fix(releases): sort by published_at to find latest release

GitHub API doesn't guarantee release order, causing getLatestRelease()
to potentially return outdated releases. This caused socket-btm tools
to download old versions when multiple releases existed for the same day.

Solution: Filter matching releases, then sort by published_at descending
to ensure we always get the most recently published release.

Fixes issue where node-smol-20260112-d8601d1 was returned instead of
the newer node-smol-20260112-9ec3865 despite having a later published_at.

Author: jdalton

src/releases/github.ts

@@ -261,34 +261,51 @@ export async function getLatestRelease(
 
       const releases = JSON.parse(response.body.toString('utf8'))
 
-      // Find the first release matching the tool prefix.
-      for (const release of releases) {
-        const { assets, tag_name: tag } = release
-        if (!tag.startsWith(toolPrefix)) {
-          continue
-        }
+      // Filter releases matching the tool prefix.
+      const matchingReleases = releases.filter(
+        (release: { tag_name: string; assets: Array<{ name: string }> }) => {
+          const { assets, tag_name: tag } = release
+          if (!tag.startsWith(toolPrefix)) {
+            return false
+          }
 
-        // If asset pattern provided, check if release has matching asset.
-        if (isMatch) {
-          const hasMatchingAsset = assets.some((a: { name: string }) =>
-            isMatch(a.name),
-          )
-          if (!hasMatchingAsset) {
-            continue
+          // If asset pattern provided, check if release has matching asset.
+          if (isMatch) {
+            const hasMatchingAsset = assets.some((a: { name: string }) =>
+              isMatch(a.name),
+            )
+            if (!hasMatchingAsset) {
+              return false
+            }
           }
-        }
 
+          return true
+        },
+      )
+
+      if (matchingReleases.length === 0) {
+        // No matching release found.
         if (!quiet) {
-          logger.info(`Found release: ${tag}`)
+          logger.info(`No ${toolPrefix} release found in latest 100 releases`)
         }
-        return tag
+        return null
       }
 
-      // No matching release found.
+      // Sort by published_at descending (newest first).
+      // GitHub API doesn't guarantee order, so we must sort explicitly.
+      matchingReleases.sort(
+        (a: { published_at: string }, b: { published_at: string }) =>
+          new Date(b.published_at).getTime() -
+          new Date(a.published_at).getTime(),
+      )
+
+      const latestRelease = matchingReleases[0]
+      const tag = latestRelease.tag_name
+
       if (!quiet) {
-        logger.info(`No ${toolPrefix} release found in latest 100 releases`)
+        logger.info(`Found release: ${tag}`)
       }
-      return null
+      return tag
     },
     {
       ...RETRY_CONFIG,

