Skip to content

fix(installation): use package-manager metadata for upgrade checks#23778

Closed
lawrence3699 wants to merge 1 commit intoanomalyco:devfrom
lawrence3699:fix/upgrade-package-manager-version-lookup
Closed

fix(installation): use package-manager metadata for upgrade checks#23778
lawrence3699 wants to merge 1 commit intoanomalyco:devfrom
lawrence3699:fix/upgrade-package-manager-version-lookup

Conversation

@lawrence3699
Copy link
Copy Markdown

Issue for this PR

Closes #23434

Type of change

  • Bug fix
  • New feature
  • Refactor / code improvement
  • Documentation

What does this PR do?

Installation.latest() was resolving npm-like upgrades by reading the registry URL and performing a raw HTTP request. That bypassed the package manager's auth/config handling, so opencode upgrade could fail against private registries even when npm, pnpm, or bun were already configured correctly.

This switches npm, pnpm, and bun installs to use their own view ... version --json commands from a neutral working directory, and it now fails instead of returning a blank version if the metadata lookup produces no output.

How did you verify your code works?

  • bun test test/installation/installation.test.ts
  • bun typecheck
  • cd ~ && npm view opencode-ai version --json
  • cd ~ && pnpm view opencode-ai version --json
  • cd ~ && bun pm view opencode-ai version --json

Screenshots / recordings

N/A

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR

Copilot AI review requested due to automatic review settings April 22, 2026 02:05
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates Installation.latest() to query npm-like package managers for the latest version using their own metadata commands (instead of raw HTTP registry requests), which preserves auth/config handling for private registries and improves upgrade reliability.

Changes:

  • Replace raw HTTP registry lookups for npm/pnpm/bun with view ... version --json package-manager commands executed from the user’s home directory.
  • Add tests asserting that npm/pnpm/bun paths do not perform HTTP requests and that an empty metadata response becomes a failure.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
packages/opencode/src/installation/index.ts Switches npm-like latest-version checks from HTTP registry calls to package-manager view commands and adds stricter “empty output” handling.
packages/opencode/test/installation/installation.test.ts Updates/extends tests to validate the new npm/pnpm/bun view-based behavior and the empty-output failure case.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +151 to +156
return yield* Effect.try({
try: () => {
const parsed = JSON.parse(raw)
return typeof parsed === "string" ? parsed : raw.replace(/^"|"$/g, "")
},
catch: () => raw.replace(/^"|"$/g, ""),
@lawrence3699
Copy link
Copy Markdown
Author

Closing this because the underlying issue appears to have been resolved by #24016. This PR is no longer needed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Opencode upgrade bypasses npm auth from .npmrc on corporate/internal registry setups

2 participants