fix: unify version comparison, refuse secret-leaking saves, reset skin strikes on card success

Fixes the three suspected bugs this PR's characterization tests pinned,
flipping those tests to assert the corrected behavior:

- plugins/store: ONE shared update comparator. New
  compatibility.is_update_available() (PEP 440 via packaging) is now used
  by both the web UI's update badge (api_v3._is_plugin_update_available
  is a thin alias) and store_manager.update_plugin's reinstall decision.
  Previously update_plugin used raw string equality: 'v1.2.0' vs '1.2.0'
  triggered a full reinstall the UI called unnecessary, and a locally-
  ahead plugin (2.0.0 installed, registry 1.9.0) was silently DOWNGRADED.
  Now equivalent spellings skip the reinstall and locally-ahead versions
  are never downgraded; unparseable versions still reconcile by
  reinstalling from the registry.

- config: save_config and save_config_atomic now refuse (ConfigError)
  when config_secrets.json exists but cannot be loaded. Both previously
  proceeded without stripping, writing the merged secrets into
  config.json in plaintext. The shared _load_secrets_for_save() helper
  raises with an actionable message instead; a missing secrets file is
  still fine (nothing to strip), and _migrate_config's catch-all keeps
  boot resilient.

- skins: render_skin_card resets _skin_failures on both success paths
  (vegas card returned, or mode renderer handled), mirroring
  _render_game. Transient card failures no longer accumulate across a
  session until they permanently disable a working skin.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NohXi78cwsAKtN1sCfxjUh

test/test_config_manager_secrets.py

@@ -4,8 +4,9 @@ Tests for the ConfigManager secrets round-trip and the load_config fast path.
 The contract under test: config_secrets.json values are deep-merged INTO the
 in-memory config at load time, and stripped back OUT before anything is
 written to config.json — so secrets live in exactly one file on disk. This
-suite pins that round-trip plus its known sharp edges (some marked as
-SUSPECTED BUG and characterized rather than fixed).
+suite pins that round-trip plus its sharp edges, including the guard that a
+save REFUSES (ConfigError) when the secrets file exists but can't be loaded,
+rather than leaking merged secrets into config.json in plaintext.
 
 Complements test_config_manager.py, which covers loading/migration/validation.
 """
@@ -16,6 +17,7 @@ import os
 import pytest
 
 from src.config_manager import ConfigManager
+from src.exceptions import ConfigError
 
 
 def make_manager(tmp_path, config=None, secrets=None):
@@ -99,13 +101,11 @@ class TestSaveStripsSecrets:
         on_disk = json.loads((tmp_path / "config.json").read_text())
         assert on_disk == {"timezone": "UTC"}
 
-    def test_corrupt_secrets_file_writes_secrets_to_config_json(self, tmp_path):
-        # SUSPECTED BUG (characterized, not fixed): when the secrets file is
-        # corrupt (or otherwise unloadable) at save time, save_config proceeds without
-        # stripping — writing the merged secrets into config.json in
-        # plaintext. The code comments acknowledge the tradeoff (it prevents
-        # data loss); this test pins the behavior so any future change to it
-        # is deliberate.
+    def test_corrupt_secrets_file_refuses_save_no_plaintext_leak(self, tmp_path):
+        # Regression guard: when the secrets file exists but is corrupt at
+        # save time, stripping is impossible — the save must raise instead of
+        # writing the merged secrets into config.json in plaintext (the
+        # historical behavior).
         manager = make_manager(
             tmp_path,
             config={"weather": {"city": "Austin"}},
@@ -114,10 +114,28 @@ class TestSaveStripsSecrets:
         loaded = manager.load_config()
         (tmp_path / "config_secrets.json").write_text("{corrupt")
 
