fix(auto-update): clean stale OMO plugin specifier cache roots

[deopa0402]

Problem

OpenCode can keep loading an old OMO plugin install from a stale package specifier cache root such as ~/.cache/opencode/packages/oh-my-openagent@latest, even after the valid cached package has been updated elsewhere. In that state, OMO may continue running outdated plugin code until the stale specifier root is manually removed.

Summary

• Clean stale OpenCode plugin specifier cache roots for accepted OMO package names.
• Extend OMO package invalidation from node_modules/<pkg> to stale <pkg>@<specifier> cache directories.
• Preserve unrelated package cache roots and lockfile entries.

Changes

• Update invalidatePackage() to expand the default OMO package name to all accepted package names:
  • oh-my-opencode
  • oh-my-openagent
• Remove stale specifier-root cache directories under the OpenCode package cache for selected OMO package names, including:
  • packages/oh-my-opencode@latest
  • packages/oh-my-openagent@latest
  • nested OMO specifier roots with the same accepted package names inside the package cache
• Keep explicit package invalidation scoped:
  • invalidatePackage("some-other-package") only invalidates that package
  • accepted OMO aliases are not removed during explicit unrelated package invalidation
• Make text bun.lock invalidation more surgical:
  • remove only selected OMO package entries from lock.packages
  • preserve unrelated entries such as other and some-other-package
• Keep the existing bun.lockb fallback behavior unchanged:
  • binary lockfiles are still treated as opaque and removed only when no text bun.lock is present
• Make cache-version tests deterministic by injecting isolated candidates/fallbacks instead of reading the developer’s real cache.

Testing

bun test src/hooks/zauc-mocks-cache/cache.test.ts

Result:

1 pass
0 fail
21 expect() calls

bun test src/hooks/auto-update-checker/checker/cached-version.test.ts \
  src/hooks/auto-update-checker/checker/package-json-locator.test.ts \
  src/hooks/zauc-mocks-cache/cache.test.ts

Result:

10 pass
0 fail
30 expect() calls

bun run typecheck
bun run build

Both passed.

Additional isolated integration checks:

• Reproduced stale old-version cache roots under isolated HOME, XDG_CACHE_HOME, and XDG_CONFIG_HOME.
• Verified production-default invalidatePackage() removes selected OMO cache entries:
  • oh-my-openagent@latest
  • oh-my-opencode@latest
  • nested OMO specifier roots for accepted package names
  • accepted alias node_modules cache entries
• Verified unrelated cache roots and lockfile entries are preserved.
• Verified real user paths were not modified:
  • ~/.cache/opencode
  • ~/.config/opencode

Old-vs-current A/B verification:

• Simulated old invalidation behavior:
  • stale oh-my-openagent@latest remained
  • alias lock entry remained
• Ran current implementation:
  • stale OMO specifier roots were removed
  • unrelated entries remained

Note: raw bun test currently fails on unrelated existing/environmental test isolation issues outside the changed cache files.

Related Issues

Related to #3522 and #3704.

Related prior attempt: #2395 tried to invalidate stale OpenCode plugin cache from postinstall, but it was not merged due to concerns around shared cache/lockfile deletion. This PR takes a narrower approach: it does not run from postinstall, does not delete the shared text bun.lock wholesale, and removes only accepted OMO package entries plus stale OMO specifier-root directories.

Complements #2291 by covering stale OMO specifier-root cache directories that are not handled by the existing node_modules/<pkg> invalidation.

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews

---

Summary by cubic

Fixes stale OMO plugin cache so OpenCode doesn’t load old code by removing specifier-root cache dirs (e.g., oh-my-openagent@latest) and narrowing lockfile edits. Invalidation now covers both oh-my-opencode and oh-my-openagent while preserving unrelated cache and lock entries.

• Bug Fixes
  • Remove OMO specifier-root cache dirs in cache root and packages/ for oh-my-opencode and oh-my-openagent; also clear matching node_modules entries.
  • Update text bun.lock handling to delete only targeted OMO entries; keep bun.lockb behavior unchanged.
  • Keep explicit invalidation scoped: invalidatePackage("some-other-package") affects only that package.
  • Add injection options to invalidatePackage() and getCachedVersion() for deterministic tests.

^{Written for commit 1b01fc3. Summary will update on new commits. Review in cubic}

[github-actions]

All contributors have signed the CLA. Thank you! ✅
_{Posted by the CLA Assistant Lite bot.}

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Auto-approved: Targeted cleanup of OMO-specific cache/lockfile entries with robust testing and isolation to prevent regressions in unrelated packages.}

[deopa0402]

I have read the CLA Document and I hereby sign the CLA