💡 Codex Review

Refresh package checksums without assuming path fields

The checksum refresh in updateManifestFile never updates the packages section. currentPackageFileKey is only populated when a line matches ^\s{4}path: (lines 133‑141), but Electron’s Windows latest.yml normally represents packages as objects keyed by architecture (e.g. packages:\n x64:\n sha512: …) and does not emit a path property. In that common format the subsequent sha512 lines (lines 145‑147) execute with currentPackageFileKey === null, so their hashes are left unchanged even though the file’s SHA‑512 was recomputed above. Update clients that read packages.*.sha512 will continue to see stale checksums and may reject the release. Consider deriving the key from the package name (e.g. the preceding architecture label) or at least recomputing hashes for these entries too.