@automattic/vip 4.1.3 → 4.1.4

package/internal/searchreplace/searchreplace.go

@@ -2,6 +2,7 @@ package searchreplace
 
 import (
 	"bufio"
+	"context"
 	"crypto/rand"
 	"encoding/hex"
 	"errors"
@@ -12,6 +13,8 @@ import (
 	"path/filepath"
 	"runtime"
 	"strings"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // InPlaceConfirmMessage is the prompt Node shows before an irreversible
@@ -93,6 +96,12 @@ func statExists(path string) bool {
 // files, stream input → go-search-replace → (optional mydumper fix) →
 // output.
 func Run(fileName string, pairs []string, opts Options) (*Result, error) {
+	return RunContext(context.Background(), fileName, pairs, opts)
+}
+
+// RunContext preserves invocation-scoped diagnostics while running the same
+// file pipeline as Run. Diagnostics deliberately omit paths and replacements.
+func RunContext(ctx context.Context, fileName string, pairs []string, opts Options) (*Result, error) {
 	// Node: if (!pairs.length) throw (ts:138)
 	if len(pairs) == 0 {
 		return nil, errors.New("No search and replace parameters provided.")
@@ -112,7 +121,9 @@ func Run(fileName string, pairs []string, opts Options) (*Result, error) {
 
 	inputPath := fileName
 	outputPath := opts.Output
+	outputMode := "file"
 	if opts.InPlace {
+		outputMode = "in-place"
 		// Node copies the input to a temp "midput" file first (ts:40-58) because
 		// it opens a write stream on the original immediately. We instead stage
 		// the result in a sibling temp file and rename it into place only on
@@ -120,6 +131,7 @@ func Run(fileName string, pairs []string, opts Options) (*Result, error) {
 		// read directly — no full extra copy of a multi-GB dump.
 		outputPath = fileName
 	} else if outputPath == "" {
+		outputMode = "temporary-file"
 		// Default: temp output file keeping the basename (ts:79-90).
 		tmpDir, err := os.MkdirTemp("", "vip-search-replace")
 		if err != nil {
@@ -127,6 +139,7 @@ func Run(fileName string, pairs []string, opts Options) (*Result, error) {
 		}
 		outputPath = filepath.Join(tmpDir, filepath.Base(fileName))
 	}
+	debuglog.Printf(ctx, "@automattic/vip:lib:search-and-replace", "stage=started input=file output=%s mydumper=%t", outputMode, details.Type == DumpTypeMyDumper)
 
 	bin, err := ResolveBinary()
 	if err != nil {
@@ -189,6 +202,7 @@ func Run(fileName string, pairs []string, opts Options) (*Result, error) {
 		return nil, err
 	}
 	committed = true
+	debuglog.Printf(ctx, "@automattic/vip:lib:search-and-replace", "stage=completed")
 
 	return &Result{InputFileName: fileName, OutputFileName: outputPath}, nil
 }

package/internal/siteimport/debug_test.go

@@ -0,0 +1,34 @@
+package siteimport
+
+import (
+	"bytes"
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Automattic/vip/internal/debuglog"
+	"github.com/Automattic/vip/internal/tui"
+)
+
+func TestStatusDebugSummarizesWithoutServerOutput(t *testing.T) {
+	var logs bytes.Buffer
+	ctx := debuglog.WithLogger(context.Background(), "vip:lib/site-import/status", &logs)
+	_, err := CheckStatus(ctx, CheckStatusOpts{Tracker: tui.NewProgressTracker(nil), Interval: time.Millisecond, Fetch: scriptedFetch([]ProgressSnapshot{
+		{Job: nil},
+		{Job: &ImportJob{Status: "SERVER_SECRET", CreatedAt: "2026-01-01T00:00:00Z", CompletedAt: "TIME_SECRET", Steps: []JobStep{{ID: "ID_SECRET", Name: "NAME_SECRET", Status: tui.StepFailed}}}, StatusProgressStartedAt: 1767225602, FailedStep: &FailedStep{Name: "STEP_SECRET", Output: []string{"SQL_SECRET"}, StartedAt: 1767225603}},
+	})})
+	if err == nil {
+		t.Fatal("expected failed import")
+	}
+	for _, want := range []string{"No import job", "status=unknown", "steps=1", "Import step failed"} {
+		if !strings.Contains(logs.String(), want) {
+			t.Errorf("missing %q in %s", want, &logs)
+		}
+	}
+	for _, secret := range []string{"SERVER_SECRET", "TIME_SECRET", "ID_SECRET", "NAME_SECRET", "STEP_SECRET", "SQL_SECRET"} {
+		if strings.Contains(logs.String(), secret) {
+			t.Errorf("leaked %q", secret)
+		}
+	}
+}

