fix(version): compare SemVer prereleases correctly

sdk/typescript/src/version.ts

@@ -13,7 +13,7 @@ export const BUNDLED_PLUGIN_VERSION = "0.1.14" as const;
 
 const PACKAGE_NAME = "@openai/codex-security";
 const VERSION_PATTERN =
-  /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u;
+  /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u;
 
 export interface UpdateNotice {
   readonly currentVersion: string;
@@ -144,24 +144,84 @@ export function formatUpdateNotice(notice: UpdateNotice): string {
 function isNewerVersion(latest: string, current: string): boolean {
   const candidate = VERSION_PATTERN.exec(latest);
   const installed = VERSION_PATTERN.exec(current);
-  if (candidate === null || installed === null) return false;
+  if (
+    candidate === null ||
+    installed === null ||
+    !isValidPrerelease(candidate[4]) ||
+    !isValidPrerelease(installed[4])
+  ) {
+    return false;
+  }
 
   for (let index = 1; index <= 3; index += 1) {
-    const difference = Number(candidate[index]) - Number(installed[index]);
+    const difference = compareNumericIdentifiers(
+      candidate[index]!,
+      installed[index]!,
+    );
     if (difference !== 0) return difference > 0;
   }
 
   if (candidate[4] === installed[4]) return false;
   if (candidate[4] === undefined) return true;
   if (installed[4] === undefined) return false;
+  return isNewerPrerelease(candidate[4], installed[4]);
+}
+
+function isNewerPrerelease(candidate: string, installed: string): boolean {
+  const candidateIdentifiers = candidate.split(".");
+  const installedIdentifiers = installed.split(".");
+  const length = Math.max(
+    candidateIdentifiers.length,
+    installedIdentifiers.length,
+  );
+
+  for (let index = 0; index < length; index += 1) {
+    const candidateIdentifier = candidateIdentifiers[index];
+    const installedIdentifier = installedIdentifiers[index];
+    if (candidateIdentifier === installedIdentifier) continue;
+    if (candidateIdentifier === undefined) return false;
+    if (installedIdentifier === undefined) return true;
+
+    const candidateIsNumeric = /^\d+$/u.test(candidateIdentifier);
+    const installedIsNumeric = /^\d+$/u.test(installedIdentifier);
+    if (candidateIsNumeric && installedIsNumeric) {
+      return (
+        compareNumericIdentifiers(candidateIdentifier, installedIdentifier) > 0
+      );
+    }
+    if (candidateIsNumeric !== installedIsNumeric) {
+      return !candidateIsNumeric;
+    }
+    return candidateIdentifier > installedIdentifier;
+  }
+
+  return false;
+}
+
+function isValidPrerelease(value: string | undefined): boolean {
   return (
-    new Intl.Collator("en", { numeric: true }).compare(
-      candidate[4],
-      installed[4],
-    ) > 0
+    value === undefined ||
+    value
+      .split(".")
+      .every(
+        (identifier) =>
+          !/^\d+$/u.test(identifier) ||
+          identifier === "0" ||
+          !identifier.startsWith("0"),
+      )
   );
 }
 
+function compareNumericIdentifiers(
+  candidate: string,
+  installed: string,
+): number {
+  if (candidate.length !== installed.length) {
+    return candidate.length > installed.length ? 1 : -1;
+  }
+  return candidate === installed ? 0 : candidate > installed ? 1 : -1;
+}
+
 function packageVersions(url: URL): {
   package: string;
   sdk: string;

sdk/typescript/tests-ts/update-notice.test.ts

@@ -102,6 +102,10 @@ describe("CLI update notice", () => {
       ["0.1.0", "0.1.0", false],
       ["0.2.0", "0.1.0", false],
       ["0.2.0", "not-a-version", false],
+      ["1.0.0", "01.0.0", false],
+      ["1.0.0-alpha.1", "1.0.0-alpha.01", false],
+      ["1.0.0", "1.0.0-alpha..1", false],
+      ["1.0.0", "1.0.0+build..1", false],
       ["0.2.0", "0.2.0-beta.1", false],
       ["0.2.0-beta.2", "0.2.0-beta.1", false],
       ["0.2.0-beta.1", "0.2.0-beta.2", true],
@@ -125,6 +129,64 @@ describe("CLI update notice", () => {
     ).toBeUndefined();
   });
 
+  test("uses SemVer precedence for prerelease identifiers", async () => {
+    const precedence = [
+      "1.0.0-alpha",
+      "1.0.0-alpha.1",
+      "1.0.0-alpha.beta",
+      "1.0.0-beta",
+      "1.0.0-beta.2",
+      "1.0.0-beta.11",
+      "1.0.0-rc.1",
+      "1.0.0",
+    ];
+
+    for (let index = 1; index < precedence.length; index += 1) {
+      const lower = precedence[index - 1]!;
+      const higher = precedence[index]!;
+      await expect(
+        checkForUpdate({
+          environment: {},
+          currentVersion: lower,
+          fetch: registryResponse(higher),
+        }),
+      ).resolves.toBeDefined();
+      await expect(
+        checkForUpdate({
+          environment: {},
+          currentVersion: higher,
+          fetch: registryResponse(lower),
+        }),
+      ).resolves.toBeUndefined();
+    }
+
+    await expect(
+      checkForUpdate({
+        environment: {},
+        currentVersion: "1.0.0-alpha.1",
+        fetch: registryResponse("1.0.0-alpha-1"),
+      }),
+    ).resolves.toBeDefined();
+
+    const longNumericIdentifier = "9".repeat(4_096);
+    await expect(
+      checkForUpdate({
+        environment: {},
+        currentVersion: `1.0.0-alpha.${longNumericIdentifier}`,
+        fetch: registryResponse(`1.0.0-alpha.1${longNumericIdentifier}`),
+      }),
+    ).resolves.toBeDefined();
+
+    const longCoreTail = "0".repeat(4_095);
+    await expect(
+      checkForUpdate({
+        environment: {},
+        currentVersion: `1${longCoreTail}.0.0`,
+        fetch: registryResponse(`2${longCoreTail}.0.0`),
+      }),
+    ).resolves.toBeDefined();
+  });
+
   test("suppresses registry checks in CI or when disabled", async () => {
     let requests = 0;
     const fetchLatest = async () => {