test/unit/releases-github.test.mts

@@ -302,6 +302,145 @@ describe('releases/github', () => {
       })
       expect(tag).toBeNull()
     })
+
+    it('should sort by published_at and return most recent release', async () => {
+      // Mock releases with same prefix but different published_at times.
+      const releasesOutOfOrder = [
+        {
+          assets: [{ name: 'node-darwin-arm64' }],
+          published_at: '2026-01-12T10:00:00Z',
+          tag_name: 'node-smol-20260112-d8601d1',
+        },
+        {
+          assets: [{ name: 'node-darwin-arm64' }],
+          published_at: '2026-01-12T15:30:00Z', // Most recent
+          tag_name: 'node-smol-20260112-9ec3865',
+        },
+        {
+          assets: [{ name: 'node-darwin-arm64' }],
+          published_at: '2026-01-12T08:00:00Z',
+          tag_name: 'node-smol-20260112-abc1234',
+        },
+      ]
+
+      vi.mocked(httpRequest).mockResolvedValue(
+        createMockHttpResponse(
+          Buffer.from(JSON.stringify(releasesOutOfOrder)),
+          true,
+          200,
+        ),
+      )
+
+      const tag = await getLatestRelease('node-smol-', SOCKET_BTM_REPO, {
+        quiet: true,
+      })
+
+      // Should return the release with the latest published_at time.
+      expect(tag).toBe('node-smol-20260112-9ec3865')
+    })
+
+    it('should handle multiple releases on same day with different times', async () => {
+      // Simulate scenario where GitHub API returns releases in arbitrary order.
+      const sameDay = [
+        {
+          assets: [{ name: 'yoga-sync-abc.mjs' }],
+          published_at: '2026-01-12T09:15:22Z',
+          tag_name: 'yoga-layout-20260112-first',
+        },
+        {
+          assets: [{ name: 'yoga-sync-xyz.mjs' }],
+          published_at: '2026-01-12T14:45:10Z', // Latest
+          tag_name: 'yoga-layout-20260112-latest',
+        },
+        {
+          assets: [{ name: 'yoga-sync-def.mjs' }],
+          published_at: '2026-01-12T11:30:00Z',
+          tag_name: 'yoga-layout-20260112-middle',
+        },
+      ]
+
+      vi.mocked(httpRequest).mockResolvedValue(
+        createMockHttpResponse(Buffer.from(JSON.stringify(sameDay)), true, 200),
+      )
+
+      const tag = await getLatestRelease('yoga-layout-', SOCKET_BTM_REPO, {
+        quiet: true,
+      })
+
+      expect(tag).toBe('yoga-layout-20260112-latest')
+    })
+
+    it('should sort by published_at even when API returns newest first', async () => {
+      // Test that we don't rely on API ordering.
+      const releasesNewestFirst = [
+        {
+          assets: [{ name: 'models-data.tar.gz' }],
+          published_at: '2026-01-15T12:00:00Z', // Newest
+          tag_name: 'models-20260115-newest',
+        },
+        {
+          assets: [{ name: 'models-data.tar.gz' }],
+          published_at: '2026-01-14T12:00:00Z',
+          tag_name: 'models-20260114-older',
+        },
+        {
+          assets: [{ name: 'models-data.tar.gz' }],
+          published_at: '2026-01-13T12:00:00Z',
+          tag_name: 'models-20260113-oldest',
+        },
+      ]
+
+      vi.mocked(httpRequest).mockResolvedValue(
+        createMockHttpResponse(
+          Buffer.from(JSON.stringify(releasesNewestFirst)),
+          true,
+          200,
+        ),
+      )
+
+      const tag = await getLatestRelease('models-', SOCKET_BTM_REPO, {
+        quiet: true,
+      })
+
+      expect(tag).toBe('models-20260115-newest')
+    })
+
+    it('should sort by published_at with asset pattern filtering', async () => {
+      // Multiple releases matching prefix, but only some have matching assets.
+      const releasesWithAssets = [
+        {
+          assets: [{ name: 'node-linux-x64' }], // No matching asset
+          published_at: '2026-01-12T16:00:00Z',
+          tag_name: 'node-smol-20260112-no-match',
+        },
+        {
+          assets: [{ name: 'node-darwin-arm64' }], // Matching asset, oldest
+          published_at: '2026-01-12T10:00:00Z',
+          tag_name: 'node-smol-20260112-older',
+        },
+        {
+          assets: [{ name: 'node-darwin-arm64' }], // Matching asset, newest
+          published_at: '2026-01-12T14:00:00Z',
+          tag_name: 'node-smol-20260112-newer',
+        },
+      ]
+
+      vi.mocked(httpRequest).mockResolvedValue(
+        createMockHttpResponse(
+          Buffer.from(JSON.stringify(releasesWithAssets)),
+          true,
+          200,
+        ),
+      )
+
+      const tag = await getLatestRelease('node-smol-', SOCKET_BTM_REPO, {
+        assetPattern: 'node-darwin-*',
+        quiet: true,
+      })
+
+      // Should return the newest release that has the matching asset.
+      expect(tag).toBe('node-smol-20260112-newer')
+    })
   })
 
   describe('getReleaseAssetUrl', () => {