package/internal/siteimport/status.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/fatih/color"
 
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/tui"
 )
 
@@ -117,6 +118,7 @@ func CheckStatus(ctx context.Context, opts CheckStatusOpts) (*StatusResult, erro
 		}
 
 		if snap.Job == nil {
+			debuglog.Printf(ctx, "vip:lib/site-import/status", "No import job data available")
 			if opts.ReturnMissingJobImmediately {
 				// status.ts:329 — resolve('No import job found')
 				return &StatusResult{Message: "No import job found"}, nil
@@ -137,6 +139,14 @@ func CheckStatus(ctx context.Context, opts CheckStatusOpts) (*StatusResult, erro
 		}
 		createdAt := job.CreatedAt
 		completedAt := job.CompletedAt
+		// Server strings and command output can contain sensitive data. Only
+		// allow known status values into the diagnostic summary.
+		diagnosticStatus := "unknown"
+		switch jobStatus {
+		case "running", "success", "error", "failed", "completed":
+			diagnosticStatus = jobStatus
+		}
+		debuglog.Printf(ctx, "vip:lib/site-import/status", "Import job: status=%s steps=%d completed=%t", diagnosticStatus, len(job.Steps), completedAt != "")
 
 		// failedImportStep gate (status.ts:353-366): the import_progress
 		// meta is only pertinent when it started at/after job creation.
@@ -155,6 +165,7 @@ func CheckStatus(ctx context.Context, opts CheckStatusOpts) (*StatusResult, erro
 		}
 
 		if failed != nil {
+			debuglog.Printf(ctx, "vip:lib/site-import/status", "Import step failed: launched=%t", snap.Launched)
 			// status.ts:373 — demote the 'import' step to failed, render,
 			// then reject with the structured error.
 			steps := make([]JobStep, len(job.Steps))

package/internal/telemetry/pendo.go

@@ -2,22 +2,26 @@ package telemetry
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
+	"errors"
+	"fmt"
 	"net/http"
 	"strings"
 	"time"
 
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/httpproxy"
 )
 
 // PendoClient posts analytics events to Pendo via the VIP API proxy.
 //
-// Node parity: mirrors src/lib/analytics/clients/pendo.ts exactly.
+// Node counterpart: src/lib/analytics/clients/pendo.ts.
 //
 // The Node client sends to Pendo.ENDPOINT = "/pendo" prefixed by API_HOST
 // (https://api.wpvip.com), so the full URL is https://api.wpvip.com/pendo.
-// Node attaches a bearer token via the shared http wrapper; Go telemetry
-// calls are fire-and-forget without auth (same approach as TracksClient).
+// Both runtimes authenticate through the current VIP session. Failures are
+// diagnostic only: Tracker deliberately does not fail the user's command.
 //
 // Payload shape (mirrors Node's send() method):
 //
@@ -44,6 +48,11 @@ type PendoClient struct {
 	EventPrefix string
 	// HTTP is the HTTP client; nil means a default 5-second-timeout client.
 	HTTP *http.Client
+	// GetToken reads the current session at send time, including login/logout
+	// changes. Missing credentials skip Pendo without starting a login flow.
+	GetToken func() (string, error)
+	// Context carries this invocation's opt-in diagnostics.
+	Context context.Context
 }
 
