fix(auto-update): break cache.ts<->checker.ts circular import (cold-graph crash)

CI failed (Check plugin, 10/10 auto-update-checker tests) with:
  SyntaxError: Export named 'isValidSemver' not found in module '.../cache.ts'

Root cause: a circular import introduced in b137074 when semver validation was
added — checker.ts imported isValidSemver from cache.ts, while cache.ts already
imported getCurrentRuntimePackageJsonPath from checker.ts. On a cold module
graph (fresh CI install) the cycle breaks static export resolution, so the whole
checker.test.ts file fails to load — including pure tests like extractChannel().
A warm local bun module cache tolerated the cycle, which is why it passed
locally and only surfaced in CI (and would equally bite a fresh user install).

Fix: move the pure leaf isValidSemver into its own dependency-free module
(auto-update-checker/semver.ts). checker.ts now imports it from there and no
longer imports cache.ts at all, breaking the cycle. cache.ts keeps using it via
the new leaf import.

Reproduced CI's condition locally (cold BUN_INSTALL_CACHE_DIR) — fails before,
10/10 pass after. plugin 1888/0, tsc + biome clean.

Co-authored-by: Alfonso [Magic Context] <288211368+alfonso-magic-context@users.noreply.github.com>

Author: 2 people

packages/plugin/src/hooks/auto-update-checker/cache.ts

@@ -6,6 +6,7 @@ import { parse as parseJsonc } from "comment-json";
 import { log } from "../../shared/logger";
 import { getCurrentRuntimePackageJsonPath } from "./checker";
 import { CACHE_DIR, PACKAGE_NAME } from "./constants";
+import { isValidSemver } from "./semver";
 import { PackageJsonSchema } from "./types";
 
 /**
@@ -183,19 +184,6 @@ export function resolveInstallContext(
     return null;
 }
 
-/**
- * Strict semver core with optional prerelease + build metadata (1.2.3,
- * 1.2.3-beta.1, 1.2.3+build.5). The version reaching the update path comes from
- * the npm registry `dist-tags` envelope — Zod-parsed only as a STRING shape, not
- * as semver — so a malformed/crafted tag value (`npm:@evil/pkg@1.0.0`,
- * `file:/tmp/x`, `git+ssh://...`) must never be written into package.json's
- * dependency spec before `npm install`. Shared by the auto-update prepare path
- * and the pinned-config rewrite.
- */
-export function isValidSemver(version: string): boolean {
-    return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version);
-}
-
 export function preparePackageUpdate(
     version: string,
     packageName: string = PACKAGE_NAME,

packages/plugin/src/hooks/auto-update-checker/checker.ts

@@ -5,7 +5,6 @@ import { fileURLToPath } from "node:url";
 import { parse as parseJsonc } from "comment-json";
 
 import { log } from "../../shared/logger";
-import { isValidSemver } from "./cache";
 import {
     CACHE_DIR,
     NPM_FETCH_TIMEOUT,
@@ -14,6 +13,7 @@ import {
     USER_OPENCODE_CONFIG,
     USER_OPENCODE_CONFIG_JSONC,
 } from "./constants";
+import { isValidSemver } from "./semver";
 import {
     NpmPackageEnvelopeSchema,
     OpencodeConfigSchema,

packages/plugin/src/hooks/auto-update-checker/semver.ts

@@ -0,0 +1,18 @@
+/**
+ * Strict semver validator for the auto-update path.
+ *
+ * The plugin version string flows from the npm registry / dist-tags into
+ * package.json's dependency spec before `npm install`. A malformed or crafted
+ * value (`npm:@evil/pkg@1.0.0`, `file:/tmp/x`, `git+ssh://...`) must never be
+ * written there — this is the arbitrary-package-install / SSRF guard.
+ *
+ * Lives in its own leaf module (no imports beyond this) so both `cache.ts` and
+ * `checker.ts` can use it without creating a circular import between them
+ * (`cache.ts` imports `checker.ts` for the runtime package.json path; if
+ * `checker.ts` also imported this from `cache.ts`, the cycle breaks static
+ * export resolution on a cold module graph — CI / fresh installs — even though
+ * a warm bun cache tolerates it).
+ */
+export function isValidSemver(version: string): boolean {
+    return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version);
+}