feat(opencode): complete DeepCode CLI lifecycle - #11
Conversation
|
The following comment was made by an LLM, it may be inaccurate: |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ff9d712adb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const execPath = path.resolve(options.execPath ?? process.execPath) | ||
| if (!isOwnedInstallPath(execPath, execPath)) throw new Error(`${execPath} is not a verified DeepCode curl installation`) |
There was a problem hiding this comment.
When a package-managed or development binary is invoked with upgrade --method curl, the CLI bypasses the detectedMethod === "unknown" guard, and this ownership check still always succeeds because it derives the allowed root from the same execPath being checked. The upgrade then renames and replaces process.execPath, potentially overwriting a binary under node_modules or even the Bun executable rather than refusing the unsupported installation; validate the .deepcode/bin/deepcode layout independently instead of treating every executable as owned.
Useful? React with 👍 / 👎.
| temporary=$(mktemp -d "${TMPDIR:-/tmp}/deepcode-install.XXXXXX") | ||
| trap 'rm -rf "$temporary"' EXIT INT TERM | ||
|
|
||
| if [ -x "$binary" ] && "$binary" --version 2>/dev/null | grep -Fq "$version"; then |
There was a problem hiding this comment.
When the requested version is a prefix of the installed version, grep -Fq reports a false match—for example, requesting 1.17.1 while 1.17.13 is installed skips the downgrade and rewrites the manifest as 1.17.1. The same substring check is also used for candidate and post-install verification, so version validation should parse or compare the complete reported version rather than search for a substring.
Useful? React with 👍 / 👎.
| rollback() { | ||
| if [ "$replaced" = "1" ] && [ -f "$backup" ]; then | ||
| rm -f "$binary" | ||
| mv "$backup" "$binary" | ||
| fi |
There was a problem hiding this comment.
On a first installation, replaced remains 0, so any failure after .deepcode.new is moved into place—such as installed-binary verification or manifest creation failing—runs this rollback without deleting the newly installed binary. The installer exits with an error but leaves a partial, potentially unverified installation at ~/.deepcode/bin/deepcode; the rollback needs to remove the binary when there was no previous installation to restore.
Useful? React with 👍 / 👎.
| { os: "linux", arch: "arm64" }, | ||
| { os: "linux", arch: "x64", avx2: false }, |
There was a problem hiding this comment.
On Alpine and other musl-based Linux systems, the installer accepts the host based only on uname, but the sole Linux artifacts are now compiled for glibc (bun-linux-* with FFF_LIBC and OPENTUI_LIBC set to glibc). Those users download a nominally supported asset that cannot execute and fail only at the smoke test; either retain musl-compatible artifacts or detect musl and report it as unsupported before downloading.
Useful? React with 👍 / 👎.
1 participant
Scope
Complete S1-03: unify DeepCode CLI build, artifact naming, verified curl installation, upgrade rollback, and manifest-bounded uninstall behavior.
Problem
The package bin still targeted
bin/opencode; compiled artifacts still contained anopencodebinary and user-agent; npm postinstall and the legacy publisher retained OpenCode/upstream channels; the verified DeepCode release channel was a fail-closed placeholder; uninstall deleted user data by default instead of preserving it.Implementation
deepcode-<os>-<arch>.<ext>archives containing onlydeepcode/deepcode.exe.deepcode-manifest.jsonanddeepcode-checksums.txtand refuse publishing unlessGH_REPO=yuanchenglu/deepcode.--purgerequires a separate confirmation and only targets DeepCode global paths.User impact
DeepCode can use one owned CLI identity and one verified release/curl lifecycle without contacting anomalyco/OpenCode or third-party package-manager release channels. Upgrade failures restore the previous binary. Normal uninstall preserves user data.
Tests
packages/opencode/test/installation/build-contract.test.tspackages/opencode/test/installation/installation.test.tspackages/opencode/test/installation/release.test.tspackages/opencode/test/installation/uninstall.test.tsEvidence
Failure baseline and final CI evidence will be recorded under
docs/open-source-readiness/evidence/S1-03/after Actions completes.Risks
Technical debt
None accepted in this PR. CI failures will be classified before any rerun.
Next task
After S1-03 is merged and Plan/evidence are closed out, re-read the dependency graph and start the next earliest eligible Stage 1 task.