 // resolveUserID returns UserID if set, otherwise calls GetUserID().
@@ -84,8 +93,26 @@ type pendoPayload struct {
 
 // TrackEvent sends a single named event to Pendo.
 // The event name is auto-prefixed with EventPrefix if not already present.
-// Errors from the HTTP call are swallowed (Node returns false on error).
+// Delivery errors contain only safe summaries; Tracker ignores them.
 func (c *PendoClient) TrackEvent(name string, props map[string]any) error {
+	requestContext := c.Context
+	if requestContext == nil {
+		requestContext = context.Background()
+	}
+	const namespace = "@automattic/vip:analytics:clients:pendo"
+	fail := func(message string) error {
+		debuglog.Printf(requestContext, namespace, "%s", message)
+		return errors.New(message)
+	}
+	if c.GetToken == nil {
+		debuglog.Printf(requestContext, namespace, "Skipping event: no authenticated session")
+		return nil
+	}
+	token, err := c.GetToken()
+	if err != nil || token == "" {
+		debuglog.Printf(requestContext, namespace, "Skipping event: no authenticated session")
+		return nil
+	}
 	if !strings.HasPrefix(name, c.EventPrefix) {
 		name = c.EventPrefix + name
 	}
@@ -125,16 +152,16 @@ func (c *PendoClient) TrackEvent(name string, props map[string]any) error {
 
 	body, err := json.Marshal(payload)
 	if err != nil {
-		// Swallow, same as Node's catch block returning false.
-		return nil
+		return fail("Unable to encode event")
 	}
 
-	req, err := http.NewRequest("POST", c.Endpoint, bytes.NewReader(body))
+	req, err := http.NewRequestWithContext(requestContext, "POST", c.Endpoint, bytes.NewReader(body))
 	if err != nil {
-		return nil
+		return fail("Unable to construct request")
 	}
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("User-Agent", c.UserAgent)
+	req.Header.Set("Authorization", "Bearer "+token)
 
 	httpClient := c.HTTP
 	if httpClient == nil {
@@ -144,11 +171,15 @@ func (c *PendoClient) TrackEvent(name string, props map[string]any) error {
 		httpClient = httpproxy.ClientWithTimeout(5 * time.Second)
 	}
 
+	debuglog.Printf(requestContext, namespace, "Sending event")
 	resp, err := httpClient.Do(req)
 	if err != nil {
-		// Node: catch(error) { debug(error); return Promise.resolve(false) }
-		return nil
+		return fail("Request failed")
 	}
 	resp.Body.Close()
+	debuglog.Printf(requestContext, namespace, "Response status=%d", resp.StatusCode)
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fail(fmt.Sprintf("Request rejected: HTTP %d", resp.StatusCode))
+	}
 	return nil
 }

