sea-loader.js: lexicographical localeCompare in fi() causes -9 to be selected over -10 / -11 in package cache

[Zelys-DFKH]

Summary

In sea-loader.js, the local version comparison helper fi(e, t) uses e.localeCompare(t) to compare prerelease / build tag suffixes when major/minor/patch segments match.

Because "1.0.81-9".localeCompare("1.0.81-11") returns 1 (lexicographical sorting where '9' > '1'), the bootstrap loader determines that 1.0.81-9 is newer than 1.0.81-10 or 1.0.81-11. Consequently, even after copilot update successfully downloads and extracts 1.0.81-11 into the package cache (%LOCALAPPDATA%\copilot\pkg\win32-x64\1.0.81-11), launching copilot continues to execute the cached 1.0.81-9 version.

---

Root Cause Analysis

In sea-loader.js:

function fi(e, t) {
  let i = kr(e), r = kr(t);
  if (!i && !r) return 0;
  if (!i) return -1;
  if (!r) return 1;
  for (let o = 0; o < 3; o++) {
    if (i[o] !== r[o]) return i[o] - r[o];
  }
  let s = e.includes("-"), n = t.includes("-");
  return s !== n ? (s ? -1 : 1) : e.localeCompare(t);
}

1. kr() parses the first 3 dot-delimited integer segments [major, minor, patch].
2. When comparing 1.0.81-9 and 1.0.81-11, the numeric segments [1, 0, 81] match.
3. Both strings include -, so s !== n is false.
4. The fallback is e.localeCompare(t).
5. "1.0.81-9".localeCompare("1.0.81-11") evaluates to 1 (since '9' > '1').
6. In mi("index.js", ...):

   i.sort((r, s) => {
     let n = fi(basename(s), basename(r));
     return n !== 0 ? n : ...;
   });

   The version list is sorted descending using fi(), placing 1.0.81-9 at the top before 1.0.81-11.
7. hh() finds 1.0.81-9 and executes its index.js.

---

Steps to Reproduce

1. Have both 1.0.81-9 and 1.0.81-11 in %LOCALAPPDATA%\copilot\pkg\win32-x64\.
2. Run copilot --version.
3. Observed: Outputs GitHub Copilot CLI 1.0.81-9..
4. Explicitly passing --prefer-version 1.0.81-11 (copilot --prefer-version 1.0.81-11 --version) outputs GitHub Copilot CLI 1.0.81-11..
5. Renaming/removing 1.0.81-9 immediately allows default copilot --version to output GitHub Copilot CLI 1.0.81-11..

---

Suggested Fix

Implement SemVer-compliant prerelease identifier comparison in fi() by splitting the prerelease tag (e.g. on . or -) and comparing numeric identifiers as integers and string identifiers lexicographically:

function comparePrerelease(a, b) {
  const parsePart = (p) => /^\d+$/.test(p) ? parseInt(p, 10) : p;
  const partsA = a.replace(/^[^-]*-/, '').split('.').map(parsePart);
  const partsB = b.replace(/^[^-]*-/, '').split('.').map(parsePart);
  const len = Math.max(partsA.length, partsB.length);
  for (let i = 0; i < len; i++) {
    if (partsA[i] === undefined) return -1;
    if (partsB[i] === undefined) return 1;
    if (partsA[i] === partsB[i]) continue;
    if (typeof partsA[i] === 'number' && typeof partsB[i] === 'number') {
      return partsA[i] - partsB[i];
    }
    return String(partsA[i]).localeCompare(String(partsB[i]));
  }
  return 0;
}

---

Environment

• Platform: Windows 11 (win32-x64)
• Copilot CLI: 1.0.81-11 binary loading 1.0.81-9 cached package