# ADR-0107: Extension versions are semver and are compared

- **Status:** Accepted
- **Date:** 2026-09-12
- **Deciders:** jka
- **Decision:** D107

## Context

The Extensions window could install and remove, but could not tell a user whether an
installed extension was out of date. ADR-0039 had made `version` an opaque string that rio
never compares. The maintainer asked for apt-like update checks and upgrades, run from the
window, when it opens, and optionally at start-up.

## Decision

**Versions are Semantic Versioning, and rio orders them.** This reverses ADR-0039's rule
while all extensions are still in-house.

- Parsing is lenient in one respect: one to three numeric components, missing ones treated
  as zero, so `1.1` reads as `1.1.0`. Pre-release identifiers require all three components;
  otherwise a date such as `2026-07-17` would parse as a version. Build metadata is ignored.
- A string that does not parse makes no claim: the extension still lists and installs,
  marked "version not comparable", but no update is offered.

**Updates come from the same source by default.** With no central namespace (ADR-0039),
an extension of the same name on another host may be a different program. An update is
offered only from the repository the ledger records. A higher version elsewhere is listed
as a variant to switch to explicitly, with consent that names the new source. A
per-extension `anysource` flag allows cross-source updates for mirrors and forks.

**The installed version of a provider comes from the core.** The GUI's view of installed
extensions starts from its ledger, but for providers `provider.list` is authoritative, so a
provider installed by another frontend or on a remote core shows its real version and can be
updated or removed. This derived view is never written back to the ledger.

**Consent matches the decision.** Update All asks once, listing each extension, its version
change and its host. Updates that cross into a different repository are listed separately
under their own heading.

**The start-up check is opt-in and quiet.** It is off by default, because a fresh rio makes
no network request it was not asked to make, and on a remote core the request comes from
someone else's machine. It runs on a timer after start-up, waits while another operation is
in flight, ignores failures, and reports only findings, in a plain dialog with a "Don't check
for updates at start-up" option. The dialog does not grab input. The setting lives in a new
Preferences ▸ Extensions page. A badge on the menu item was rejected as out of keeping with
the period style.

## Consequences

- Users can see and apply updates, individually or all at once.
- Publishers must follow semver to get update tracking; not doing so costs only that.
- No core changes were needed; the division of labour in ADR-0039 held.
- rio's own extensions were renumbered to three-component versions.