amorphous-cli 0.1.6 → 0.1.8

package/lib/serve.mjs

@@ -0,0 +1,360 @@
+import { createServer } from 'node:http'
+import { existsSync, readFileSync, watch } from 'node:fs'
+import { join } from 'node:path'
+import { apiFetch } from './api.mjs'
+import { cliAbstractsFetchOrigin, cliAbstractsHostHeader } from './config.mjs'
+import { insertLocalRecord, readProjectFiles, recordsFromLocal, replaceLocalRecord } from './files.mjs'
+
+const BAR_CSS = `#amorphous-serve{position:fixed;z-index:2147483646;left:12px;bottom:12px;display:flex;gap:6px;align-items:center;padding:4px 6px 4px 10px;border-radius:999px;background:#18181b;color:#fff;font:500 12px/1 system-ui,-apple-system,sans-serif}
+#amorphous-serve button{border:0;border-radius:999px;padding:4px 8px;font:inherit;color:#a1a1aa;background:transparent;cursor:pointer}
+#amorphous-serve button[aria-pressed="true"]{background:#fff;color:#18181b}`
+
+function stripScriptTags(html) {
+  return String(html || '').replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
+}
+
+function readCookie(req, name) {
+  const raw = req.headers.cookie || ''
+  const match = new RegExp(`(?:^|;\\s*)${name}=([^;]+)`).exec(raw)
+  return match ? decodeURIComponent(match[1]) : ''
+}
+
+function recordsMode(req, url) {
+  const query = url.searchParams.get('records')
+  if (query === 'prod' || query === 'local') return query
+  const cookie = readCookie(req, 'amorphous_records')
+  return cookie === 'prod' ? 'prod' : 'local'
+}
+
+async function readJson(req) {
+  const chunks = []
+  for await (const chunk of req) chunks.push(chunk)
+  const text = Buffer.concat(chunks).toString('utf8')
+  if (!text) return {}
+  return JSON.parse(text)
+}
+
+function send(res, status, body, headers = {}) {
+  const payload = body == null ? '' : typeof body === 'string' ? body : JSON.stringify(body)
+  res.writeHead(status, {
+    'Cache-Control': 'no-store',
+    ...headers,
+    ...(payload && typeof body !== 'string' ? { 'Content-Type': 'application/json; charset=utf-8' } : {}),
+  })
+  res.end(payload)
+}
+
+function pageHtml(html, mode) {
+  const pressed = (value) => (mode === value ? ' aria-pressed="true"' : '')
+  return `<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<link rel="stylesheet" href="/styles.css">
+<style>${BAR_CSS}</style>
+</head>
+<body>
+<div id="amorphous-root">${stripScriptTags(html)}</div>
+<div id="amorphous-serve" data-mode="${mode}">
+  <span>Records</span>
+  <button type="button" data-set="local"${pressed('local')}>Local</button>
+  <button type="button" data-set="prod"${pressed('prod')}>Prod</button>
+</div>
+<script>
+window.amorphous = {
+  login() {},
+  async me() {
+    const res = await fetch('/__amorphous/me')
+    if (!res.ok || res.status === 204) return null
+    const text = await res.text()
+    if (!text) return null
+    return JSON.parse(text)
+  },
+  async names(ids) {
+    const res = await fetch('/__amorphous/names', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ ids })
+    })
+    if (!res.ok) return { names: {} }
+    return res.json()
+  },
+  data: {
+    async find() {
+      const res = await fetch('/__amorphous/data')
+      if (!res.ok) return []
+      const payload = await res.json()
+      return payload.records || []
+    },
+    async insert(row) {
+      const body = { ...row }
+      if (!body.id && crypto.randomUUID) body.id = crypto.randomUUID()
+      const res = await fetch('/__amorphous/data', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body)
+      })
+      if (!res.ok) throw new Error('insert failed: ' + res.status)
+      return body
+    },
+    async replace(id, row) {
+      const res = await fetch('/__amorphous/data/' + encodeURIComponent(id), {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(row)
+      })
+      if (!res.ok) throw new Error('replace failed: ' + res.status)
+      return row
+    }
+  }
+}
+document.getElementById('amorphous-serve').addEventListener('click', function (event) {
+  var mode = event.target && event.target.getAttribute('data-set')
+  if (!mode) return
+  fetch('/__amorphous/mode', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ mode: mode })
+  }).then(function () { location.reload() })
+})
+new EventSource('/__amorphous/events').addEventListener('reload', function () {
+  location.reload()
+})
+</script>
+<script src="/app.js"></script>
+</body>
+</html>`
+}
+
+function passFromResponse(res) {
