fix: address code review - preserve installedAt in rollback, fix semver parsing, remove duplicate hash

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Author: Copilot

packages/cli/src/commands/plugin/build.ts

@@ -77,7 +77,6 @@ export default class PluginBuild extends Command {
 
       // 5. Compute checksums
       if (!flags.json) printStep('Computing checksums...');
-      const fileHash = crypto.createHash(flags.checksumAlgorithm).update(configBuffer).digest('hex');
       const manifestChecksum = crypto.createHash(flags.checksumAlgorithm).update(configBuffer).digest('hex');
 
       // 6. Write output
@@ -136,7 +135,7 @@ export default class PluginBuild extends Command {
           checksums: {
             algorithm: flags.checksumAlgorithm,
             manifest: manifestChecksum,
-            files: { 'manifest.json': fileHash },
+            files: { 'manifest.json': manifestChecksum },
           },
           signature: signatureInfo,
           files: fileEntries,

packages/cli/src/commands/plugin/validate.ts

@@ -135,15 +135,68 @@ export default class PluginValidate extends Command {
         const engine = (manifest as any).manifest?.engine || (manifest as any).engine;
         const required = engine?.objectstack as string | undefined;
         if (required) {
-          // Simple semver range check (>=X.Y.Z)
-          const rangeMatch = required.match(/>=?\s*([\d.]+)/);
-          if (rangeMatch) {
-            const [rMajor, rMinor = '0', rPatch = '0'] = rangeMatch[1].split('.');
-            const [pMajor, pMinor = '0', pPatch = '0'] = flags.platformVersion.split('.');
-            const compatible =
-              parseInt(pMajor) > parseInt(rMajor) ||
-              (parseInt(pMajor) === parseInt(rMajor) && parseInt(pMinor) > parseInt(rMinor)) ||
-              (parseInt(pMajor) === parseInt(rMajor) && parseInt(pMinor) === parseInt(rMinor) && parseInt(pPatch) >= parseInt(rPatch));
+          // Semver range check supporting >=, >, ^, ~, and exact versions
+          const parseSemver = (v: string) => {
+            const parts = v.replace(/^v/, '').split('.').map(p => parseInt(p, 10));
+            return { major: parts[0] || 0, minor: parts[1] || 0, patch: parts[2] || 0 };
+          };
+
+          const target = parseSemver(flags.platformVersion);
+          let compatible = false;
+          let matched = false;
+
+          // >=X.Y.Z — greater than or equal
+          const gteMatch = required.match(/^>=\s*([\d.]+)/);
+          if (gteMatch) {
+            const req = parseSemver(gteMatch[1]);
+            compatible = (target.major > req.major) ||
+              (target.major === req.major && target.minor > req.minor) ||
+              (target.major === req.major && target.minor === req.minor && target.patch >= req.patch);
+            matched = true;
+          }
+
+          // >X.Y.Z — strictly greater than
+          if (!matched) {
+            const gtMatch = required.match(/^>\s*([\d.]+)/);
+            if (gtMatch) {
+              const req = parseSemver(gtMatch[1]);
+              compatible = (target.major > req.major) ||
+                (target.major === req.major && target.minor > req.minor) ||
+                (target.major === req.major && target.minor === req.minor && target.patch > req.patch);
+              matched = true;
+            }
+          }
+
+          // ^X.Y.Z — caret range (same major, >= minor.patch)
+          if (!matched) {
+            const caretMatch = required.match(/^\^\s*([\d.]+)/);
+            if (caretMatch) {
+              const req = parseSemver(caretMatch[1]);
+              compatible = target.major === req.major &&
+                ((target.minor > req.minor) ||
+                  (target.minor === req.minor && target.patch >= req.patch));
+              matched = true;
+            }
+          }
+
+          // ~X.Y.Z — tilde range (same major.minor, >= patch)
+          if (!matched) {
+            const tildeMatch = required.match(/^~\s*([\d.]+)/);
+            if (tildeMatch) {
+              const req = parseSemver(tildeMatch[1]);
+              compatible = target.major === req.major && target.minor === req.minor && target.patch >= req.patch;
+              matched = true;
+            }
+          }
+
+          // Exact version match
+          if (!matched && /^\d+\.\d+\.\d+$/.test(required)) {
+            const req = parseSemver(required);
+            compatible = target.major === req.major && target.minor === req.minor && target.patch === req.patch;
+            matched = true;
+          }
+
+          if (matched) {
             platformResult = { compatible, requiredRange: required, targetVersion: flags.platformVersion };
             findings.push({
               severity: compatible ? 'info' : 'error',

packages/core/src/package-manager.ts

@@ -36,6 +36,8 @@ export interface PackageSnapshot {
   previousManifest: Record<string, unknown>;
   /** Namespaces before upgrade */
   previousNamespaces: string[];
+  /** Original installation timestamp */
+  installedAt: string;
   /** Snapshot timestamp */
   createdAt: string;
 }
@@ -254,7 +256,7 @@ export class PackageManager {
         packageId,
         fromVersion: '',
         toVersion: newVersion,
-        snapshot: { packageId, previousVersion: '', previousManifest: {}, previousNamespaces: [], createdAt: new Date().toISOString() },
+        snapshot: { packageId, previousVersion: '', previousManifest: {}, previousNamespaces: [], installedAt: '', createdAt: new Date().toISOString() },
         errorMessage: `Package ${packageId} is not installed`,
       };
     }
@@ -265,6 +267,7 @@ export class PackageManager {
       previousVersion: existing.version,
       previousManifest: existing.manifest,
       previousNamespaces: [...existing.namespaces],
+      installedAt: existing.installedAt,
       createdAt: new Date().toISOString(),
     };
     this.snapshots.set(packageId, snapshot);
@@ -351,7 +354,7 @@ export class PackageManager {
       packageId,
       version: snapshot.previousVersion,
       manifest: snapshot.previousManifest,
-      installedAt: new Date().toISOString(),
+      installedAt: snapshot.installedAt,
       status: 'installed',
       namespaces: snapshot.previousNamespaces,
       dependencies: deps ? Object.keys(deps) : [],