fix: make self-updates complete and retry-safe

[laurenceputra]

Summary

• download self-update and bootstrap assets from one GitHub branch archive snapshot
• validate the managed release manifest, archive safety, shell syntax, and complete file set before promotion
• repair equal-version incomplete installs created by historical managed-file manifests
• promote retry-safely with the wrapper near-last and VERSION last
• add exact 0.1.10 migration, malformed archive, and interrupted promotion regression coverage

Validation

• bash tests/run.sh
• bash tests/version_guard.sh
• bash -n on touched shell scripts and the historical fixture
• git diff --check

ShellCheck is not installed locally; CI runs it.

[Copilot]

🔵 Needs a closer look

It substantially rewrites the security- and reliability-critical self-update/install path (archive extraction, path-traversal defenses, promotion ordering), which warrants final human review despite strong test coverage.

Pull request overview

This PR reworks the self-update and streamed/bootstrap install paths so that updates fetch one validated GitHub branch-archive snapshot instead of downloading managed files individually, and so that promotion is retry-safe. It introduces a tracked .opencode_web_yolo.manifest as the canonical release file set, adds strict archive-safety validation (rejecting traversal, symlink/hardlink/non-regular entries, multi-root, duplicate manifest, and malformed archives), replaces the sort -V version comparison with a portable Bash 3.2-safe comparator, and repairs incomplete installs even when local and remote VERSION are equal. Promotion moves the wrapper near-last and VERSION last, guarded by a re-exec marker to prevent update loops, so an interrupted update never falsely advances the installed release.

Changes:

• Archive-based, manifest-validated self-update and bootstrap install with fail-closed validation and same-filesystem atomic promotion.
• Portable version_gt, equal-version repair, re-exec loop guard, and URL-encoded branch handling.
• Extensive regression tests (0.1.10 migration fixture, malformed/malicious archives, interrupted promotion), plus docs, VERSION, and CHANGELOG updates.

File summaries

File	Description
.opencode_web_yolo.sh	Portable version compare, archive download/validate/promote helpers, equal-version repair, re-exec guard, post-update validation gate
install.sh	Manifest-driven required files, archive bootstrap with validation, staged same-fs promotion with VERSION last
.opencode_web_yolo.manifest	New tracked canonical release-file manifest
tests/test_self_update.sh	Adds repair, malicious/malformed archive, interrupted-promotion, and 0.1.10 migration coverage
tests/test_install_bootstrap.sh	Manifest-driven remote, archive fake curl, malicious-archive rejection coverage
tests/test_helpers.sh	Manifest-backed helper and archive-generating fake curl
tests/test_health.sh	Unsets retention env vars for isolation
tests/fixtures/old-0.1.10/.opencode_web_yolo.sh	Immutable historical wrapper fixture for migration test
tests/version_guard.sh	Includes manifest in runtime/version drift guard
.github/workflows/ci.yml	Syntax/shellcheck the new fixture and bootstrap test
TECHNICAL.md, README.md, skills/.../*.md	Document archive flow, repair, retry-safety, and 0.1.10 recovery note
VERSION, CHANGELOG.md	Release bump to 0.2.2

Review details

• Files reviewed: 17/17 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.