@baize-ai/core 0.3.14 → 0.3.16

package/test/model-provider.test.js

@@ -41,6 +41,10 @@ function readToml() {
   const p = path.join(homeDir, '.codex', 'config.toml');
   return fs.existsSync(p) ? fs.readFileSync(p, 'utf8') : '';
 }
+function readProjectToml() {
+  const p = path.join(baizeDir, '.codex', 'config.toml');
+  return fs.existsSync(p) ? fs.readFileSync(p, 'utf8') : '';
+}
 function readStore() {
   const p = path.join(baizeDir, '.baize', 'providers.json');
   return fs.existsSync(p) ? JSON.parse(fs.readFileSync(p, 'utf8')) : {};
@@ -52,10 +56,11 @@ describe('provider store', () => {
     expect(mp.getProviders()).toEqual({ active: 'official', providers: [] });
   });
 
-  test('saveProvider validates name and url', async () => {
+  test('saveProvider validates name, url, and kind', async () => {
     expect((await mp.saveProvider({})).success).toBe(false);
     expect((await mp.saveProvider({ name: 'x', cc: { baseUrl: 'ftp://bad' } })).success).toBe(false);
     expect((await mp.saveProvider({ name: 'x', codex: { baseUrl: 'nope' } })).success).toBe(false);
+    expect((await mp.saveProvider({ name: 'x', codex: { kind: 'bogus-kind' } })).success).toBe(false);
   });
 
   test('saveProvider persists sanitized entry (no secrets echoed)', async () => {
@@ -70,6 +75,64 @@ describe('provider store', () => {
     expect(stored.providers[0].cc.authToken).toBe('sk-ds-token'); // persisted, just not echoed
   });
 
+  test('saveProvider assigns codex kind + providerKey (D51)', async () => {
+    const r = await mp.saveProvider(DEEPSEEK);
+    expect(r.provider.codex.kind).toBe('responses-compatible');
+    expect(r.provider.codex.providerKey).toBe('deepseek');
+    // Stored (not just sanitized) so the slug is stable across restarts.
+    const stored = readStore();
+    expect(stored.providers[0].codex.kind).toBe('responses-compatible');
+    expect(stored.providers[0].codex.providerKey).toBe('deepseek');
+  });
+
+  test('provider without codex.baseUrl defaults to openai-official kind', async () => {
+    const r = await mp.saveProvider({ name: 'Claude Only', cc: { baseUrl: 'https://a', authToken: 'sk', model: 'm' } });
+    expect(r.success).toBe(true);
+    expect(r.provider.codex.kind).toBe('openai-official');
+    expect(r.provider.codex.providerKey).toBe('claude-only');
+  });
+
+  test('codex kind can be set explicitly, chat-only included', async () => {
+    const r = await mp.saveProvider({ name: 'Old Gateway', codex: { baseUrl: 'https://legacy.example.com', kind: 'chat-only' } });
+    expect(r.success).toBe(true);
+    expect(r.provider.codex.kind).toBe('chat-only');
+  });
+
+  test('providerKey falls back to codex-<hash8> for reserved slugs (D51)', async () => {
+    // Raw reserved key 'openai' → codex-<hash8>; the id itself is sanitized to
+    // 'openai-custom' by genId, which is a safe non-reserved slug.
+    const r = await mp.saveProvider({ name: 'OpenAI', codex: { baseUrl: 'https://api.deepseek.com', apiKey: 'sk', model: 'm' } });
+    expect(r.success).toBe(true);
+    expect(r.provider.id).toBe('openai-custom'); // genId reservation (D51-extended)
+    expect(r.provider.codex.providerKey).toBe('openai-custom');
+    expect(r.provider.codex.providerKey).not.toBe('openai');
+  });
+
+  test('explicit kind survives an update; slug stays stable (D51)', async () => {
+    const created = await mp.saveProvider(DEEPSEEK);
+    const updated = await mp.saveProvider({ id: created.provider.id, name: 'DeepSeek 主', codex: { baseUrl: 'https://api.deepseek.com/v2', apiKey: 'sk2', model: 'm2' } });
+    expect(updated.success).toBe(true);
+    expect(updated.provider.codex.kind).toBe('responses-compatible'); // unchanged
+    expect(updated.provider.codex.providerKey).toBe('deepseek'); // slug never regenerated
+  });
+
+  test('lazy migration backfills kind/providerKey for legacy store entries (D51)', async () => {
+    // Simulate a pre-D51 providers.json: codex config but no kind/providerKey.
+    fs.writeFileSync(
+      path.join(baizeDir, '.baize', 'providers.json'),
+      JSON.stringify({
+        active: 'legacy',
+        providers: [{ id: 'legacy', name: 'Legacy', codex: { baseUrl: 'https://api.deepseek.com', apiKey: 'sk', model: 'm' } }],
+      }),
+    );
+    const list = mp.getProviders();
+    expect(list.providers[0].codex.kind).toBe('responses-compatible');
+    expect(list.providers[0].codex.providerKey).toBe('legacy');
+    // Backfill is persisted by the lazy migration.
+    expect(readStore().providers[0].codex.kind).toBe('responses-compatible');
+    expect(readStore().providers[0].codex.providerKey).toBe('legacy');
+  });
+
   test('deleteProvider falls back to official when active', async () => {
     await mp.saveProvider(DEEPSEEK);
     const store = readStore();
@@ -82,7 +145,7 @@ describe('provider store', () => {
 });
 
 describe('activateProvider — external (cc + codex)', () => {
-  test('applies env/settings/auth/toml, stashes official key, restarts', async () => {
+  test('applies env/settings/auth + provider block, stashes official key, restarts', async () => {
     // Pre-configure an official API key via D5-style storage
     fs.writeFileSync(path.join(baizeDir, '.env'), 'ANTHROPIC_API_KEY=sk-ant-official-key\n');
     fs.mkdirSync(path.join(homeDir, '.claude'), { recursive: true });
@@ -104,7 +167,7 @@ describe('activateProvider — external (cc + codex)', () => {
     expect(env).toMatch(/^ANTHROPIC_BASE_URL=https:\/\/api\.deepseek\.com\/anthropic$/m);
     expect(env).toMatch(/^ANTHROPIC_MODEL=deepseek-chat$/m);
     expect(env).toMatch(/^ANTHROPIC_SMALL_FAST_MODEL=deepseek-chat$/m);
-    expect(env).toMatch(/^OPENAI_BASE_URL=https:\/\/api\.deepseek\.com$/m);
+    expect(env).toMatch(/^OPENAI_BASE_URL=https:\/\/api\.deepseek\.com$/m); // legacy health-probe surface, kept
     expect(env).not.toMatch(/ANTHROPIC_API_KEY/);
 
     // settings.json env: same
@@ -115,12 +178,29 @@ describe('activateProvider — external (cc + codex)', () => {
     // stash preserved for revert
     expect(readStore().stash.apiKey).toBe('sk-ant-official-key');
 
-    // codex auth.json + config.toml
+    // codex auth.json + provider block config (D51)
     const auth = JSON.parse(fs.readFileSync(path.join(homeDir, '.codex', 'auth.json'), 'utf8'));
     expect(auth.OPENAI_API_KEY).toBe('sk-ds-key');
     const toml = readToml();
-    expect(toml).toMatch(/^model = "deepseek-chat"$/m);
-    expect(toml).toMatch(/^openai_base_url = "https:\/\/api\.deepseek\.com"$/m);
+    expect(toml).toMatch(/^model_provider = "deepseek"$/m);
+    expect(toml).toMatch(/^\[model_providers\.deepseek\]$/m);
+    expect(toml).toMatch(/^name = "deepseek"$/m);
+    expect(toml).toMatch(/^base_url = "https:\/\/api\.deepseek\.com"$/m);
+    expect(toml).toMatch(/^wire_api = "responses"$/m);
+    expect(toml).toMatch(/^experimental_bearer_token = "sk-ds-key"$/m);
+    // the legacy override must never coexist with the provider block
+    expect(toml).not.toMatch(/openai_base_url/);
+
+    // project-level: model ensured, openai_base_url cleaned, no provider block
+    const projectToml = readProjectToml();
+    expect(projectToml).toMatch(/^model = "deepseek-chat"$/m);
+    expect(projectToml).not.toMatch(/openai_base_url/);
+    expect(projectToml).not.toMatch(/model_provider/);
+    expect(projectToml).not.toMatch(/\[model_providers\./);
+
+    // token-bearing global config is user-only
+    const mode = fs.statSync(path.join(homeDir, '.codex', 'config.toml')).mode & 0o777;
+    expect(mode).toBe(0o600);
   });
 
   test('probe failure surfaces a warning but still applies', async () => {
@@ -139,6 +219,22 @@ describe('activateProvider — external (cc + codex)', () => {
   });
 });
 
+describe('activateProvider — chat-only interception (D51)', () => {
+  test('activating a chat-only provider is rejected before anything is written', async () => {
+    const saved = await mp.saveProvider({
+      name: '旧网关',
+      codex: { baseUrl: 'https://legacy.example.com', apiKey: 'sk-legacy', model: 'gpt-3.5', kind: 'chat-only' },
+    });
+    const before = readToml();
+    const r = await mp.activateProvider(saved.provider.id, { probe: async () => true, restart: noopRestart });
+    expect(r.success).toBe(false);
+    expect(r.error).toMatch(/仅支持 Chat 接口/);
+    expect(r.error).toMatch(/Claude 运行时/);
+    expect(readToml()).toBe(before); // nothing written
+    expect(readEnv()).not.toMatch(/OPENAI_BASE_URL=https:\/\/legacy\.example\.com/);
+  });
+});
+
 describe('activateProvider — official restores', () => {
   test('official clears external vars and restores stashed key', async () => {
     fs.writeFileSync(path.join(baizeDir, '.env'), 'ANTHROPIC_API_KEY=sk-ant-official-key\n');
@@ -160,58 +256,57 @@ describe('activateProvider — official restores', () => {
     expect(readStore().stash).toBeUndefined(); // stash cleared from file
   });
 
-  test('official-openai clears codex base_url and resets model', async () => {
+  test('official-openai drops the provider block and resets model to gpt-5.5 (D51)', async () => {
     await mp.saveProvider(DEEPSEEK);
     await mp.activateProvider('deepseek', { probe: async () => true, restart: noopRestart });
 
     const r = await mp.activateProvider('official-openai', { restart: noopRestart });
     expect(r.success).toBe(true);
+    expect(r.codexProviderKey).toBeNull();
     const env = readEnv();
-    expect(env).not.toMatch(/OPENAI_BASE_URL/);
     const toml = readToml();
+    expect(env).not.toMatch(/OPENAI_BASE_URL/);
     expect(toml).toMatch(/^model = "gpt-5.5"$/m);
+    expect(toml).not.toMatch(/^model_provider/m);
+    expect(toml).not.toMatch(/\[model_providers\.deepseek\]/);
     expect(toml).not.toMatch(/openai_base_url/);
-  });
-});
-
-describe('editCodexConfigToml (TOML scope aware)', () => {
-  test('top-level keys land BEFORE the first section header; section content byte-preserved', () => {
-    fs.mkdirSync(path.join(homeDir, '.codex'), { recursive: true });
-    fs.writeFileSync(path.join(homeDir, '.codex', 'config.toml'), '# comment\n\n[model_providers.my]\nbase_url = "https://x"\nmodel = "other"\n');
-    mp.editCodexConfigToml({ model: 'deepseek-chat', openaiBaseUrl: 'https://api.deepseek.com' });
-    const toml = readToml();
-    const sectionIdx = toml.indexOf('[model_providers.my]');
-    // top-level keys must appear in the prefix BEFORE the section header
-    const topLevelIdx = toml.indexOf('model = "deepseek-chat"');
-    const baseUrlIdx = toml.indexOf('openai_base_url = "https://api.deepseek.com"');
-    expect(topLevelIdx).toBeGreaterThanOrEqual(0);
-    expect(baseUrlIdx).toBeGreaterThanOrEqual(0);
-    expect(topLevelIdx).toBeLessThan(sectionIdx);
-    expect(baseUrlIdx).toBeLessThan(sectionIdx);
-    // section content untouched
-    expect(toml).toMatch(/^\[model_providers\.my\]$/m);
-    expect(toml).toMatch(/^base_url = "https:\/\/x"$/m);
-    expect(toml).toMatch(/^model = "other"$/m);
+    const projectToml = readProjectToml();
+    expect(projectToml).not.toMatch(/openai_base_url/);
   });
 
-  test('replaces existing top-level keys without duplicating', () => {
+  test('official-openai removes baize-written tables but preserves hand-edited ones (D51 review P2)', async () => {
+    // Contract (review P2): a baize-written block always has name === key &&
+    // wire_api === 'responses'. Those are removed on restore. Hand-edited
+    // user providers (any other shape) survive untouched.
     fs.mkdirSync(path.join(homeDir, '.codex'), { recursive: true });
-    fs.writeFileSync(path.join(homeDir, '.codex', 'config.toml'), 'model = "gpt-5.5"\n');
-    mp.editCodexConfigToml({ model: 'deepseek-chat', openaiBaseUrl: 'https://api.deepseek.com' });
+    fs.writeFileSync(
+      path.join(homeDir, '.codex', 'config.toml'),
+      'model_provider = "deepseek"\n\n[model_providers.deepseek]\nname = "deepseek"\nbase_url = "https://api.deepseek.com"\nwire_api = "responses"\n\n[model_providers.myrelay]\nname = "My Relay"\nbase_url = "https://r.example"\n',
+    );
+    const r = await mp.activateProvider('official-openai', { restart: noopRestart });
+    expect(r.success).toBe(true);
     const toml = readToml();
-    expect(toml.match(/^model = "deepseek-chat"$/gm)).toHaveLength(1);
-    expect(toml.match(/^openai_base_url = "https:\/\/api\.deepseek\.com"$/gm)).toHaveLength(1);
+    expect(toml).toMatch(/^model = "gpt-5.5"$/m);
+    expect(toml).not.toMatch(/^model_provider/m);
+    expect(toml).not.toMatch(/\[model_providers\.deepseek\]/, 'baize-written block removed');
+    expect(toml).toMatch(/\[model_providers\.myrelay\]/, 'hand-edited provider survives');
+    expect(toml).toMatch(/name = "My Relay"/);
   });
 
-  test('removes openai_base_url on official restore, keeping sections', () => {
+  test('activating an openai-official-kind provider keeps the built-in OpenAI provider (D51)', async () => {
+    fs.mkdirSync(path.join(baizeDir, '.baize'), { recursive: true });
+    fs.writeFileSync(path.join(baizeDir, '.baize', 'config.json'), JSON.stringify({ runtime: 'codex' }));
     fs.mkdirSync(path.join(homeDir, '.codex'), { recursive: true });
-    fs.writeFileSync(path.join(homeDir, '.codex', 'config.toml'), 'openai_base_url = "https://api.deepseek.com"\n\n[model_providers.my]\nmodel = "deepseek-chat"\n');
-    mp.editCodexConfigToml({ model: 'gpt-5.5', openaiBaseUrl: null });
+    // fixture: baize-written shape (name === key && wire_api === responses) so restore removes it
+    fs.writeFileSync(path.join(homeDir, '.codex', 'config.toml'), 'model_provider = "deepseek"\n\n[model_providers.deepseek]\nname = "deepseek"\nbase_url = "https://api.deepseek.com"\nwire_api = "responses"\n');
+    await mp.saveProvider({ name: '官方 OpenAI', codex: { apiKey: 'sk-official', model: 'gpt-5.5' } }); // no baseUrl → openai-official
+    const r = await mp.activateProvider('openai-custom', { probe: async () => true, restart: noopRestart });
+    expect(r.success).toBe(true);
+    expect(r.codexProviderKey).toBeNull();
     const toml = readToml();
-    expect(toml).not.toMatch(/^openai_base_url/m);
+    expect(toml).not.toMatch(/^model_provider/m); // built-in provider back in charge
+    expect(toml).not.toMatch(/\[model_providers\.deepseek\]/);
     expect(toml).toMatch(/^model = "gpt-5.5"$/m);
-    expect(toml).toMatch(/^\[model_providers\.my\]$/m);
-    expect(toml).toMatch(/^model = "deepseek-chat"$/m); // section model untouched
   });
 });
 
@@ -268,3 +363,18 @@ describe('activateProvider — side-coverage validation (D13)', () => {
     expect(r.success).toBe(true);
   });
 });
+
+describe('D51 migration — legacy activation cleans stale overrides', () => {
+  test('activating a provider removes a pre-existing openai_base_url override', async () => {
+    fs.mkdirSync(path.join(homeDir, '.codex'), { recursive: true });
+    fs.writeFileSync(path.join(homeDir, '.codex', 'config.toml'), 'openai_base_url = "https://old.example.com/v1"\nmodel = "old"\n');
+    fs.mkdirSync(path.join(baizeDir, '.baize'), { recursive: true });
+    fs.writeFileSync(path.join(baizeDir, '.baize', 'config.json'), JSON.stringify({ runtime: 'codex' }));
+    await mp.saveProvider({ name: 'codex-only', codex: { baseUrl: 'https://api.deepseek.com', apiKey: 'sk', model: 'deepseek-chat' } });
+    const r = await mp.activateProvider('codex-only', { probe: async () => true, restart: noopRestart });
+    expect(r.success).toBe(true);
+    const toml = readToml();
+    expect(toml).not.toMatch(/openai_base_url/);
+    expect(toml).toMatch(/^model_provider = "codex-only"$/m);
+  });
+});

package/test/upgrade-file.test.js

@@ -0,0 +1,229 @@
+/**
+ * K4 e2e: `baize upgrade <name> --file <tgz>` — offline commercial upgrade
+ * channel. The tarball IS the source (checkForUpdates/downloadToTemp skipped);
+ * version gate via K6 getLocalVersion (package.json first); the existing
+ * 9-step runUpgrade pipeline (backup → smart merge → npm install → baseline →
+ * restart) executes unchanged, with rollback on failure.
+ */
+import { describe, test, expect, beforeAll, afterAll } from '@jest/globals';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import {
+  generateManifest,
+  loadManifest,
+  saveMergeBaseline,
+} from '../cli/lib/manifest.js';
+
+const DRIVER = path.join(import.meta.dirname, 'helpers', 'run-upgrade-file-driver.mjs');
+
+let tmpRoot;
+let baizeDir;
+let skillsDir;
+let shimDir;
+let failFlag;
+
+function mkTmp() {
+  return fs.mkdtempSync(path.join(tmpRoot, 'test-'));
+}
+
+function writeFile(dir, relPath, content) {
+  const full = path.join(dir, relPath);
+  fs.mkdirSync(path.dirname(full), { recursive: true });
+  fs.writeFileSync(full, content);
+}
+
+function readFile(dir, relPath) {
+  return fs.readFileSync(path.join(dir, relPath), 'utf8');
+}
+
+/** Install a v1 fixture: real skill dir + authoritative baseline manifest +
+ * components.json registration (required: upgrade refuses unregistered comps). */
+function installV1(name) {
+  const dest = path.join(skillsDir, name);
+  const source = mkTmp();
+  writeFile(source, 'a.js', 'v1');
+  writeFile(source, 'package.json', JSON.stringify({ name, version: '1.0.0' }));
+  writeFile(dest, 'a.js', 'v1');
+  writeFile(dest, 'package.json', JSON.stringify({ name, version: '1.0.0' }));
+  saveMergeBaseline(dest, source, generateManifest(source));
+  const componentsFile = path.join(baizeDir, '.baize', 'components.json');
+  fs.mkdirSync(path.dirname(componentsFile), { recursive: true });
+  const components = JSON.parse(fs.existsSync(componentsFile) ? fs.readFileSync(componentsFile, 'utf8') : '{}');
+  components[name] = {
+    version: '1.0.0',
+    repo: `baize-ai/${name}`,
+    skillDir: dest,
+    installedAt: new Date().toISOString(),
+  };
+  fs.writeFileSync(componentsFile, JSON.stringify(components, null, 2));
+  return dest;
+}
+
+/** Pack a real .tgz (single wrapper dir, npm publish layout). */
+function buildTarball(name, version, { pkgName = name, aContent = `v-${version}` } = {}) {
+  const dir = mkTmp();
+  writeFile(dir, path.join('package', 'a.js'), aContent);
+  writeFile(dir, path.join('package', 'package.json'), JSON.stringify({ name: pkgName, version }));
+  const out = path.join(os.tmpdir(), `upgrade-file-${name}-${version}-${Math.random().toString(36).slice(2)}.tgz`);
+  execTar(dir);
+  fs.rmSync(dir, { recursive: true, force: true });
+  return out;
+
+  function execTar(from) {
+    spawnSync('tar', ['czf', out, '-C', from, 'package'], { encoding: 'utf8' });
+  }
+}
+
+function runFileUpgrade(name, tgzPath, { check = false } = {}) {
+  const args = [DRIVER, name, tgzPath];
+  if (check) args.push('--check');
+  const child = spawnSync(process.execPath, args, {
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      BAIZE_DIR: baizeDir,
+      PATH: shimDir + path.delimiter + process.env.PATH,
+      BAIZE_TEST_BASELINE_COMMIT_FAIL: '0',
+    },
+    timeout: 60000,
+  });
+  let body = null;
+  try { body = JSON.parse(child.stdout); } catch { /* surfaced below */ }
+  return { status: child.status, stderr: child.stderr, body };
+}
+
+beforeAll(() => {
+  tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'baize-upgrade-file-e2e-'));
+  baizeDir = path.join(tmpRoot, 'baize-home');
+  skillsDir = path.join(baizeDir, '.claude', 'skills');
+  fs.mkdirSync(skillsDir, { recursive: true });
+
+  // npm shim: the pipeline's step4 must never hit the network; the fail flag
+  // lets a test exercise rollback-on-npm-install-failure.
+  shimDir = path.join(tmpRoot, 'shim-bin');
+  fs.mkdirSync(shimDir, { recursive: true });
+  failFlag = path.join(shimDir, 'npm-fail');
+  fs.writeFileSync(path.join(shimDir, 'npm'), [
+    '#!/bin/sh',
+    `if [ -e "${failFlag}" ]; then echo "simulated npm failure" >&2; exit 1; fi`,
+    'exit 0',
+    '',
+  ].join('\n'), { mode: 0o755 });
+});
+
+afterAll(() => {
+  fs.rmSync(tmpRoot, { recursive: true, force: true });
+});
+
+describe('baize upgrade <name> --file <tgz> (K4)', () => {
+  test('upgrades through the real 9-step pipeline from a local tarball', () => {
+    const name = 'file-upgrade-happy';
+    const skillDir = installV1(name);
+    const tgz = buildTarball(name, '2.0.0', { aContent: 'v2' });
+
+    const { status, body } = runFileUpgrade(name, tgz);
+
+    expect(status).toBe(0);
+    expect(body.success).toBe(true);
+    expect(body.from).toBe('1.0.0');
+    expect(body.to).toBe('2.0.0');
+    expect(body.source).toMatchObject({ type: 'local-tarball' });
+    // Pipeline actually ran (steps 1-9 present) — not a shortcut path
+    const stepNames = body.steps.map((s) => s.name);
+    expect(stepNames).toEqual(expect.arrayContaining(['stop_service', 'backup', 'smart_merge', 'npm_install', 'commit_baseline']));
+    // New files landed
+    expect(readFile(skillDir, 'a.js')).toBe('v2');
+    expect(JSON.parse(readFile(skillDir, 'package.json')).version).toBe('2.0.0');
+    // Authoritative baseline advanced to the tarball content
+    const manifest = loadManifest(skillDir);
+    expect(manifest.files['a.js']).toBeDefined();
+    // components.json bumped
+    const components = JSON.parse(readFile(path.join(baizeDir, '.baize'), 'components.json'));
+    expect(components[name].version).toBe('2.0.0');
+    expect(components[name].upgradedAt).toBeTruthy();
+    fs.rmSync(tgz, { force: true });
+  });
+
+  test('rejects a tarball whose version is not higher (version_not_higher)', () => {
+    const name = 'file-upgrade-gate';
+    installV1(name);
+    const tgz = buildTarball(name, '1.0.0', { aContent: 'should-not-land' });
+
+    const { status, body } = runFileUpgrade(name, tgz);
+
+    expect(status).toBe(1);
+    expect(body.success).toBe(false);
+    expect(body.error).toBe('version_not_higher');
+    expect(body.local).toBe('1.0.0');
+    expect(body.incoming).toBe('1.0.0');
+    // Installation untouched
+    expect(readFile(path.join(skillsDir, name), 'a.js')).toBe('v1');
+    const components = JSON.parse(readFile(path.join(baizeDir, '.baize'), 'components.json'));
+    expect(components[name].version).toBe('1.0.0');
+    fs.rmSync(tgz, { force: true });
+  });
+
+  test('rejects a downgrade the same way', () => {
+    const name = 'file-upgrade-downgrade';
+    installV1(name);
+    const tgz = buildTarball(name, '0.9.0', { aContent: 'old-code' });
+
+    const { status, body } = runFileUpgrade(name, tgz);
+
+    expect(status).toBe(1);
+    expect(body.error).toBe('version_not_higher');
+    expect(body.incoming).toBe('0.9.0');
+    expect(readFile(path.join(skillsDir, name), 'a.js')).toBe('v1');
+    fs.rmSync(tgz, { force: true });
+  });
+
+  test('rejects a tarball whose package name mismatches the installed component', () => {
+    const name = 'file-upgrade-mismatch';
+    installV1(name);
+    const tgz = buildTarball(name, '2.0.0', { pkgName: 'some-other-package' });
+
+    const { status, body } = runFileUpgrade(name, tgz);
+
+    expect(status).toBe(1);
+    expect(body.success).toBe(false);
+    expect(body.error).toMatch(/manifest name mismatch/);
+    expect(readFile(path.join(skillsDir, name), 'a.js')).toBe('v1');
+    fs.rmSync(tgz, { force: true });
+  });
+
+  test('rolls back the installation when npm install fails mid-pipeline', () => {
+    const name = 'file-upgrade-rollback';
+    const skillDir = installV1(name);
+    const tgz = buildTarball(name, '2.0.0', { aContent: 'v2' });
+
+    fs.writeFileSync(failFlag, '');
+    try {
+      const { status, body } = runFileUpgrade(name, tgz);
+      expect(status).toBe(1);
+      expect(body.success).toBe(false);
+      expect(body.failedStep).toBe(4);
+      expect(body.rollback?.performed).toBe(true);
+      // Original code restored from .backup
+      expect(readFile(skillDir, 'a.js')).toBe('v1');
+      expect(JSON.parse(readFile(skillDir, 'package.json')).version).toBe('1.0.0');
+    } finally {
+      fs.rmSync(failFlag, { force: true });
+    }
+    fs.rmSync(tgz, { force: true });
+  });
+
+  test('--check compares versions without touching the installation', () => {
+    const name = 'file-upgrade-check';
+    installV1(name);
+    const tgz = buildTarball(name, '2.0.0');
+
+    const { status, body } = runFileUpgrade(name, tgz, { check: true });
+
+    expect(status).toBe(0);
+    expect(body).toMatchObject({ action: 'check', success: true, hasUpdate: true, current: '1.0.0', latest: '2.0.0' });
+    expect(readFile(path.join(skillsDir, name), 'a.js')).toBe('v1');
+    fs.rmSync(tgz, { force: true });
+  });
+});

package/test/upgrade-local-version.test.js

@@ -0,0 +1,70 @@
+/**
+ * K6: getLocalVersion must read skillDir/package.json version first (SKILL.md
+ * frontmatter is stale by design — it historically stayed at 0.1.0 while
+ * package.json advanced, breaking upgrade version gating). SKILL.md remains
+ * the fallback for components that never shipped a package.json.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, expect, test } from '@jest/globals';
+import { getLocalVersion } from '../cli/lib/upgrade.js';
+
+let tmp;
+
+beforeEach(() => {
+  tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'local-version-'));
+});
+
+afterEach(() => {
+  fs.rmSync(tmp, { recursive: true, force: true });
+});
+
+function write(rel, content) {
+  const full = path.join(tmp, rel);
+  fs.mkdirSync(path.dirname(full), { recursive: true });
+  fs.writeFileSync(full, content);
+}
+
+describe('getLocalVersion reads package.json first (K6)', () => {
+  test('package.json version wins over SKILL.md frontmatter', () => {
+    write('SKILL.md', '---\nname: a2a\nversion: 0.1.0\n---\n# A2A\n');
+    write('package.json', JSON.stringify({ name: 'x', version: '0.2.0' }));
+    expect(getLocalVersion(tmp)).toEqual({ success: true, version: '0.2.0' });
+  });
+
+  test('falls back to SKILL.md frontmatter when package.json is absent', () => {
+    write('SKILL.md', '---\nname: a2a\nversion: 1.2.3\n---\n# A2A\n');
+    expect(getLocalVersion(tmp)).toEqual({ success: true, version: '1.2.3' });
+  });
+
+  test('falls back to SKILL.md when package.json version is invalid semver', () => {
+    write('SKILL.md', '---\nname: a2a\nversion: 3.4.5\n---\n# A2A\n');
+    write('package.json', JSON.stringify({ name: 'x', version: 'not-a-version' }));
+    expect(getLocalVersion(tmp)).toEqual({ success: true, version: '3.4.5' });
+  });
+
+  test('falls back to SKILL.md when package.json is unparseable', () => {
+    write('SKILL.md', '---\nname: a2a\nversion: 3.4.5\n---\n# A2A\n');
+    write('package.json', '{broken');
+    expect(getLocalVersion(tmp)).toEqual({ success: true, version: '3.4.5' });
+  });
+
+  test('prerelease versions in package.json are accepted', () => {
+    write('package.json', JSON.stringify({ name: 'x', version: '0.2.0-beta.1' }));
+    expect(getLocalVersion(tmp)).toEqual({ success: true, version: '0.2.0-beta.1' });
+  });
+
+  test('fails when neither source has a version', () => {
+    write('SKILL.md', '---\nname: a2a\n---\n# A2A\n');
+    const result = getLocalVersion(tmp);
+    expect(result.success).toBe(false);
+    expect(result.error).toMatch(/Version not found/);
+  });
+
+  test('fails for a missing skill dir', () => {
+    const missing = path.join(tmp, 'nope');
+    const result = getLocalVersion(missing);
+    expect(result.success).toBe(false);
+  });
+});