR"
+    echo "Note: Installing to $INSTALL_DIR (add to PATH if needed)"
+  fi
+fi
 
 OS=$(uname -s | tr '[:upper:]' '[:lower:]')
 ARCH=$(uname -m)
@@ -18,8 +29,8 @@ esac
 
 BINARY="review-bot-${OS}-${ARCH}"
 
-# Get latest release tag
-LATEST=$(curl -sSf "${GITEA_URL}/api/v1/repos/${REPO}/releases?limit=1" | grep -o '"tag_name":"[^"]*"' | head -1 | cut -d'"' -f4)
+# Get latest release tag (POSIX-safe parsing without jq)
+LATEST=$(curl -sSf "${GITEA_URL}/api/v1/repos/${REPO}/releases?limit=1" | sed -n 's/.*"tag_name":"\([^"]*\)".*/\1/p' | head -1)
 
 if [ -z "$LATEST" ]; then
   echo "Failed to determine latest release" >&2
@@ -29,7 +40,36 @@ fi
 echo "Installing review-bot ${LATEST} (${OS}/${ARCH})..."
 
 DOWNLOAD_URL="${GITEA_URL}/${REPO}/releases/download/${LATEST}/${BINARY}"
-curl -sSfL -o "${INSTALL_DIR}/review-bot" "$DOWNLOAD_URL"
+CHECKSUM_URL="${GITEA_URL}/${REPO}/releases/download/${LATEST}/checksums.txt"
+
+# Download binary and checksums
+TMPDIR=$(mktemp -d)
+trap 'rm -rf "$TMPDIR"' EXIT
+
+curl -sSfL -o "${TMPDIR}/${BINARY}" "$DOWNLOAD_URL"
+curl -sSfL -o "${TMPDIR}/checksums.txt" "$CHECKSUM_URL"
+
+# Verify checksum
+cd "$TMPDIR"
+EXPECTED=$(grep "${BINARY}" checksums.txt | awk '{print $1}')
+ACTUAL=$(sha256sum "${BINARY}" | awk '{print $1}')
+
+if [ -z "$EXPECTED" ]; then
+  echo "Error: no checksum found for ${BINARY} in checksums.txt" >&2
+  exit 1
+fi
+
+if [ "$EXPECTED" != "$ACTUAL" ]; then
+  echo "Error: checksum mismatch!" >&2
+  echo "  Expected: $EXPECTED" >&2
+  echo "  Actual:   $ACTUAL" >&2
+  exit 1
+fi
+
+echo "Checksum verified ✓"
+
+# Install
+cp "${TMPDIR}/${BINARY}" "${INSTALL_DIR}/review-bot"
 chmod +x "${INSTALL_DIR}/review-bot"
 
 echo "Installed review-bot ${LATEST} to ${INSTALL_DIR}/review-bot"