package/internal/telemetry/pendo_auth_test.go

@@ -0,0 +1,92 @@
+package telemetry
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/Automattic/vip/internal/debuglog"
+)
+
+func TestPendoTokenChangesAndRemoval(t *testing.T) {
+	var headers []string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		headers = append(headers, r.Header.Get("Authorization"))
+	}))
+	defer srv.Close()
+	token := "first-token"
+	c := &PendoClient{Endpoint: srv.URL, HTTP: srv.Client(), GetToken: func() (string, error) { return token, nil }}
+	for _, next := range []string{"first-token", "replacement-token", ""} {
+		token = next
+		if err := c.TrackEvent("test", nil); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if len(headers) != 2 || headers[0] != "Bearer first-token" || headers[1] != "Bearer replacement-token" {
+		t.Fatalf("authentication did not follow token changes: %v", headers)
+	}
+}
+
+func TestPendoMissingCredentialsSkipsRequestAndIdentityLookup(t *testing.T) {
+	for _, getToken := range []func() (string, error){nil, func() (string, error) { return "", nil }, func() (string, error) { return "", errors.New("PRIVATE_STORE_ERROR") }} {
+		var diagnostics bytes.Buffer
+		c := &PendoClient{
+			Endpoint: ":invalid", GetToken: getToken,
+			Context:   debuglog.WithLogger(context.Background(), "*", &diagnostics),
+			GetUserID: func() string { t.Fatal("no-token event accessed the identity store"); return "" },
+		}
+		if err := c.TrackEvent("test", nil); err != nil {
+			t.Fatal(err)
+		}
+		if !strings.Contains(diagnostics.String(), "Skipping event") || strings.Contains(diagnostics.String(), "PRIVATE_STORE_ERROR") {
+			t.Fatalf("unexpected diagnostics: %s", &diagnostics)
+		}
+	}
+}
+
+func TestPendoDiagnosticsAndNonfatalFailures(t *testing.T) {
+	for _, selector := range []string{"", "@automattic/vip:analytics:clients:pendo", "*,-@automattic/vip:analytics:clients:pendo"} {
+		t.Run(selector, func(t *testing.T) {
+			for _, name := range []string{"DO_NOT_TRACK", "GO_ENV", "NODE_ENV"} {
+				t.Setenv(name, "")
+			}
+			var diagnostics bytes.Buffer
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusUnauthorized)
+				_, _ = w.Write([]byte("PRIVATE_RESPONSE"))
+			}))
+			defer srv.Close()
+			pendo := &PendoClient{Endpoint: srv.URL, HTTP: srv.Client(), UserID: "PRIVATE_ID"}
+			other := &fakeClient{}
+			tr := &Tracker{Clients: []Client{pendo, other}}
+			tr.SetPendoTokenSource(func() (string, error) { return "PRIVATE_TOKEN", nil })
+			tr.SetContext(debuglog.WithLogger(context.Background(), selector, &diagnostics))
+			tr.TrackEvent("test", map[string]any{"value": "PRIVATE_PAYLOAD"})
+			if len(other.events) != 1 {
+				t.Fatal("Pendo failure prevented other telemetry")
+			}
+			if strings.Contains(diagnostics.String(), "PRIVATE_") {
+				t.Fatalf("private data in diagnostics: %s", &diagnostics)
+			}
+			wantLog := selector == "@automattic/vip:analytics:clients:pendo"
+			if strings.Contains(diagnostics.String(), "401") != wantLog {
+				t.Fatalf("missing or unfiltered status: %s", &diagnostics)
+			}
+		})
+	}
+}
+
+func TestPendoTrackingOptOutAvoidsCredentials(t *testing.T) {
+	for _, name := range []string{"DO_NOT_TRACK", "GO_ENV", "NODE_ENV"} {
+		t.Run(name, func(t *testing.T) {
+			t.Setenv(name, "test")
+			tr := &Tracker{Clients: []Client{&PendoClient{}}}
+			tr.SetPendoTokenSource(func() (string, error) { t.Fatal("tracking opt-out accessed credentials"); return "", nil })
+			tr.TrackEvent("test", nil)
+		})
+	}
+}

package/internal/telemetry/pendo_test.go

@@ -26,6 +26,7 @@ func captureRequest(t *testing.T, c *PendoClient, name string, props map[string]
 	t.Cleanup(srv.Close)
 
 	c.Endpoint = srv.URL
+	c.GetToken = func() (string, error) { return "fixture-token", nil }
 	if err := c.TrackEvent(name, props); err != nil {
 		t.Fatalf("TrackEvent returned unexpected error: %v", err)
 	}
@@ -35,6 +36,22 @@ func captureRequest(t *testing.T, c *PendoClient, name string, props map[string]
 	return captured, capturedReq
 }
 