+  const list = typeof res.headers.getSetCookie === 'function' ? res.headers.getSetCookie() : []
+  const lines = list.length ? list : [res.headers.get('set-cookie') || '']
+  for (const line of lines) {
+    const match = /(?:^|,\s*)am_pass=([^;]+)/.exec(line)
+    if (match) return `am_pass=${match[1]}`
+  }
+  return null
+}
+
+export async function mintAbstractPass(abstractId) {
+  const data = await apiFetch(`/api/abstracts/${abstractId}/code`, { method: 'POST', body: '{}' })
+  const code = data?.code
+  if (!code) throw new Error('Could not open the abstract records.')
+  const res = await fetch(`${cliAbstractsFetchOrigin()}/${abstractId}?code=${encodeURIComponent(code)}`, {
+    redirect: 'manual',
+    headers: { ...cliAbstractsHostHeader() },
+  })
+  const cookie = passFromResponse(res)
+  if (!cookie) throw new Error('Could not open the abstract records.')
+  return cookie
+}
+
+async function proxyAbstract(abstractId, path, init, session) {
+  const headers = {
+    ...cliAbstractsHostHeader(),
+    ...(init.headers || {}),
+  }
+  if (session.cookie) headers.Cookie = session.cookie
+  let res
+  try {
+    res = await fetch(`${cliAbstractsFetchOrigin()}/${abstractId}${path}`, {
+      method: init.method || 'GET',
+      headers,
+      body: init.body,
+      redirect: 'manual',
+    })
+  } catch {
+    return new Response(JSON.stringify({ message: 'Could not reach the abstract.' }), {
+      status: 502,
+      headers: { 'Content-Type': 'application/json' },
+    })
+  }
+  if (res.status === 401 && session.cookie && !init.retried) {
+    session.cookie = null
+    session.cookie = await session.mint()
+    return proxyAbstract(abstractId, path, { ...init, retried: true }, session)
+  }
+  return res
+}
+
+export function startServe(options) {
+  const cwd = options.cwd
+  const abstractId = options.abstractId
+  const host = options.host || '127.0.0.1'
+  const session = {
+    cookie: null,
+    failed: false,
+    mint: options.mintPass || (() => mintAbstractPass(abstractId)),
+  }
+  const clients = new Set()
+  let reloadTimer = null
+
+  function notifyReload() {
+    clearTimeout(reloadTimer)
+    reloadTimer = setTimeout(() => {
+      for (const client of clients) client.write('event: reload\ndata: 1\n\n')
+    }, 60)
+  }
+
+  const watchers = []
+  for (const name of ['index.html', 'styles.css', 'app.js']) {
+    const path = join(cwd, name)
+    if (!existsSync(path)) continue
+    watchers.push(watch(path, notifyReload))
+  }
+
+  async function ensurePass() {
+    if (session.cookie) return session.cookie
+    if (session.failed) return null
+    try {
+      session.cookie = await session.mint()
+      return session.cookie
+    } catch {
+      session.failed = true
+      return null
+    }
+  }
+
+  async function prod(path, init) {
+    if (options.prodFetch) return options.prodFetch(abstractId, path, init, session)
+    const cookie = await ensurePass()
+    if (!cookie && init.auth !== false) {
+      return new Response(JSON.stringify({ message: 'Not signed in. Run: npx amorphous-cli@latest login' }), {
+        status: 401,
+        headers: { 'Content-Type': 'application/json' },
+      })
+    }
+    const res = await proxyAbstract(abstractId, path, { ...init, headers: { ...(init.headers || {}), Cookie: cookie || '' } }, session)
+    const text = await res.text()
+    return new Response(text, { status: res.status, headers: { 'Content-Type': res.headers.get('content-type') || 'application/json' } })
+  }
+
+  const server = createServer(async (req, res) => {
+    try {
+      const url = new URL(req.url || '/', 'http://127.0.0.1')
+      if (req.method === 'GET' && url.pathname === '/') {
+        const mode = recordsMode(req, url)
+        const headers = { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' }
+        if (url.searchParams.get('records') === 'local' || url.searchParams.get('records') === 'prod') {
+          headers['Set-Cookie'] = `amorphous_records=${mode}; Path=/; SameSite=Lax`
+        }
+        send(res, 200, pageHtml(readProjectFiles(cwd).html, mode), headers)
+        return
+      }
+      if (req.method === 'GET' && url.pathname === '/styles.css') {
+        send(res, 200, readProjectFiles(cwd).css, { 'Content-Type': 'text/css; charset=utf-8' })
+        return
+      }
+      if (req.method === 'GET' && url.pathname === '/app.js') {