-        manager.save_config(loaded)
+        with pytest.raises(ConfigError):
+            manager.save_config(loaded)
+
+        # On-disk config untouched: no secret leaked.
+        on_disk = json.loads((tmp_path / "config.json").read_text())
+        assert "api_key" not in on_disk.get("weather", {})
+
+    def test_corrupt_secrets_file_refuses_atomic_save_too(self, tmp_path):
+        # Same refusal on the atomic save path, which shared the leak.
+        manager = make_manager(
+            tmp_path,
+            config={"weather": {"city": "Austin"}},
+            secrets={"weather": {"api_key": "s3cret"}},
+        )
+        loaded = manager.load_config()
+        (tmp_path / "config_secrets.json").write_text("{corrupt")
+
+        with pytest.raises(ConfigError):
+            manager.save_config_atomic(loaded)
 
         on_disk = json.loads((tmp_path / "config.json").read_text())
-        assert on_disk["weather"].get("api_key") == "s3cret"  # leaked
+        assert "api_key" not in on_disk.get("weather", {})
 
 
 class TestLoadFastPath:

test/test_skin_system.py

@@ -455,10 +455,8 @@ class TestExampleSkin:
 class TestRenderSkinCard:
     """render_skin_card (vegas cards) shares _render_game's 3-strike counter.
 
-    The asymmetry pinned here: _render_game resets the counter on success,
-    render_skin_card does NOT — card successes never clear strikes, so
-    failures accumulated across card renders (however far apart) still
-    disable the skin for the session.
+    Both paths reset the counter on success — transient failures must not
+    accumulate across a session and disable a working skin.
     """
 
     def _probe(self, skin):
@@ -518,11 +516,10 @@ class TestRenderSkinCard:
         assert probe.builtin_calls == 1
         assert BrokenCardSkin.calls == 3  # not consulted again
 
-    def test_card_success_does_not_reset_strikes(self):
-        """Characterized asymmetry: unlike _render_game (which resets the
-        counter on success, core.py _render_game), a successful card render
-        leaves accumulated strikes in place — 2 failures + N successes + 1
-        failure still disables the skin."""
+    def test_card_success_resets_strikes(self):
+        """A successful card render clears accumulated strikes (mirroring
+        _render_game) — 2 failures + a success + 1 failure leaves the skin
+        enabled with a single strike, instead of disabling it."""
         card_img = Image.new("RGB", (96, 32), (0, 0, 255))
 
         class FlakyCardSkin(ScoreboardSkin):
@@ -540,17 +537,30 @@ class TestRenderSkinCard:
         assert probe._skin_failures == 2
 
         FlakyCardSkin.fail = False
-        for _ in range(10):
-            assert probe.render_skin_card({}, (96, 32)) is card_img
-        assert probe._skin_failures == 2  # successes did NOT clear strikes
+        assert probe.render_skin_card({}, (96, 32)) is card_img
+        assert probe._skin_failures == 0  # success cleared the strikes
 
         FlakyCardSkin.fail = True
         probe.render_skin_card({}, (96, 32))
-        assert probe._skin_failures == 3
-        assert probe.render_skin_card({}, (96, 32)) is None  # disabled
+        assert probe._skin_failures == 1  # counting from the reset state
+        FlakyCardSkin.fail = False
+        assert probe.render_skin_card({}, (96, 32)) is card_img  # still enabled
 
-    def test_render_game_success_does_reset_strikes(self):
-        """The other half of the asymmetry, for contrast with the above."""
+    def test_card_success_via_mode_renderer_also_resets_strikes(self):
+        """The fallthrough path (render_vegas_card None -> mode renderer
+        True) resets the counter as well."""
+        class ModeOnlySkin(ScoreboardSkin):
+            def render_live(self, ctx, game):
+                ctx.draw.rectangle([0, 0, 5, 5], fill=(255, 0, 0))
+                return True
+
+        probe = self._probe(ModeOnlySkin({}, {}))
+        probe._skin_failures = 2
+        assert probe.render_skin_card({}, (96, 32)) is not None
+        assert probe._skin_failures == 0
+
+    def test_render_game_success_also_resets_strikes(self):
+        """Same reset contract on the display path, for symmetry."""
         class GoodSkin(ScoreboardSkin):
             def render_live(self, ctx, game):
                 return True

test/test_version_comparison_consistency.py

@@ -1,25 +1,17 @@
 """
-Drift guard: the repo has FOUR version-comparison implementations, and they
-do not agree. This file pins each one's answer on the same inputs so any
-future change to one of them (or a fifth copy appearing) surfaces here.
+Drift guard for version comparison.
 
