fix(preview): sanitize channel-derived versions for plugin installs

packages/opencode/src/config/config.ts

@@ -270,9 +270,16 @@ export namespace Config {
     await Promise.all(deps)
   }
 
+  const semver = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/
+
+  export function pluginVersion(value: string) {
+    if (semver.test(value)) return value
+    return "*"
+  }
+
   export async function installDependencies(dir: string) {
     const pkg = path.join(dir, "package.json")
-    const targetVersion = Installation.isLocal() ? "*" : Installation.VERSION
+    const targetVersion = Installation.isLocal() ? "*" : pluginVersion(Installation.VERSION)
 
     const json = await Filesystem.readJson<{ dependencies?: Record<string, string> }>(pkg).catch(() => ({
       dependencies: {},

packages/opencode/test/config/config.test.ts

@@ -1727,6 +1727,19 @@ test("wellknown URL with trailing slash is normalized", async () => {
   }
 })
 
+describe("pluginVersion", () => {
+  test("keeps valid versions", () => {
+    expect(Config.pluginVersion("1.2.3")).toBe("1.2.3")
+    expect(Config.pluginVersion("0.0.0-opencode-jolly-river-202603042256")).toBe(
+      "0.0.0-opencode-jolly-river-202603042256",
+    )
+  })
+
+  test("falls back for invalid versions", () => {
+    expect(Config.pluginVersion("0.0.0-opencode/jolly-river-202603042256")).toBe("*")
+  })
+})
+
 describe("getPluginName", () => {
   test("extracts name from file:// URL", () => {
     expect(Config.getPluginName("file:///path/to/plugin/foo.js")).toBe("foo")

packages/script/src/index.ts

@@ -1,6 +1,7 @@
 import { $ } from "bun"
 import semver from "semver"
 import path from "path"
+import { previewVersion, sanitizeChannel, sanitizePreviewVersion } from "./version"
 
 const rootPkgPath = path.resolve(import.meta.dir, "../../../package.json")
 const rootPkg = await Bun.file(rootPkgPath).json()
@@ -23,17 +24,18 @@ const env = {
   OPENCODE_VERSION: process.env["OPENCODE_VERSION"],
   OPENCODE_RELEASE: process.env["OPENCODE_RELEASE"],
 }
-const CHANNEL = await (async () => {
+const RAW_CHANNEL = await (async () => {
   if (env.OPENCODE_CHANNEL) return env.OPENCODE_CHANNEL
   if (env.OPENCODE_BUMP) return "latest"
   if (env.OPENCODE_VERSION && !env.OPENCODE_VERSION.startsWith("0.0.0-")) return "latest"
   return await $`git branch --show-current`.text().then((x) => x.trim())
 })()
+const CHANNEL = RAW_CHANNEL === "latest" ? RAW_CHANNEL : sanitizeChannel(RAW_CHANNEL)
 const IS_PREVIEW = CHANNEL !== "latest"
 
 const VERSION = await (async () => {
-  if (env.OPENCODE_VERSION) return env.OPENCODE_VERSION
-  if (IS_PREVIEW) return `0.0.0-${CHANNEL}-${new Date().toISOString().slice(0, 16).replace(/[-:T]/g, "")}`
+  if (env.OPENCODE_VERSION) return sanitizePreviewVersion(env.OPENCODE_VERSION)
+  if (IS_PREVIEW) return previewVersion(CHANNEL)
   const version = await fetch("https://registry.npmjs.org/opencode-ai/latest")
     .then((res) => {
       if (!res.ok) throw new Error(res.statusText)

packages/script/src/version.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, test } from "bun:test"
+import { previewVersion, sanitizeChannel, sanitizePreviewVersion } from "./version"
+
+describe("sanitizeChannel", () => {
+  test("replaces slash separators", () => {
+    expect(sanitizeChannel("opencode/jolly-river")).toBe("opencode-jolly-river")
+  })
+
+  test("falls back when channel is empty", () => {
+    expect(sanitizeChannel("///")).toBe("preview")
+  })
+})
+
+describe("sanitizePreviewVersion", () => {
+  test("sanitizes preview prerelease labels", () => {
+    expect(sanitizePreviewVersion("0.0.0-opencode/jolly-river-20260304")).toBe("0.0.0-opencode-jolly-river-20260304")
+  })
+
+  test("leaves stable versions untouched", () => {
+    expect(sanitizePreviewVersion("1.2.3")).toBe("1.2.3")
+  })
+})
+
+describe("previewVersion", () => {
+  test("builds semver-safe preview versions", () => {
+    const date = new Date("2026-03-04T22:56:02.000Z")
+    expect(previewVersion("opencode/jolly-river", date)).toBe("0.0.0-opencode-jolly-river-202603042256")
+  })
+})

packages/script/src/version.ts

@@ -0,0 +1,19 @@
+const PREVIEW = "0.0.0-"
+
+export function sanitizeChannel(value: string) {
+  const cleaned = value
+    .trim()
+    .replace(/[^0-9A-Za-z-]+/g, "-")
+    .replace(/-+/g, "-")
+    .replace(/^-+|-+$/g, "")
+  return cleaned || "preview"
+}
+
+export function sanitizePreviewVersion(value: string) {
+  if (!value.startsWith(PREVIEW)) return value
+  return `${PREVIEW}${sanitizeChannel(value.slice(PREVIEW.length))}`
+}
+
+export function previewVersion(channel: string, date = new Date()) {
+  return `${PREVIEW}${sanitizeChannel(channel)}-${date.toISOString().slice(0, 16).replace(/[-:T]/g, "")}`
+}