fix(cli): use public npm registry for curl fallback, fix tests and changeset

.changeset/fix-upgrade-curl-version.md

@@ -1,5 +1,5 @@
 ---
-" @kilocode/cli": patch
+"@kilocode/cli": patch
 ---
 
 Fix `kilo upgrade` for curl installs resolving the wrong latest version

packages/opencode/src/installation/index.ts

@@ -308,13 +308,15 @@ export const layer: Layer.Layer<Service, never, HttpClient.HttpClient | AppProce
           return data.version
         }
 
-        // kilocode_change start - curl/unknown fallback: resolve from the npm dist-tag
-        // instead of GitHub /releases/latest, which is polluted by non-CLI (e.g. JetBrains)
-        // releases and returns a tag like "jetbrains/v7.0.4" that breaks version resolution.
+        // kilocode_change start - curl/unknown fallback: resolve from the public npm
+        // dist-tag instead of GitHub /releases/latest, which is polluted by non-CLI
+        // (e.g. JetBrains) releases and returns a tag like "jetbrains/v7.0.4" that
+        // breaks version resolution. Use the public registry directly: a curl-
+        // installed binary is not tied to any project's npm config.
         const response = yield* httpOk.execute(
-          HttpClientRequest.get(
-            `${yield* NpmConfig.registry(process.cwd())}/${KiloNpm.path}/${InstallationChannel}`,
-          ).pipe(HttpClientRequest.acceptJson),
+          HttpClientRequest.get(`https://registry.npmjs.org/${KiloNpm.path}/${InstallationChannel}`).pipe(
+            HttpClientRequest.acceptJson,
+          ),
         )
         const data = yield* HttpClientResponse.schemaBodyJson(NpmPackage)(response)
         return data.version

packages/opencode/test/installation/installation.test.ts

@@ -58,16 +58,23 @@ function testLayer(
 
 describe("installation", () => {
   describe("latest", () => {
-    testEffect(testLayer(() => jsonResponse({ tag_name: "v1.2.3" }))).effect(
-      "reads release version from GitHub releases",
-      () =>
-        Effect.gen(function* () {
-          const result = yield* Installation.use.latest("unknown")
-          expect(result).toBe("1.2.3")
-        }),
+    // kilocode_change start - curl/unknown fallback now resolves from the public npm
+    // registry instead of GitHub /releases/latest (which is polluted by JetBrains releases)
+    const curlCalls: string[] = []
+    testEffect(
+      testLayer((request) => {
+        curlCalls.push(request.url)
+        return jsonResponse({ version: "1.2.3" })
+      }),
+    ).effect("reads release version from GitHub releases", () =>
+      Effect.gen(function* () {
+        const result = yield* Installation.use.latest("unknown")
+        expect(result).toBe("1.2.3")
+        expect(curlCalls).toContain("https://registry.npmjs.org/@kilocode%2fcli/local")
+      }),
     )
 
-    testEffect(testLayer(() => jsonResponse({ tag_name: "v4.0.0-beta.1" }))).effect(
+    testEffect(testLayer(() => jsonResponse({ version: "4.0.0-beta.1" }))).effect(
       "strips v prefix from GitHub release tag",
       () =>
         Effect.gen(function* () {
@@ -75,6 +82,7 @@ describe("installation", () => {
           expect(result).toBe("4.0.0-beta.1")
         }),
     )
+    // kilocode_change end
 
     const npmCalls: string[] = []
     testEffect(