-The four:
-1. src/plugin_system/compatibility.py  — parse_semver / tuple comparison
-   (install gate).
-2. web_interface/blueprints/api_v3.py  — _is_plugin_update_available, uses
-   packaging.version (update badge in the UI).
-3. src/plugin_system/store_manager.py  — update_plugin's raw STRING EQUALITY
-   for monorepo plugins ("local_version == remote_version").
-4. src/skin_system/skin_runtime.py     — _major, int(major) gate for the
-   skin API.
+There is now ONE shared "should this plugin update?" comparator —
+`src.plugin_system.compatibility.is_update_available` — used by both the web
+UI's update badge (`api_v3._is_plugin_update_available`) and the store's
+`update_plugin` reinstall decision, so the badge and the actual reinstall
+can never disagree. (Historically the store used raw string equality, which
+reinstalled over cosmetic differences like "v1.2.0" vs "1.2.0" and even
+DOWNGRADED locally-ahead plugins; this file's tests killed that.)
 
-SUSPECTED BUG (characterized here, not fixed): #3 disagrees with #2. For
-"v1.2.0" vs "1.2.0" the UI says "no update available" while update_plugin
-performs a full reinstall; for a locally-ahead plugin ("2.0.0" installed,
-registry "1.9.0") the UI says no update but update_plugin DOWNGRADES via
-reinstall. Unifying on one comparator is tracked follow-up work; when that
-lands, the expectations in TestStoreManagerStringEquality flip and this
-file is the reminder to update them deliberately.
+Two other version parsers legitimately remain and are pinned here so they
+don't drift: `compatibility.parse_semver` (the install-compatibility gate,
+range-spec oriented) and `skin_runtime._major` (skin API major gate).
 """
 
 import json
@@ -28,44 +20,40 @@ from unittest.mock import patch
 import pytest
 from packaging.version import parse as pkg_parse
 
-from src.plugin_system.compatibility import parse_semver
+from src.plugin_system.compatibility import is_update_available, parse_semver
 from src.skin_system.skin_runtime import _major
 from src.plugin_system.store_manager import PluginStoreManager
 from web_interface.blueprints.api_v3 import _is_plugin_update_available
 
 
-# (installed, registry) pairs and what each comparator concludes.
+# (installed, registry) -> update available?
 CASES = [
-    # pair                  parse_semver equal?   api_v3 update?   store equal-string?
-    (("1.2.0", "1.2.0"),    True,                 False,           True),
-    (("v1.2.0", "1.2.0"),   True,                 False,           False),
-    (("1.2", "1.2.0"),      True,                 False,           False),
-    (("1.2.0", "1.2.0-rc1"), True,                False,           False),
-    (("1.2.0", "1.3.0"),    False,                True,            False),
-    (("2.0.0", "1.9.0"),    False,                False,           False),
+    (("1.2.0", "1.2.0"), False),   # identical
+    (("v1.2.0", "1.2.0"), False),  # cosmetic v-prefix, semantically equal
+    (("1.2", "1.2.0"), False),     # short form, semantically equal
+    (("1.2.0", "1.2.0-rc1"), False),  # rc of same release is not newer
+    (("1.2.0", "1.3.0"), True),    # registry genuinely newer
+    (("2.0.0", "1.9.0"), False),   # locally ahead — never downgrade
+    (("abc.def", "1.0.0"), True),  # unparseable — surface the mismatch
+    (("", "1.0.0"), False),        # missing either side — nothing to do
+    (("1.0.0", ""), False),
 ]
 
