Name the fork build with SemVer build metadata

[leoncheng57]

Summary

The deployed OpenCode binary is a fork build carrying two local patches, but it reported a bare 1.18.23. That string is what /global/health, --version, the LLM User-Agent, MCP clientInfo and the durable per-session version field all report, so every one of them attributed fork-only behaviour — including a task.model parameter stock 1.18.23 does not have — to upstream.

The build now reports 1.18.23+dca.2, and the pin follows it.

Why build metadata, not a prerelease

Form	Plugin engines ranges	Ordering vs stock	Honest about the fork
1.18.23	passes	equal	no
1.18.23-dca.1	fails >=1.18.0	sorts lower	yes
1.18.23+dca.2	passes	equal	yes

OpenCode gates plugin loading on semver.satisfies. A prerelease only satisfies a comparator set when a comparator with the same major.minor.patch also carries a prerelease, so 1.18.23-dca.1 would fail an ordinary >=1.18.0 range and any plugin declaring engines.opencode would throw at load. Build metadata is stripped before comparison, so precedence is identical to the release. This also matches what upstream already does for its own non-published builds in nix/node_modules.nix.

<n> counts the fork patch set: 1 is the deny-inheritance fix from closed-unmerged anomalyco/opencode#45064, 2 is the task model parameter from leoncheng57/opencode#4.

scripts/dev.sh

The pin was extracted with a bare MAJOR.MINOR.PATCH regex while the server's version was read whole, so a +dca.2 pin would have printed ! version skew on every npm run dev. A warning that always fires is worse than none, especially when this one is the signal that catches an accidental fallback to a stock binary — which silently reintroduces the #75 deny-inheritance bug. The pin is now captured verbatim, with regression tests in both directions.

Verification

• npm run typecheck — VERIFIED
• npm test — VERIFIED: 1186 passed, 2 skipped, 66 files
• npm run build — VERIFIED
• CI=1 PORT=3581 MOCK_OPENCODE_PORT=4784 MOCK_PREVIEW_PORT=4785 npm run test:e2e — VERIFIED: 364 passed, 1 skipped, 1 flaky (settings and tools UI > badges unresolved notifications, unrelated to versioning, passed on retry)
• npm run test:preview — VERIFIED: 1 passed
• Built the binary with OPENCODE_VERSION=1.18.23+dca.2 OPENCODE_CHANNEL=prod and verified it in isolation on a throwaway port: /global/health reports 1.18.23+dca.2, and the task tool still advertises an optional model parameter absent from required. The live server on 4097 was not touched.

Human verification

1. Run npm run dev against the fork server. Expected: no ! version skew line. Failure: a skew warning naming the same two versions.
2. Point the BFF at a stock binary. Expected: the skew banner appears. Failure: silence, which would mean the tripwire is gone.
3. Open the Hub. Expected: the upstream badge reads 1.18.23+dca.2. Failure: a bare 1.18.23.

Deployment

Not applied. The new binary is installed at ~/.opencode/bin/opencode-1.18.23-dca.2 alongside its rollback artifacts, but the LaunchAgent still points at opencode-1.18.23-dca-taskmodel and no service was restarted.