+        send(res, 200, readProjectFiles(cwd).js, { 'Content-Type': 'text/javascript; charset=utf-8' })
+        return
+      }
+      if (req.method === 'GET' && url.pathname === '/__amorphous/events') {
+        res.writeHead(200, {
+          'Content-Type': 'text/event-stream',
+          'Cache-Control': 'no-cache',
+          Connection: 'keep-alive',
+        })
+        res.write(':\n\n')
+        clients.add(res)
+        req.on('close', () => clients.delete(res))
+        return
+      }
+      if (req.method === 'POST' && url.pathname === '/__amorphous/mode') {
+        const body = await readJson(req)
+        const mode = body.mode === 'prod' ? 'prod' : 'local'
+        send(res, 204, null, { 'Set-Cookie': `amorphous_records=${mode}; Path=/; SameSite=Lax` })
+        return
+      }
+      const mode = recordsMode(req, url)
+      if (req.method === 'GET' && url.pathname === '/__amorphous/me') {
+        const upstream = await prod('/api/me', { method: 'GET', auth: false })
+        const text = await upstream.text()
+        send(res, upstream.ok ? 200 : upstream.status, text, {
+          'Content-Type': 'application/json; charset=utf-8',
+        })
+        return
+      }
+      if (req.method === 'POST' && url.pathname === '/__amorphous/names') {
+        const body = await readJson(req)
+        const upstream = await prod('/api/names', {
+          method: 'POST',
+          auth: false,
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ ids: Array.isArray(body.ids) ? body.ids : [] }),
+        })
+        const text = await upstream.text()
+        send(res, upstream.ok ? 200 : upstream.status, text, {
+          'Content-Type': 'application/json; charset=utf-8',
+        })
+        return
+      }
+      if (url.pathname === '/__amorphous/data' || url.pathname.startsWith('/__amorphous/data/')) {
+        if (mode === 'prod') {
+          const recordId = decodeURIComponent(url.pathname.slice('/__amorphous/data/'.length))
+          const path = req.method === 'PUT' ? `/api/data/${encodeURIComponent(recordId)}` : '/api/data'
+          const init = { method: req.method, auth: true }
+          if (req.method === 'POST' || req.method === 'PUT') {
+            init.headers = { 'Content-Type': 'application/json' }
+            init.body = JSON.stringify(await readJson(req))
+          }
+          const upstream = await prod(path, init)
+          const text = await upstream.text()
+          send(res, upstream.status, text, { 'Content-Type': 'application/json; charset=utf-8' })
+          return
+        }
+        if (req.method === 'GET') {
+          send(res, 200, { records: recordsFromLocal(cwd) })
+          return
+        }
+        if (req.method === 'POST') {
+          const result = insertLocalRecord(cwd, await readJson(req))
+          send(res, result.status, result.row || { message: result.message })
+          return
+        }
+        if (req.method === 'PUT') {
+          const recordId = decodeURIComponent(url.pathname.slice('/__amorphous/data/'.length))
+          const result = replaceLocalRecord(cwd, recordId, await readJson(req))
+          send(res, result.status, result.row || { message: result.message })
+          return
+        }
+      }
+      send(res, 404, { message: 'Not found' })
+    } catch (error) {
+      if (error instanceof SyntaxError) {
+        send(res, 400, { message: 'Invalid request' })
+        return
+      }
+      send(res, 500, { message: error instanceof Error ? error.message : 'Request failed' })
+    }
+  })
+
+  const ready = new Promise((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(options.port || 0, host, () => {
+      server.removeListener('error', reject)
+      const address = server.address()
+      const port = typeof address === 'object' && address ? address.port : options.port
+      const url = `http://${host}:${port}/`
+      resolve({ url, port })
+    })
+  })
+
+  return ready.then((info) => {
+    if (!options.silent) {
+      if (options.json) console.log(JSON.stringify({ url: info.url }))
+      else console.log(info.url)
+    }
+    return {
+      ...info,
+      close() {
+        clearTimeout(reloadTimer)
+        for (const watcher of watchers) watcher.close()
+        for (const client of clients) client.end()
+        return new Promise((resolve, reject) => {
+          server.close((error) => (error ? reject(error) : resolve()))
+        })
+      },
+    }
+  })
+}