+func TestPendoRejectsHTTPFailure(t *testing.T) {
+	for _, status := range []int{401, 403, 429, 500} {
+		t.Run(http.StatusText(status), func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(status)
+				_, _ = w.Write([]byte("private response body"))
+			}))
+			defer srv.Close()
+			c := &PendoClient{Endpoint: srv.URL, HTTP: srv.Client(), UserID: "fixture", GetToken: func() (string, error) { return "fixture-token", nil }}
+			if err := c.TrackEvent("test", nil); err == nil {
+				t.Fatal("failed delivery was reported as successful")
+			}
+		})
+	}
+}
+
 // TestPendoClientPostsExpectedPayload verifies that TrackEvent sends a POST
 // with the correct JSON body matching Node's send() output: event name (prefixed),
 // type "track", visitorId, accountId, context fields, and properties.
@@ -173,17 +190,18 @@ func TestPendoClientOrgContextFields(t *testing.T) {
 	}
 }
 
-// TestPendoClientSwallowsNetworkError verifies that a network failure returns
-// nil (not an error), mirroring Node's catch block returning Promise.resolve(false).
-func TestPendoClientSwallowsNetworkError(t *testing.T) {
+// TestPendoClientReportsNetworkError verifies failures are observable to the
+// tracker without including raw transport errors or request data.
+func TestPendoClientReportsNetworkError(t *testing.T) {
 	c := &PendoClient{
+		GetToken:    func() (string, error) { return "fixture-token", nil },
 		Endpoint:    "http://127.0.0.1:1", // nothing listening
 		UserID:      "u",
 		UserAgent:   "x",
 		EventPrefix: TracksEventPrefix,
 	}
-	if err := c.TrackEvent("test", nil); err != nil {
-		t.Errorf("expected nil on network error (Node swallows errors), got %v", err)
+	if err := c.TrackEvent("test", nil); err == nil || err.Error() != "Request failed" {
+		t.Errorf("expected safe network error, got %v", err)
 	}
 }
 
@@ -198,6 +216,7 @@ func TestPendoClientLazyUserIDResolved(t *testing.T) {
 
 	c := &PendoClient{
 		Endpoint:    srv.URL,
+		GetToken:    func() (string, error) { return "fixture-token", nil },
 		GetUserID:   func() string { calls++; return "lazy-uuid" },
 		UserAgent:   "vip-next/test",
 		EventPrefix: TracksEventPrefix,

package/internal/telemetry/tracker.go

@@ -1,6 +1,7 @@
 package telemetry
 
 import (
+	"context"
 	"fmt"
 	"os"
 )
@@ -19,6 +20,31 @@ type Tracker struct {
 	Disabled  bool
 }
 
+// SetPendoTokenSource binds Pendo to the invocation's credential store before
+// login can emit events. Tracks has its own authentication scheme.
+func (t *Tracker) SetPendoTokenSource(getToken func() (string, error)) {
+	if t == nil {
+		return
+	}
+	for _, client := range t.Clients {
+		if pendo, ok := client.(*PendoClient); ok {
+			pendo.GetToken = getToken
+		}
+	}
+}
+
+// SetContext attaches the parsed command's diagnostics before command events.
+func (t *Tracker) SetContext(ctx context.Context) {
+	if t == nil {
+		return
+	}
+	for _, client := range t.Clients {
+		if pendo, ok := client.(*PendoClient); ok {
+			pendo.Context = ctx
+		}
+	}
+}
+
 // TrackEvent emits name with props to every configured Client.
 // It is a no-op when the tracker is disabled or DO_NOT_TRACK / test env vars are set.
 func (t *Tracker) TrackEvent(name string, props map[string]any) {

