feat(install): version-driven packaging — prepopulate plugin, verify checksum, normalize base version

Merged
PI
4mo ago
+91-13

What

Three changes to the forked install script so a single version pin drives the whole packaging story (fork binary + @opencode-ai/plugin), with integrity checking and consistent version normalization.

  • Auto-detect prepopulate of @opencode-ai/plugin — the install resolves and prepopulates the matching plugin for the pinned version, so one version input installs both the fork binary and its plugin.
  • Verify archive against SHA256SUMS before extract — the downloaded archive is checksum-verified prior to extraction; a mismatch aborts the install instead of unpacking a tampered/corrupt artifact.
  • Normalize bare base version to patch 1 — a bare base version is normalized to the -1 patch (e.g. 1.17.9 → 1.17.9-1) so bare and explicit pins resolve identically.

Scope

Single file: install. Targets the first versioned-packaging release, 1.17.9-1.

This PR intentionally contains only the install-script code — the design spec and implementation plan docs are kept out.

Validation

  • prepopulate: validated in sandbox (rc build)
  • checksum: validated in sandbox + tamper test (mismatch aborts)
  • bare-base normalize: 5/5 offline cases

Summary by cubic

Make the install script version-driven: one version pin installs the fork binary and the matching @opencode-ai/plugin, with checksum verification and consistent version normalization, and removes Playwright prepopulation. Targets the first versioned-packaging release 1.17.9-1.

  • New Features

    • Auto-prepopulates @opencode-ai/plugin for the pinned base version; still runs even if that binary version is already installed.
    • Verifies the downloaded archive against SHA256SUMS before extraction; aborts on mismatch.
    • Normalizes bare versions to patch -1 (e.g. 1.17.9 → 1.17.9-1) so base and explicit pins resolve the same.

  • Bug Fixes

    • Removed redundant lockfile patch during plugin prepopulation; rely on npm install --save-exact to lock exact versions and avoid npm ci failures.
    • Missing normalized -1 release is a hard error; no fallback to legacy bare tags.