Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@install.sh`:
- Around line 92-94: The installer currently logs a warning when neither
sha256sum nor shasum is available (the else branch that calls warn "Neither
sha256sum nor shasum found — skipping checksum verification"); change this to
fail closed by emitting an explicit error and aborting the install (exit
non‑zero) so the script does not continue without checksum verification —
replace the warn call with a fatal/error path (use the existing die/error
function if present, otherwise call echo >&2 and exit 1) in the same conditional
that checks for sha256sum/shasum.
- Around line 73-76: When a checksum entry is missing or a verification fails,
the script currently leaves the downloaded binary on disk; update the failure
branches that check "if [ -z \"$expected\" ]" and the later checksum-failure
block to also remove the downloaded binary by adding a safe, quoted removal
(e.g. rm -f "$binary_file") alongside rm -f "$checksum_file"; use the existing
variables binary_name, checksum_file and binary_file and ensure all variable
expansions are quoted to avoid accidental word-splitting or globbing.

In `@tools/automation/ollama-delegate.sh`:
- Around line 45-48: The current logic unconditionally strips leading and
trailing quotes from the variable value (see the manipulations of value), which
can corrupt strings when quotes don't match; change it to only remove
surrounding quotes when both the first and last characters are matching quotes
(either both " or both '): detect the first and last char of value, and if they
are both double-quotes or both single-quotes, strip them; otherwise leave value
untouched; apply this check where value is currently being trimmed.
- Around line 36-38: Replace the stderr log that prints the raw rejected line
(the echo referencing $line) so secrets are not leaked: add and maintain a line
counter (e.g., lineno incremented each loop) and change the warning to only emit
metadata such as "WARN: Skipping unsafe .env line at line $lineno" (do not
include or expand $line), leaving the continue in place; ensure the read loop
uses safe read -r and the new warning only outputs the line number or other
non-sensitive context.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@tools/automation/ollama-delegate.sh`:
- Around line 47-48: The current quoted-value trimming uses a Bash 4.x
negative-length expansion (value="${value:1:-1}") which fails on macOS Bash 3.2;
change the logic inside the quoted branch that operates on the variable value to
first take the substring from index 1 onward and then remove the final character
(i.e., strip the leading quote, then strip the trailing quote) using POSIX/Bash
3.2-compatible parameter expansions (take value from offset 1, then remove its
last character via a trailing-pattern removal), so the quoted branch that checks
value with the regexes still ends up with the unquoted content but without using
negative-length expansions.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@tools/automation/ollama-delegate.sh`:
- Around line 43-52: The current loop that parses lines and exports variables
(matching the regex and using local key="${line%%=*}" and export "$key=$value")
should be restricted to an allowlist to prevent exporting dangerous variables
like PATH or IFS; modify the code so after extracting key and value you check
key against a predefined allowlist (e.g., an array or a regex of permitted
names) and only perform export "$key=$value" when the key is in that allowlist,
otherwise skip or log/ignore the entry—apply this change in the block that
handles the case stripping and before the export.

---

Nitpick comments:
In `@tools/automation/ollama-delegate.sh`:
- Line 55: Replace the unstable "$(dirname "$0")/../../.env" invocation passed
to _load_env with a path resolved from BASH_SOURCE[0]; specifically, update the
_load_env call that currently uses "$0" so it uses "${BASH_SOURCE[0]}" (and keep
proper quoting and dirname usage) to reliably resolve the repo-root .env. Ensure
the change targets the existing _load_env invocation and preserves the
surrounding dirname and ../../.env path traversal.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@install.sh`:
- Around line 69-80: The sha256sum verification block is broken: remove the
duplicate expected=$(grep ...) line, add a proper check for an empty expected
(if [ -z "$expected" ]; then ... fi) before using it, and fix the grep to match
filename at end of line (e.g. grep "<pattern matching filename at end>"
"$checksum_file" to extract the hash into the variable expected) so that when
expected is empty you run rm -f "$dest" "$checksum_file" and call fail "Checksum
entry for $binary_name not found in checksums.txt", otherwise echo "$expected 
$dest" | sha256sum --check --status || { rm -f "$dest" "$checksum_file"; fail
"Checksum verification failed — binary may be corrupted or tampered with"; }
referencing the variables binary_name, checksum_file, expected, dest and the
sha256sum verification block.
- Around line 92-97: The else branch inside the checksum selection block should
not emit a misleading warn and must be closed: remove the redundant warn
"Neither sha256sum nor shasum found — skipping checksum verification" and keep
the fail call that aborts ("fail 'Neither sha256sum nor shasum found — cannot
verify binary integrity. Install coreutils and retry.'"), then add the missing
fi to close the if/elif/else block that begins around the checksum detection,
and ensure the standalone rm -f "$checksum_file" that follows is
positioned/executed only on the successful path after that fi (i.e., leave the
cleanup rm for the success flow, not inside the else).

---

Duplicate comments:
In `@install.sh`:
- Around line 81-91: In the shasum fallback block, remove the duplicated
expected= assignment and replace the fragile grep+awk with a single, reliable
lookup that finds the checksum by matching the filename column; for example set
expected by running awk to check $2==binary_name and print $1 (e.g.
expected=$(awk -v name="$binary_name" '$2==name {print $1; exit}'
"$checksum_file")), then add the missing if [ -z "$expected" ]; then rm -f
"$dest" "$checksum_file" && fail "Checksum entry for $binary_name not found in
checksums.txt" fi before running shasum -a 256 --check --status so the script
fails early when no entry is found and uses the correct checksum value.