 
-class TestComparatorMatrix:
-    @pytest.mark.parametrize("pair,semver_equal,api_update,store_equal", CASES)
-    def test_parse_semver_equality(self, pair, semver_equal, api_update, store_equal):
-        a, b = pair
-        assert (parse_semver(a) == parse_semver(b)) is semver_equal
-
-    @pytest.mark.parametrize("pair,semver_equal,api_update,store_equal", CASES)
-    def test_api_v3_update_available(self, pair, semver_equal, api_update, store_equal):
+class TestSharedComparator:
+    @pytest.mark.parametrize("pair,expected", CASES)
+    def test_is_update_available(self, pair, expected):
         installed, latest = pair
-        assert _is_plugin_update_available(installed, latest) is api_update
+        assert is_update_available(installed, latest) is expected
 
-    @pytest.mark.parametrize("pair,semver_equal,api_update,store_equal", CASES)
-    def test_store_manager_string_equality(self, pair, semver_equal, api_update, store_equal):
-        # The literal comparison update_plugin performs at its
-        # "already at latest version" check.
-        a, b = pair
-        assert (a == b) is store_equal
+    @pytest.mark.parametrize("pair,expected", CASES)
+    def test_api_v3_helper_agrees(self, pair, expected):
+        # The UI badge helper must be a pure alias of the shared comparator.
+        installed, latest = pair
+        assert _is_plugin_update_available(installed, latest) is expected
 
 
-class TestStoreManagerStringEquality:
+class TestStoreManagerUsesSharedComparator:
     """Drive update_plugin's real code path to its version check."""
 
     def _store(self, tmp_path, local_version, registry_version):
@@ -98,18 +86,30 @@ class TestStoreManagerStringEquality:
         assert result is True
         reinstall.assert_not_called()
 
-    def test_v_prefix_triggers_reinstall_despite_semantic_equality(self, tmp_path):
-        # SUSPECTED BUG: packaging (and api_v3) treat these as equal; the
-        # string comparison does not, so the user gets a full reinstall.
+    def test_v_prefix_equivalent_skips_reinstall(self, tmp_path):
+        # "v1.2.0" == "1.2.0" semantically — no pointless reinstall.
         store, info = self._store(tmp_path, "v1.2.0", "1.2.0")
         result, reinstall = self._run_update(store, info)
+        assert result is True
+        reinstall.assert_not_called()
+
+    def test_locally_ahead_version_is_never_downgraded(self, tmp_path):
+        # A plugin ahead of the registry (local dev build) must not be
+        # "updated" — that would be a downgrade.
+        store, info = self._store(tmp_path, "2.0.0", "1.9.0")
+        result, reinstall = self._run_update(store, info)
+        assert result is True
+        reinstall.assert_not_called()
+
+    def test_registry_newer_triggers_reinstall(self, tmp_path):
+        store, info = self._store(tmp_path, "1.2.0", "1.3.0")
+        result, reinstall = self._run_update(store, info)
         reinstall.assert_called_once()
         assert result is True
 
-    def test_locally_ahead_version_triggers_downgrade_reinstall(self, tmp_path):
-        # SUSPECTED BUG: a plugin ahead of the registry (local dev build) is
-        # "updated" — i.e. downgraded — because inequality is the only test.
-        store, info = self._store(tmp_path, "2.0.0", "1.9.0")
+    def test_unparseable_version_surfaces_via_reinstall(self, tmp_path):
+        # Direction unknowable → reconcile by reinstalling from the registry.
+        store, info = self._store(tmp_path, "abc.def", "1.0.0")
         result, reinstall = self._run_update(store, info)
         reinstall.assert_called_once()
         assert result is True