refactor(cli): replace updater semver dependency (#42492)

Author: kitlangton

bun.lock

@@ -38,7 +38,6 @@
     "immer": "11.1.4",
     "jsonc-parser": "3.3.1",
     "open": "10.1.2",
-    "semver": "catalog:",
     "solid-js": "catalog:",
     "tree-sitter-bash": "0.25.0",
     "tree-sitter-powershell": "0.25.10",
@@ -51,7 +50,6 @@
     "@opencode-ai/protocol": "workspace:*",
     "@tsconfig/bun": "catalog:",
     "@types/bun": "catalog:",
-    "@types/semver": "catalog:",
     "@typescript/native-preview": "catalog:",
     "@lydell/node-pty-darwin-arm64": "1.2.0-beta.12",
     "@lydell/node-pty-darwin-x64": "1.2.0-beta.12",

packages/cli/package.json

@@ -0,0 +1,50 @@
+export type Policy = boolean | "notify"
+export type Action = "none" | "upgrade"
+
+const maximumComponent = "9007199254740991"
+const versionPattern =
+  /^v?([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/
+
+export function action(current: string, latest: string, policy: Policy): Action {
+  if (policy === false) return "none"
+  const currentVersion = parseReleaseVersion(current)
+  const latestVersion = parseReleaseVersion(latest)
+  if (!currentVersion || !latestVersion || sameRelease(currentVersion, latestVersion)) return "none"
+  // Major upgrades are never installed automatically.
+  if (currentVersion.major !== latestVersion.major) return "none"
+  return "upgrade"
+}
+
+function parseReleaseVersion(input: string) {
+  if (input.length > 256) return
+  const match = input.trim().match(versionPattern)
+  if (!match) return
+  if ([match[1], match[2], match[3]].some(invalidComponent)) return
+  if (
+    match[4]
+      ?.split(".")
+      .some((identifier) => identifier.length > 1 && identifier.startsWith("0") && /^[0-9]+$/.test(identifier))
+  )
+    return
+  return {
+    major: match[1],
+    core: `${match[1]}.${match[2]}.${match[3]}`,
+    prerelease: match[4]?.split(".") ?? [],
+  }
+}
+
+function sameRelease(current: NonNullable<ReturnType<typeof parseReleaseVersion>>, latest: typeof current) {
+  if (current.core !== latest.core || current.prerelease.length !== latest.prerelease.length) return false
+  return current.prerelease.every((identifier, index) => {
+    const other = latest.prerelease[index]
+    if (identifier === other) return true
+    // semver compares oversized numeric prerelease identifiers after numeric coercion.
+    return /^[0-9]+$/.test(identifier) && /^[0-9]+$/.test(other) && Number(identifier) === Number(other)
+  })
+}
+
+function invalidComponent(value: string) {
+  if (value.length > 1 && value.startsWith("0")) return true
+  if (value.length !== maximumComponent.length) return value.length > maximumComponent.length
+  return value > maximumComponent
+}

packages/cli/src/services/updater-action.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from "bun:test"
-import { action, decodePolicy } from "./updater"
+import { action } from "./updater-action"
+import { decodePolicy } from "./updater"
 
 describe("updater", () => {
   test("reads autoupdate from JSONC", () => {
@@ -30,4 +31,48 @@ describe("updater", () => {
   test("upgrades when latest is lower (rollback)", () => {
     expect(action("1.2.4", "1.2.3", true)).toBe("upgrade")
   })
+
+  test("accepts strict release version variants", () => {
+    expect(action("v1.2.3", " 1.2.4\n", true)).toBe("upgrade")
+    expect(action("1.2.3-alpha.1", "1.2.3-alpha.2", true)).toBe("upgrade")
+    expect(action("0.0.0-next-17403", "0.0.0-next-17403.2", true)).toBe("upgrade")
+    expect(action("1.2.3+old", "1.2.3+new", true)).toBe("none")
+    expect(action("v1.2.3+old", "1.2.3", true)).toBe("none")
+  })
+
+  test("preserves strict validity", () => {
+    const invalid = [
+      "=1.2.3",
+      "V1.2.3",
+      "1.2",
+      "1.2.3.4",
+      "01.2.3",
+      "1.02.3",
+      "1.2.03",
+      "1.2.3-01",
+      "1.2.3-",
+      "1.2.3+",
+      "1.2.3-alpha..1",
+      "1.2.3_alpha",
+      "9007199254740992.0.0",
+      "0.9007199254740992.0",
+      "0.0.9007199254740992",
+    ]
+    invalid.forEach((version) => expect(action("1.2.3", version, true), version).toBe("none"))
+  })
+
+  test("handles numeric limits without losing precision", () => {
+    expect(action("9007199254740991.0.0", "9007199254740991.0.1", true)).toBe("upgrade")
+    expect(action("9007199254740990.0.0", "9007199254740991.0.0", true)).toBe("none")
+  })
+
+  test("preserves equality for oversized numeric prerelease identifiers", () => {
+    expect(action("1.0.0-9007199254740992", "1.0.0-9007199254740993", true)).toBe("none")
+    expect(action("1.0.0-9007199254740991", "1.0.0-9007199254740992", true)).toBe("upgrade")
+  })
+
+  test("rejects versions longer than semver's limit before trimming", () => {
+    expect(action("1.2.3", `${" ".repeat(251)}1.2.3`, true)).toBe("none")
+    expect(action("1.2.3", `1.2.4+${"a".repeat(250)}`, true)).toBe("upgrade")
+  })
 })

packages/cli/src/services/updater.test.ts

@@ -5,12 +5,10 @@ import { Context, Duration, Effect, FileSystem, Layer } from "effect"
 import { ChildProcess } from "effect/unstable/process"
 import { parse, type ParseError } from "jsonc-parser"
 import path from "node:path"
-import semver from "semver"
+import { action, type Policy } from "./updater-action"
 
 declare const OPENCODE_CLI_NAME: string | undefined
 
-export type Policy = boolean | "notify"
-export type Action = "none" | "upgrade"
 type Method = "npm" | "pnpm" | "bun" | "yarn"
 
 const packageName =
@@ -34,14 +32,6 @@ export function decodePolicy(text: string): Policy | undefined {
   if (typeof value === "boolean" || value === "notify") return value
 }
 
-export function action(current: string, latest: string, policy: Policy): Action {
-  if (policy === false) return "none"
-  if (!semver.valid(current) || !semver.valid(latest) || semver.eq(latest, current)) return "none"
-  // Major upgrades are never installed automatically.
-  if (semver.major(latest) !== semver.major(current)) return "none"
-  return "upgrade"
-}
-
 export const layer = Layer.effect(
   Service,
   Effect.gen(function* () {
@@ -166,3 +156,4 @@ export const layer = Layer.effect(
 )
 
 export * as Updater from "./updater"
+export { action, type Action, type Policy } from "./updater-action"