Skip to content

fix(cli): stop auto-updating over a local or dev-channel build - #92

Merged
androidand merged 2 commits into
devfrom
fix/dont-autoupdate-over-nonrelease-build
Sep 19, 2026
Merged

androidand merged 2 commits into
devfrom
fix/dont-autoupdate-over-nonrelease-build

Conversation

@androidand

Copy link
Copy Markdown
Owner

Summary

upgrade.ts only exempted the literal "local" channel from the self-upgrade check. A local build on any other channel — including "dev", the stable default build-local.ts now uses for every local build — was treated as a real release and compared against the latest published version.

Confirmed live: a dev build's version read as needing "a patch", and the auto-updater silently curl-installed a real release over the running binary mid-session, corrupting the TUI's rendered screen with the installer's raw progress output and leaving the process spinning afterward.

Replaces the "local"-only check with InstallationIsRelease (channel is latest/beta/prod — the only channels a real release ever carries, already used by database.ts to pick the session-database path). Comparing a never-published build's version against "the latest release" is meaningless at best; silently replacing it mid-session is actively harmful.

Test plan

  • bun typecheck clean (core, opencode)
  • packages/core/test/database-migration.test.ts passes (channel-path refactor didn't change behavior for release channels)
  • bun run script/fork-verify.ts clean

upgrade.ts only exempted the literal "local" channel from the
self-upgrade check. A local build on any other channel — including
"dev", the stable default build-local.ts now uses for every local
build — was treated as a real release and compared against the latest
published version. Confirmed live: a dev build's version read as
needing "a patch", and the auto-updater silently curl-installed a
real release over the running binary mid-session, corrupting the
TUI's rendered screen with the installer's raw progress output and
leaving the process spinning afterward.

Replace the "local"-only check with InstallationIsRelease (channel is
latest/beta/prod — the only channels a real release ever carries,
already used by database.ts to pick the session-database path).
Comparing a never-published build's version against "the latest
release" is meaningless at best; silently replacing it mid-session is
actively harmful.
The previous commit replaced upgrade.ts's InstallationLocal check with
InstallationIsRelease, dropping the tracked marker string; updated it to
match. version.ts is a newly-diverged upstream file (adds
InstallationReleaseChannels/InstallationIsRelease) and needed a fresh
patched entry.
@github-actions

Copy link
Copy Markdown

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

  • PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

@github-actions

Copy link
Copy Markdown

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

  1. Open an issue describing the bug/feature (if one doesn't exist)
  2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

@androidand
androidand merged commit 5ea9494 into dev Sep 19, 2026
3 of 9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant