@openchambery/web 2.0.0-beta.26 → 2.0.0-beta.29

package/server/lib/opencode/mcp.js

@@ -29,7 +29,7 @@ function validateMcpName(name) {
  */
 function resolveMcpScopeFromPath(layers, sourcePath) {
   if (!sourcePath) return null;
-  return sourcePath === layers.paths.projectPath ? AGENT_SCOPE.PROJECT : AGENT_SCOPE.USER;
+  return layers.projectLayers.some((layer) => layer.path === sourcePath) ? AGENT_SCOPE.PROJECT : AGENT_SCOPE.USER;
 }
 
 function ensureProjectMcpConfigPath(workingDirectory) {

package/server/lib/opencode/opencode2-pin.js

@@ -1,5 +1,6 @@
 // Pinned desktop/runtime opencode2. Upgrade and prepare must not fall back to 1.18.x.
-export const PINNED_OPENCODE2_VERSION = '2.0.12';
+export const PINNED_OPENCODE2_VERSION = '2.0.23';
+export const MINIMUM_OPENCODE2_VERSION = '2.0.20';
 
 // Global npm/bun package that installs the opencode v2 binary (not 1.x opencode-ai).
 export const OPENCODE2_NPM_PACKAGE = '@opencode/cli';

package/server/lib/opencode/owned-runtime-upgrade.test.js

@@ -86,15 +86,15 @@ describe('owned runtime upgrade (ticket 12)', () => {
 
   it('verifies running serve identity before upgrade success', () => {
     const contractOk = evaluateRuntimeContract({
-      serveVersion: '2.0.14',
+      serveVersion: '2.0.23',
       reachable: true,
       authenticated: true,
       healthOk: true,
       migrationAdmitTranscript: true,
     });
     expect(evaluateOwnedUpgradeResult({
-      targetVersion: '2.0.14',
-      serveVersion: '2.0.14',
+      targetVersion: '2.0.23',
+      serveVersion: '2.0.23',
       binaryPath: ownedBinary,
       expectedBinaryPath: ownedBinary,
       contract: contractOk,
@@ -116,8 +116,8 @@ describe('owned runtime upgrade (ticket 12)', () => {
     });
 
     expect(evaluateOwnedUpgradeResult({
-      targetVersion: '2.0.14',
-      serveVersion: '2.0.14',
+      targetVersion: '2.0.23',
+      serveVersion: '2.0.23',
       binaryPath: '/usr/bin/opencode',
       expectedBinaryPath: ownedBinary,
       contract: contractOk,

package/server/lib/opencode/plugin-routes.test.js

@@ -1,4 +1,5 @@
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, mock, test } from 'bun:test';
+import { vi } from 'vitest';
 import express from 'express';
 import fs from 'fs';
 import os from 'os';
@@ -67,7 +68,8 @@ describe('opencode plugin routes', () => {
   beforeAll(async () => {
     rootDir = fs.mkdtempSync(path.join(os.tmpdir(), 'openchamber-plugin-routes-'));
     userConfigPath = path.join(rootDir, 'user-opencode.json');
-    process.env.OPENCODE_CONFIG = userConfigPath;
+    vi.stubEnv('OPENCODE_CONFIG', userConfigPath);
+    vi.stubEnv('OPENCODE_CONFIG_DIR', path.join(rootDir, 'global-config'));
     plugins = await import('./plugins.js');
   });
 
@@ -91,7 +93,7 @@ describe('opencode plugin routes', () => {
 
   afterAll(() => {
     fs.rmSync(rootDir, { recursive: true, force: true });
-    delete process.env.OPENCODE_CONFIG;
+    vi.unstubAllEnvs();
   });
 
   test('GET /api/config/plugins empty returns entries and files arrays', async () => {

package/server/lib/opencode/plugins.js

@@ -4,6 +4,8 @@ import path from 'path';
 import {
   AGENT_SCOPE,
   readConfigFile,
+  readConfigLayers,
+  getConfigForPath,
   writeConfig,
 } from './shared.js';
 import { isPathSpec } from './plugin-spec.js';
@@ -74,54 +76,8 @@ function getActiveOpencodeConfigDir() {
   return path.join(os.homedir(), '.config', 'opencode');
 }
 
-function getActiveUserConfigPaths() {
-  const configDir = getActiveOpencodeConfigDir();
-  return [
-    path.join(configDir, 'config.json'),
-    path.join(configDir, 'opencode.json'),
-    path.join(configDir, 'opencode.jsonc'),
-  ];
-}
-
-function getActiveCustomConfigPath() {
-  return process.env.OPENCODE_CONFIG ? path.resolve(process.env.OPENCODE_CONFIG) : null;
-}
-
-function getPrimaryUserConfigPath() {
-  const [defaultPath, ...fallbackPaths] = getActiveUserConfigPaths();
-  for (const userPath of [defaultPath, ...fallbackPaths]) {
-    if (fs.existsSync(userPath)) {
-      return userPath;
-    }
-  }
-  return defaultPath;
-}
-
-function getProjectConfigPath(workingDirectory) {
-  if (!workingDirectory) return null;
-  const candidates = [
-    path.join(workingDirectory, 'opencode.json'),
-    path.join(workingDirectory, 'opencode.jsonc'),
-    path.join(workingDirectory, '.opencode', 'opencode.json'),
-    path.join(workingDirectory, '.opencode', 'opencode.jsonc'),
-  ];
-  return candidates.find((candidate) => fs.existsSync(candidate)) || candidates[0];
-}
-
 function readPluginConfigLayers(workingDirectory) {
-  const customPath = getActiveCustomConfigPath();
-  const userPath = getPrimaryUserConfigPath();
-  const projectPath = getProjectConfigPath(workingDirectory);
-  return {
-    userConfig: readConfigFile(userPath),
-    projectConfig: readConfigFile(projectPath),
-    customConfig: readConfigFile(customPath),
-    paths: {
-      userPath,
-      projectPath,
-      customPath,
-    },
-  };
+  return readConfigLayers(workingDirectory);
 }
 
 function validateFileName(fileName) {
@@ -144,16 +100,10 @@ function ensureProjectConfigPath(workingDirectory) {
 }
 
 function configSources(layers) {
-  const sources = [];
-  if (layers.paths.customPath) {
-    sources.push({ config: layers.customConfig, filePath: layers.paths.customPath, scope: AGENT_SCOPE.USER });
-  } else {
-    sources.push({ config: layers.userConfig, filePath: layers.paths.userPath, scope: AGENT_SCOPE.USER });
-  }
-  if (layers.paths.projectPath) {
-    sources.push({ config: layers.projectConfig, filePath: layers.paths.projectPath, scope: AGENT_SCOPE.PROJECT });
-  }
-  return sources;
+  return [...layers.documents.filter((layer) => layer.scope !== 'project').reverse(), ...layers.projectLayers.toReversed()].map((layer) => ({
+    config: layer.config, filePath: layer.path,
+    scope: layer.scope === 'project' ? AGENT_SCOPE.PROJECT : AGENT_SCOPE.USER,
+  }));
 }
 
 function splitScopedValue(value) {
@@ -175,7 +125,9 @@ function getPluginTarget(id, workingDirectory) {
   const { scope, value: spec } = splitScopedValue(decoded.value);
   validateScope(scope);
   const layers = readPluginConfigLayers(workingDirectory);
-  const source = configSources(layers).find((candidate) => candidate.scope === scope);
+  const source = configSources(layers).find((candidate) => candidate.scope === scope
+    && Array.isArray(candidate.config?.plugin)
+    && candidate.config.plugin.some((raw) => parsePluginRaw(raw).spec === spec));
   const plugin = Array.isArray(source?.config?.plugin) ? source.config.plugin : [];
   const index = plugin.findIndex((raw) => parsePluginRaw(raw).spec === spec);
   if (!source || index === -1) {
@@ -281,14 +233,14 @@ function createPluginEntry(entry, workingDirectory) {
     throw codedError(`Plugin "${spec}" already exists`, 'ENTRY_EXISTS');
   }
 
-  let targetPath = getPrimaryUserConfigPath();
+  let targetPath = layers.paths.userPath;
   let config = {};
   if (scope === AGENT_SCOPE.PROJECT) {
     targetPath = ensureProjectConfigPath(workingDirectory);
     config = fs.existsSync(targetPath) ? readConfigFile(targetPath) : {};
   } else {
     targetPath = layers.paths.customPath || layers.paths.userPath;
-    config = layers.paths.customPath ? layers.customConfig : layers.userConfig;
+    config = getConfigForPath(layers, targetPath);
   }
 
   if (!Array.isArray(config.plugin)) {

package/server/lib/opencode/plugins.test.js

@@ -1,4 +1,5 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from 'bun:test';
+import { vi } from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
@@ -30,19 +31,20 @@ describe('opencode plugins data layer', () => {
   beforeAll(async () => {
     rootDir = fs.mkdtempSync(path.join(os.tmpdir(), 'openchamber-plugins-'));
     userConfigPath = path.join(rootDir, 'user-opencode.json');
-    process.env.OPENCODE_CONFIG = userConfigPath;
+    vi.stubEnv('OPENCODE_CONFIG', userConfigPath);
+    vi.stubEnv('OPENCODE_CONFIG_DIR', path.join(rootDir, 'global-config'));
     plugins = await import('./plugins.js');
   });
 
   beforeEach(() => {
-    process.env.OPENCODE_CONFIG = userConfigPath;
+    vi.stubEnv('OPENCODE_CONFIG', userConfigPath);
     projectDir = fs.mkdtempSync(path.join(rootDir, 'project-'));
     fs.rmSync(userConfigPath, { force: true });
   });
 
   afterAll(() => {
     fs.rmSync(rootDir, { recursive: true, force: true });
-    delete process.env.OPENCODE_CONFIG;
+    vi.unstubAllEnvs();
   });
 
   test('parses raw plugin entries', () => {

package/server/lib/opencode/providers.js

@@ -30,8 +30,8 @@ function getProviderSources(providerId, workingDirectory) {
   return {
     sources: {
       auth: { exists: false },
-      user: { exists: userExists, path: paths.userPath },
-      project: { exists: projectExists, path: paths.projectPath || null },
+      user: { exists: userExists, path: layers.userLayers.findLast((layer) => layer.config?.provider?.[providerId] !== undefined || layer.config?.providers?.[providerId] !== undefined)?.path || paths.userPath },
+      project: { exists: projectExists, path: layers.projectLayers.findLast((layer) => layer.config?.provider?.[providerId] !== undefined || layer.config?.providers?.[providerId] !== undefined)?.path || paths.projectPath || null },
       custom: { exists: customExists, path: paths.customPath }
     }
   };
@@ -44,17 +44,20 @@ function removeProviderConfig(providerId, workingDirectory, scope = 'user') {
 
   const layers = readConfigLayers(workingDirectory);
   let targetPath = layers.paths.userPath;
+  const sources = getProviderSources(providerId, workingDirectory).sources;
 
   if (scope === 'project') {
     if (!workingDirectory) {
       throw new Error('Working directory is required for project scope');
     }
-    targetPath = layers.paths.projectPath || targetPath;
+    targetPath = sources.project.path || targetPath;
   } else if (scope === 'custom') {
     if (!layers.paths.customPath) {
       return false;
     }
     targetPath = layers.paths.customPath;
+  } else {
+    targetPath = sources.user.path;
   }
 
   const targetConfig = getConfigForPath(layers, targetPath);

package/server/lib/opencode/proxy.js

@@ -1,4 +1,5 @@
 import { createProxyMiddleware } from 'http-proxy-middleware';
+import { isSensitiveCredentialResponse } from './credential-boundary.js';
 
 import {
   applyForwardProxyResponseHeaders,
@@ -244,6 +245,12 @@ export const resolveSessionTurnAdmissionRequest = (req) => {
 };
 
 export const registerOpenCodeProxy = (app, deps) => {
+  app.use((req, res, next) => {
+    if (isSensitiveCredentialResponse(req.method, req.originalUrl || req.url)) {
+      return res.status(403).json({ code: 'credential_response_refused', error: 'Provider credential values are host-only.' });
+    }
+    return next();
+  });
   const {
     fs,
     os,

package/server/lib/opencode/proxy.test.js

@@ -57,6 +57,19 @@ const mountProxy = () => {
   return app;
 };
 
+describe('credential response boundary', () => {
+  it.each(['/api/credential', '/api/credential/', '/api/%63redential?directory=/repo'])('refuses raw credential list %s before upstream', async (path) => {
+    const fetchSpy = vi.fn();
+    globalThis.fetch = fetchSpy;
+    const response = await request(mountProxy()).get(path).expect(403);
+    expect(response.body.code).toBe('credential_response_refused');
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+  it('refuses credential create replies which echo values', async () => {
+    await request(mountProxy()).post('/api/credential').send({}).expect(403);
+  });
+});
+
 const sseBody = (blocks) => {
   const encoder = new TextEncoder();
   const text = blocks.join('');

package/server/lib/opencode/routes.js

@@ -709,7 +709,7 @@ export const registerOpenCodeRoutes = (app, dependencies) => {
 
       const sources = getProviderSources(providerId, directory);
       const { getProviderAuth } = await getAuthLibrary();
-      const auth = getProviderAuth(providerId);
+      const auth = await getProviderAuth(providerId);
       sources.sources.auth.exists = Boolean(auth);
 
       return res.json({
@@ -753,12 +753,12 @@ export const registerOpenCodeRoutes = (app, dependencies) => {
       let removed = false;
       if (scope === 'auth') {
         const { removeProviderAuth } = await getAuthLibrary();
-        removed = removeProviderAuth(providerId);
+        removed = await removeProviderAuth(providerId);
       } else if (scope === 'user' || scope === 'project' || scope === 'custom') {
         removed = removeProviderConfig(providerId, directory, scope);
       } else if (scope === 'all') {
         const { removeProviderAuth } = await getAuthLibrary();
-        const authRemoved = removeProviderAuth(providerId);
+        const authRemoved = await removeProviderAuth(providerId);
         const userRemoved = removeProviderConfig(providerId, directory, 'user');
         const projectRemoved = directory ? removeProviderConfig(providerId, directory, 'project') : false;
         const customRemoved = removeProviderConfig(providerId, directory, 'custom');
@@ -767,14 +767,14 @@ export const registerOpenCodeRoutes = (app, dependencies) => {
         return res.status(400).json({ error: 'Invalid scope' });
       }
 
-      if (removed) {
+      if (removed && scope !== 'auth') {
         await refreshOpenCodeAfterConfigChange(`provider ${providerId} disconnected (${scope})`);
       }
 
       return res.json({
         success: true,
         removed,
-        requiresReload: removed,
+        requiresReload: removed && scope !== 'auth',
         message: removed ? 'Provider disconnected successfully' : 'Provider was not connected',
         reloadDelayMs: removed ? clientReloadDelayMs : undefined,
       });

package/server/lib/opencode/routes.test.js

@@ -233,39 +233,39 @@ describe('opencode2 upgrade pin (ticket 12)', () => {
   });
 
   it('upgrades a shared service using the owned cache and verifies the running version', async () => {
-    const binary = '/cache/opencode-cli/2.0.14/opencode';
+    const binary = '/cache/opencode-cli/2.0.23/opencode';
     vi.mocked(installPinnedOpenCode2Cli).mockResolvedValueOnce(binary);
-    vi.mocked(readOpenCode2BinaryVersion).mockReturnValueOnce('2.0.14');
-    vi.stubGlobal('fetch', vi.fn(async () => new Response(JSON.stringify({ version: '2.0.14', pid: 42 }))));
+    vi.mocked(readOpenCode2BinaryVersion).mockReturnValueOnce('2.0.23');
+    vi.stubGlobal('fetch', vi.fn(async () => new Response(JSON.stringify({ version: '2.0.23', pid: 42 }))));
     let resolvedBinary = '/usr/local/bin/opencode';
     const restartOpenCode = vi.fn(async () => {});
     const { app } = createUpgradeApp({
       getIsExternalOpenCode: () => true,
       getIsSharedOpenCodeService: () => true,
       getResolvedOpenCodeBinary: () => resolvedBinary,
-      getOpenCodeCliVersion: () => '2.0.14',
+      getOpenCodeCliVersion: () => '2.0.23',
       forceResolvedOpenCodeBinary: (value) => { resolvedBinary = value; },
       restartOpenCode,
       waitForOpenCodeReady: vi.fn(),
       openchamberDataDir: '/cache',
     });
 
-    const response = await request(app).post('/api/opencode/upgrade').send({ target: '2.0.14' }).expect(200);
+    const response = await request(app).post('/api/opencode/upgrade').send({ target: '2.0.23' }).expect(200);
     expect(restartOpenCode).toHaveBeenCalledWith({ binaryPath: binary });
-    expect(response.body).toMatchObject({ success: true, version: '2.0.14', ownership: 'shared-service' });
+    expect(response.body).toMatchObject({ success: true, version: '2.0.23', ownership: 'shared-service' });
   });
 
-  it('discovers the remote release and updates a shared 2.0.16 service to 2.0.18', async () => {
+  it('discovers the remote release and updates a shared 2.0.16 service to 2.0.23', async () => {
     let serveVersion = '2.0.16';
     let binary = '/usr/local/bin/opencode';
-    const installed = '/cache/opencode-cli/2.0.18/opencode';
+    const installed = '/cache/opencode-cli/2.0.23/opencode';
     const fetchMock = vi.fn(async (url) => new Response(JSON.stringify({
-      version: String(url).includes('registry.npmjs.org') ? '2.0.18' : serveVersion,
+      version: String(url).includes('registry.npmjs.org') ? '2.0.23' : serveVersion,
     })));
     vi.stubGlobal('fetch', fetchMock);
-    vi.mocked(readOpenCode2BinaryVersion).mockReturnValue('2.0.18');
+    vi.mocked(readOpenCode2BinaryVersion).mockReturnValue('2.0.23');
     vi.mocked(installPinnedOpenCode2Cli).mockResolvedValueOnce(installed);
-    const restartOpenCode = vi.fn(async () => { serveVersion = '2.0.18'; });
+    const restartOpenCode = vi.fn(async () => { serveVersion = '2.0.23'; });
     const { app } = createUpgradeApp({
       discoverOpenCodeUpdate: createOpenCodeUpdateDiscovery(),
       getIsExternalOpenCode: () => true,
@@ -277,12 +277,12 @@ describe('opencode2 upgrade pin (ticket 12)', () => {
       openchamberDataDir: '/cache',
     });
     const before = await request(app).get('/api/opencode/upgrade-status').expect(200);
-    expect(before.body).toMatchObject({ available: true, serveVersion: '2.0.16', targetVersion: '2.0.18', canManage: true });
+    expect(before.body).toMatchObject({ available: true, serveVersion: '2.0.16', targetVersion: '2.0.23', canManage: true });
     const result = await request(app).post('/api/opencode/upgrade').send({}).expect(200);
-    expect(result.body).toMatchObject({ success: true, restarted: true, version: '2.0.18' });
+    expect(result.body).toMatchObject({ success: true, restarted: true, version: '2.0.23' });
     expect(restartOpenCode).toHaveBeenCalledWith({ binaryPath: installed });
     const after = await request(app).get('/api/opencode/upgrade-status').expect(200);
-    expect(after.body).toMatchObject({ available: false, serveVersion: '2.0.18' });
+    expect(after.body).toMatchObject({ available: false, serveVersion: '2.0.23' });
     expect(fetchMock.mock.calls.filter(([url]) => String(url).includes('registry.npmjs.org'))).toHaveLength(1);
     vi.mocked(readOpenCode2BinaryVersion).mockReset();
   });
@@ -385,7 +385,7 @@ describe('runtime contract routes (ticket 11)', () => {
       ok: true,
       status: 200,
       statusText: 'OK',
-      json: async () => ({ version: '2.0.12', pid: 1 }),
+      json: async () => ({ version: '2.0.20', pid: 1 }),
     })));
     const { app } = createContractApp();
 
@@ -395,7 +395,7 @@ describe('runtime contract routes (ticket 11)', () => {
     expect(health.body.executionAllowed).toBe(true);
 
     const contract = await request(app).get('/api/opencode/contract').expect(200);
-    expect(contract.body.serveVersion).toBe('2.0.12');
+    expect(contract.body.serveVersion).toBe('2.0.20');
     expect(contract.body.capabilities['core.protocol'].available).toBe(true);
   });
 
@@ -439,7 +439,7 @@ describe('GET /api/opencode/health', () => {
         status: 200,
         statusText: 'OK',
         json: async () => ({
-          version: '2.0.12',
+          version: '2.0.20',
           pid: 4242,
           urls: { api: 'http://127.0.0.1:4096' },
           paths: { config: '/tmp/config', data: '/tmp/data' },
@@ -453,7 +453,7 @@ describe('GET /api/opencode/health', () => {
 
     expect(response.body).toMatchObject({
       healthy: true,
-      version: '2.0.12',
+      version: '2.0.20',
       executionAllowed: true,
       protocolCompatible: true,
     });

package/server/lib/opencode/runtime-contract.js

@@ -7,20 +7,21 @@
  * execution semantics.
  *
  * Evidence bounds (ticket 11):
- * - MIN_VERIFIED: pin / installed verification (`2.0.12`)
+ * - MIN_VERIFIED: credential API availability (`2.0.20`)
  * Any acceptable OpenCode 2.x at or above MIN_VERIFIED may execute. Below-min
  * 2.x and 1.x are refused with upgrade guidance; there is no upper version cap.
  */
 
 import {
   PINNED_OPENCODE2_VERSION,
+  MINIMUM_OPENCODE2_VERSION,
   compareOpenCode2Versions,
   isAcceptableOpenCode2HealthVersion,
   isOpenCode1xVersion,
 } from './opencode2-pin.js';
 
 /** Lowest version with documented OpenChamber + OpenCode 2 contract tests. */
-export const RUNTIME_CONTRACT_MIN_VERIFIED = PINNED_OPENCODE2_VERSION;
+export const RUNTIME_CONTRACT_MIN_VERIFIED = MINIMUM_OPENCODE2_VERSION;
 
 /**
  * Optional / core capabilities and the minimum serve version that admits them.

package/server/lib/opencode/runtime-contract.test.js

@@ -13,14 +13,14 @@ import {
 } from './runtime-contract.js';
 
 describe('runtime contract admission (ticket 11)', () => {
-  it('records minimum verified bound from pin', () => {
-    expect(RUNTIME_CONTRACT_MIN_VERIFIED).toBe('2.0.12');
+  it('records the credential API floor independently of the install pin', () => {
+    expect(RUNTIME_CONTRACT_MIN_VERIFIED).toBe('2.0.20');
   });
 
   it('classifies version bands with a 2.x floor only', () => {
-    expect(classifyRuntimeVersionBand('2.0.12')).toBe('verified');
-    expect(classifyRuntimeVersionBand('2.0.14')).toBe('verified');
-    expect(classifyRuntimeVersionBand('2.0.15')).toBe('verified');
+    expect(classifyRuntimeVersionBand('2.0.19')).toBe('below-min');
+    expect(classifyRuntimeVersionBand('2.0.20')).toBe('verified');
+    expect(classifyRuntimeVersionBand('2.0.23')).toBe('verified');
     expect(classifyRuntimeVersionBand('2.1.0')).toBe('verified');
     expect(classifyRuntimeVersionBand('2.0.5')).toBe('below-min');
     expect(classifyRuntimeVersionBand('1.18.18')).toBe('1x');
@@ -30,8 +30,8 @@ describe('runtime contract admission (ticket 11)', () => {
 
   it('admits verified serve for core protocol and optional caps', () => {
     const result = evaluateRuntimeContract({
-      serveVersion: '2.0.12',
-      cliVersion: '2.0.12',
+      serveVersion: '2.0.20',
+      cliVersion: '2.0.20',
       reachable: true,
       authenticated: true,
       healthOk: true,
@@ -65,7 +65,7 @@ describe('runtime contract admission (ticket 11)', () => {
 
   it('admits newer 2.x above the documented floor for execution', () => {
     const result = evaluateRuntimeContract({
-      serveVersion: '2.0.15',
+      serveVersion: '2.0.23',
       reachable: true,
       authenticated: true,
       healthOk: true,
@@ -105,12 +105,12 @@ describe('runtime contract admission (ticket 11)', () => {
     expect(evaluateRuntimeContract({
       reachable: true,
       authenticated: false,
-      serveVersion: '2.0.12',
+      serveVersion: '2.0.20',
       healthOk: true,
     }).phase).toBe('unauthenticated');
 
     const migration = evaluateRuntimeContract({
-      serveVersion: '2.0.12',
+      serveVersion: '2.0.20',
       reachable: true,
       authenticated: true,
       healthOk: true,
@@ -122,7 +122,7 @@ describe('runtime contract admission (ticket 11)', () => {
     expect(migration.migrationExecutable).toBe(false);
 
     const mismatch = evaluateRuntimeContract({
-      serveVersion: '2.0.12',
+      serveVersion: '2.0.20',
       cliVersion: '2.0.14',
       reachable: true,
       authenticated: true,
@@ -179,7 +179,7 @@ describe('runtime contract admission (ticket 11)', () => {
       migrationAdmitTranscript: true,
     });
     const body = runtimeContractExecutionBlockedBody(contract);
-    expect(body.error).toContain('2.0.12');
+    expect(body.error).toContain('2.0.20');
     expect(body.error).toMatch(/Settings → About/i);
     expect(formatRuntimeContractBlockedError(contract)).toBe(body.error);
   });