fix(auto-update-checker): use OpenCode cache paths for updates

[acamq]

Summary

• fix auto-update path resolution to use the OpenCode cache directory for installed plugin metadata and install execution
• update invalidation to target cache artifacts (node_modules + resolved lock package entry) while preserving declared dependencies so update flow does not converge to uninstall
• add regression coverage for cache path constants, invalidation behavior, and bun install cwd, and verify with typecheck/build and auto-update tests

---

Summary by cubic

Fixes the auto-update flow to use the OpenCode cache directory and correctly handle Bun lockfiles, so updates target the loaded plugin and don’t uninstall it.

• Bug Fixes
  • Route all update paths to getOpenCodeCacheDir(): CACHE_DIR, INSTALLED_PACKAGE_JSON, and lockfile paths; run bun install in that directory.
  • Validate workspace before install by ensuring package.json exists; improve timeout handling with quoted paths and safer process kill logging.
  • Invalidate by removing node_modules/oh-my-opencode and the packages entry from bun.lock; support bun.lockb by deleting it; keep package.json and workspace dependency declarations intact.
  • Add regression tests for constants, cache invalidation (text and binary lockfiles), and bun install cwd.

^{Written for commit c4112f8. Summary will update on new commits.}

[acamq]

@cubic-dev-ai review

[cubic-dev-ai]

@cubic-dev-ai review

@acamq I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Auto-approved: Fixes path consistency by using cache directory and improves update reliability with better invalidation logic. Includes comprehensive regression tests.}

[cubic-dev-ai]

1 issue found across 6 files

Confidence score: 4/5

• This PR is likely safe to merge with minimal risk: the reported problem is confined to test behavior in src/hooks/auto-update-checker/cache.test.ts, not a clear runtime production regression.
• Most severe issue: dynamic import cache busting does not affect dependencies, so constants.ts can remain cached and make this test flaky/non-deterministic in CI.
• Given the 6/10 severity and high confidence (9/10), this is a real reliability concern for test stability, but it appears limited in scope rather than merge-blocking functionality risk.
• Pay close attention to src/hooks/auto-update-checker/cache.test.ts and constants.ts - dependency caching can undermine cache-busting assumptions and cause flaky test outcomes.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/hooks/auto-update-checker/cache.test.ts">

<violation number="1" location="src/hooks/auto-update-checker/cache.test.ts:63">
P2: Dynamic import cache busting does not apply to dependencies, causing test flakiness due to `constants.ts` caching.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}