package/lib/serve.test.mjs

@@ -0,0 +1,123 @@
+import assert from 'node:assert/strict'
+import { mkdtempSync, readFileSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import test from 'node:test'
+import { startServe } from './serve.mjs'
+
+function project() {
+  const cwd = mkdtempSync(join(tmpdir(), 'amorphous-serve-'))
+  writeFileSync(join(cwd, 'index.html'), '<main><script>alert(1)</script><p id="who">Hi</p></main>')
+  writeFileSync(join(cwd, 'styles.css'), 'main{color:black}')
+  writeFileSync(join(cwd, 'app.js'), 'document.title = "served"')
+  writeFileSync(join(cwd, 'data.ndjson'), '')
+  writeFileSync(join(cwd, 'private.ndjson'), '')
+  return cwd
+}
+
+function cookieFrom(res) {
+  const line = res.headers.get('set-cookie') || ''
+  const match = /amorphous_records=(local|prod)/.exec(line)
+  return match ? `amorphous_records=${match[1]}` : ''
+}
+
+test('serve reloads local source and keeps prod records off disk', async () => {
+  const cwd = project()
+  const calls = []
+  const running = await startServe({
+    cwd,
+    abstractId: '00000000-0000-4000-8000-000000000001',
+    silent: true,
+    prodFetch: async (_id, path, init) => {
+      calls.push({ path, method: init.method, body: init.body })
+      if (path === '/api/data' && init.method === 'GET') {
+        return new Response(JSON.stringify({ records: [{ id: 'live', visibility: 'shared', text: 'remote' }] }), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      }
+      if (path === '/api/data' && init.method === 'POST') {
+        return new Response(JSON.stringify({ ok: true }), { status: 200 })
+      }
+      if (path === '/api/me') {
+        return new Response(JSON.stringify({ id: 'user-1', name: 'Ada' }), { status: 200 })
+      }
+      return new Response(JSON.stringify({ names: { 'user-1': 'Ada' } }), { status: 200 })
+    },
+  })
+
+  try {
+    const page = await fetch(running.url)
+    const html = await page.text()
+    assert.match(html, /id="who"/)
+    assert.doesNotMatch(html, /alert\(1\)/)
+    assert.match(html, /data-set="local" aria-pressed="true"/)
+    assert.match(html, /data-set="prod"/)
+    assert.equal(await (await fetch(`${running.url}styles.css`)).text(), 'main{color:black}')
+    assert.equal(await (await fetch(`${running.url}app.js`)).text(), 'document.title = "served"')
+
+    const inserted = await fetch(`${running.url}__amorphous/data`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ id: 'local-1', text: 'note' }),
+    })
+    assert.equal(inserted.status, 200)
+    const found = await (await fetch(`${running.url}__amorphous/data`)).json()
+    assert.deepEqual(found.records, [{ id: 'local-1', text: 'note', visibility: 'shared' }])
+
+    const replaced = await fetch(`${running.url}__amorphous/data/local-1`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ text: 'edited' }),
+    })
+    assert.equal(replaced.status, 200)
+    assert.match(readFileSync(join(cwd, 'data.ndjson'), 'utf8'), /"text":"edited"/)
+    assert.equal(calls.filter((call) => call.path === '/api/data').length, 0)
+
+    const again = await fetch(`${running.url}__amorphous/data`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ id: 'local-1', text: 'nope' }),
+    })
+    assert.equal(again.status, 409)
+
+    const switched = await fetch(`${running.url}__amorphous/mode`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ mode: 'prod' }),
+    })
+    const jar = cookieFrom(switched)
+    assert.equal(jar, 'amorphous_records=prod')
+    const live = await (
+      await fetch(`${running.url}__amorphous/data`, { headers: { Cookie: jar } })
+    ).json()
+    assert.equal(live.records[0].text, 'remote')
+    const pushed = await fetch(`${running.url}__amorphous/data`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Cookie: jar },
+      body: JSON.stringify({ id: 'from-prod', text: 'up' }),
+    })
+    assert.equal(pushed.status, 200)
+    assert.doesNotMatch(readFileSync(join(cwd, 'data.ndjson'), 'utf8'), /from-prod/)
+    assert.equal(calls.filter((call) => call.method === 'POST' && call.path === '/api/data').length, 1)
+
+    const me = await (await fetch(`${running.url}__amorphous/me`)).json()
+    assert.equal(me.name, 'Ada')
+
+    const events = await fetch(`${running.url}__amorphous/events`)
+    const reader = events.body.getReader()
+    const first = await reader.read()
+    assert.match(Buffer.from(first.value).toString(), /:/)
+    writeFileSync(join(cwd, 'styles.css'), 'main{color:white}')
+    let chunk = ''
+    const deadline = Date.now() + 2000
+    while (!chunk.includes('reload') && Date.now() < deadline) {
+      const next = await reader.read()
+      chunk += Buffer.from(next.value).toString()
+    }
+    assert.match(chunk, /reload/)
+    reader.cancel()
+  } finally {
+    await running.close()
+  }
+})

package/lib/session.mjs

@@ -58,7 +58,7 @@ async function withCredentialLock(dir, fn) {
         /* the other process released it */
       }
       if (Date.now() - started > LOCK_WAIT_MS) {
-        throw new Error('Not signed in. Run: amorphous login')
+        throw new Error('Not signed in. Run: npx amorphous-cli@latest login')
       }
       await sleep(25)
     }
@@ -115,11 +115,11 @@ export async function ensureFreshSession(options = {}) {
     const now = options.now ?? Date.now()
     const session = loadSession()
     if (!session?.access_token) {
-      throw new Error('Not signed in. Run: amorphous login')
+      throw new Error('Not signed in. Run: npx amorphous-cli@latest login')
     }
     if (!options.force && !sessionNeedsRefresh(session, now)) return session
     if (!session.refresh_token) {
-      throw new Error('Not signed in. Run: amorphous login')
+      throw new Error('Not signed in. Run: npx amorphous-cli@latest login')
     }
     const refresh = options.refresh ?? refreshWithSupabase
     try {
@@ -135,7 +135,7 @@ export async function ensureFreshSession(options = {}) {
       ) {
         return again
       }
-      throw new Error('Not signed in. Run: amorphous login')
+      throw new Error('Not signed in. Run: npx amorphous-cli@latest login')
     }
   })
 }
@@ -148,7 +148,7 @@ export function accessToken() {
 export function authHeaders(extra = {}) {
   const token = accessToken()
   if (!token) {
-    throw new Error('Not signed in. Run: amorphous login')
+    throw new Error('Not signed in. Run: npx amorphous-cli@latest login')
   }
   return {
     Authorization: `Bearer ${token}`,

package/lib/tool-result.mjs

@@ -0,0 +1,8 @@
+/** Tool text for an MCP result. The model sees `content`, not the child process stderr. */
+export function toolText(stdout, stderr, code) {
+  const out = String(stdout || '').trim()
+  const err = String(stderr || '').trim()
+  if (code !== 0) return err || out || `exit ${code}`
+  if (!err) return out || 'ok'
+  return out ? `${out}\n${err}` : err
+}

package/lib/tool-result.test.mjs

@@ -0,0 +1,17 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { toolText } from './tool-result.mjs'
+
+const NUDGE = 'Run: npx amorphous-cli@latest setup'
+
+test('a successful command keeps stderr the model must see', () => {
+  assert.equal(toolText('[{"id":"a"}]', `${NUDGE}\n`, 0), `[{"id":"a"}]\n${NUDGE}`)
+})
+
+test('a failed command returns the error text', () => {
+  assert.equal(toolText('', 'Not signed in. Run: npx amorphous-cli@latest login\n', 1), 'Not signed in. Run: npx amorphous-cli@latest login')
+})
+
+test('empty success is ok', () => {
+  assert.equal(toolText('', '', 0), 'ok')
+})

package/lib/update-check.mjs

@@ -2,6 +2,7 @@ import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { randomBytes } from 'node:crypto'
+import { installUserSkill } from './agent-contract.mjs'
 import { ALIASES } from './help.mjs'
 import { userSkillDirs } from './agent-contract.mjs'
 import { CLI_VERSION } from './version.mjs'
@@ -59,6 +60,29 @@ function existsSkill(path) {
   }
 }
 
+export function shouldRefreshSkill(home, version) {
+  let refresh = false
+  for (const dir of userSkillDirs(home)) {
+    const skillPath = join(dir, 'SKILL.md')
+    const stampPath = join(dir, '.amorphous-version')
+    if (!existsSkill(skillPath)) {
+      refresh = true
+      continue
+    }
+    let stamp
+    try {
+      stamp = readFileSync(stampPath, 'utf8').trim()
+    } catch {
+      refresh = true
+      continue
+    }
+    const cmp = compareVersions(stamp, version)
+    if (cmp != null && cmp > 0) return false
+    if (cmp == null || cmp < 0) refresh = true
+  }
+  return refresh
+}
+
 export function skillStale(home, version) {
   const dirs = userSkillDirs(home)
   for (const dir of dirs) {
@@ -125,10 +149,8 @@ export function defaultFetchLatest(env = process.env) {
   })
 }
 
-function needsNudge({ cmd, version, latest, home }) {
-  if (latest && compareVersions(version, latest) === -1) return true
-  if (cmd !== 'setup' && skillStale(home, version)) return true
-  return false
+function needsNudge({ version, latest }) {
+  return Boolean(latest && compareVersions(version, latest) === -1)
 }
 
 export function startUpdateCheck({
@@ -176,7 +198,16 @@ export function startUpdateCheck({
           }
         }
 
-        if (!printed && needsNudge({ cmd, version, latest, home })) {
+        const behind = needsNudge({ version, latest })
+        if (!behind && cmd !== 'setup' && shouldRefreshSkill(home, version)) {
+          try {
+            installUserSkill(home)
+          } catch {
+            /* a read-only home must not change the command's exit code */
+          }
+        }
+
+        if (!printed && behind) {
           printed = true
           stderr.write(NUDGE)
         }

package/lib/update-check.test.mjs

@@ -231,7 +231,7 @@ test('setup skips skill stamp nudge when registry matches', async () => {
   assert.equal(err, '')
 })
 
-test('non-setup nudges on stale skill when registry matches', async () => {
+test('non-setup refreshes a stale skill when registry matches', async () => {
   const home = mkdtempSync(join(tmpdir(), 'amorphous-uc-'))
   const [d0] = userSkillDirs(home)
   mkdirSync(d0, { recursive: true })
@@ -250,7 +250,33 @@ test('non-setup nudges on stale skill when registry matches', async () => {
     } },
   })
   await update.finish()
+  assert.equal(err, '')
+  assert.equal(readFileSync(join(d0, '.amorphous-version'), 'utf8').trim(), CLI_VERSION)
+  assert.match(readFileSync(join(d0, 'SKILL.md'), 'utf8'), /npx amorphous-cli@latest/)
+})
+
+test('a newer registry is not copied over the installed skill', async () => {
+  const home = mkdtempSync(join(tmpdir(), 'amorphous-uc-'))
+  const [d0] = userSkillDirs(home)
+  mkdirSync(d0, { recursive: true })
+  writeFileSync(join(d0, 'SKILL.md'), 'keep-this')
+  writeFileSync(join(d0, '.amorphous-version'), '0.0.1\n')
+  writeCache(home, { checkedAt: new Date().toISOString(), latest: '9.9.9' })
+  let err = ''
+  const update = startUpdateCheck({
+    argv: ['list'],
+    env: {},
+    home,
+    version: CLI_VERSION,
+    now: () => Date.now(),
+    fetchLatest: async () => '9.9.9',
+    stderr: { write: (s) => {
+      err += s
+    } },
+  })
+  await update.finish()
   assert.equal(err, NUDGE)
+  assert.equal(readFileSync(join(d0, 'SKILL.md'), 'utf8'), 'keep-this')
 })
 
 test('integration help skips update check file', () => {