package/internal/update/github.go

@@ -64,24 +64,26 @@ func (g GitHub) Releases(ctx context.Context) ([]Release, error) {
 		}
 		releases = append(releases, batch...)
 		next := 0
-		for _, part := range strings.Split(resp.Header.Get("Link"), ",") {
-			if !strings.Contains(part, `rel="next"`) {
-				continue
+		for _, value := range resp.Header.Values("Link") {
+			for _, part := range strings.Split(value, ",") {
+				if !strings.Contains(part, `rel="next"`) {
+					continue
+				}
+				left, right := strings.Index(part, "<"), strings.Index(part, ">")
+				if left < 0 || right <= left {
+					return nil, fmt.Errorf("invalid release pagination")
+				}
+				u, err := url.Parse(part[left+1 : right])
+				if err != nil {
+					return nil, fmt.Errorf("invalid release pagination")
+				}
+				u = origin.ResolveReference(u)
+				n, err := strconv.Atoi(u.Query().Get("page"))
+				if err != nil || n <= page || u.Scheme != origin.Scheme || u.Host != origin.Host || !isReleasePaginationPath(u.EscapedPath()) || u.User != nil || next != 0 {
+					return nil, fmt.Errorf("invalid release pagination")
+				}
+				next = n
 			}
-			left, right := strings.Index(part, "<"), strings.Index(part, ">")
-			if left < 0 || right <= left {
-				return nil, fmt.Errorf("invalid release pagination")
-			}
-			u, err := url.Parse(part[left+1 : right])
-			if err != nil {
-				return nil, fmt.Errorf("invalid release pagination")
-			}
-			u = origin.ResolveReference(u)
-			n, err := strconv.Atoi(u.Query().Get("page"))
-			if err != nil || n <= page || u.Scheme != origin.Scheme || u.Host != origin.Host || u.Path != "/repos/"+Repository+"/releases" || u.User != nil || next != 0 {
-				return nil, fmt.Errorf("invalid release pagination")
-			}
-			next = n
 		}
 		if next == 0 {
 			return releases, nil
@@ -90,6 +92,23 @@ func (g GitHub) Releases(ctx context.Context) ([]Release, error) {
 	}
 	return nil, fmt.Errorf("GitHub release pagination limit exceeded")
 }
+
+func isReleasePaginationPath(path string) bool {
+	if path == "/repos/"+Repository+"/releases" {
+		return true
+	}
+	repositoryID, ok := strings.CutPrefix(path, "/repositories/")
+	if !ok {
+		return false
+	}
+	repositoryID, ok = strings.CutSuffix(repositoryID, "/releases")
+	if !ok {
+		return false
+	}
+	id, err := strconv.ParseUint(repositoryID, 10, 64)
+	return err == nil && id > 0
+}
+
 func readBounded(r io.Reader, max int64) ([]byte, error) {
 	b, err := io.ReadAll(io.LimitReader(r, max+1))
 	if err != nil {

package/internal/update/ownership.go

@@ -24,6 +24,28 @@ func inspectOwnership(ctx context.Context, l Layout, goos string, query ownershi
 	ctx, cancel := context.WithTimeout(ctx, 3*time.Second)
 	defer cancel()
 	for _, target := range []string{l.CLI, l.Helper} {
+		if goos == "darwin" || goos == "windows" {
+			markerPath := filepath.Join(filepath.Dir(target), ".vip-next-installer.json")
+			if _, err := regularFile(markerPath); err == nil {
+				var marker struct {
+					Schema  int    `json:"schema"`
+					Manager string `json:"manager"`
+				}
+				if err := readJSON(markerPath, 4096, &marker); err != nil {
+					return Ownership{}, fmt.Errorf("read installer ownership: %w", err)
+				}
+				manager := "pkg"
+				if goos == "windows" {
+					manager = "msi"
+				}
+				if marker.Schema != 1 || marker.Manager != manager {
+					return Ownership{}, fmt.Errorf("invalid installer ownership record: %s", markerPath)
+				}
+				return Ownership{true, "This installation is managed by the VIP CLI installer. Download and run the latest ." + manager + " installer for your platform from " + ReleasesURL}, nil
+			} else if !os.IsNotExist(err) {
+				return Ownership{}, fmt.Errorf("inspect installer ownership: %w", err)
+			}
+		}
 		normalized := filepath.ToSlash(target)
 		switch goos {
 		case "darwin":

package/internal/update/ownership_test.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -38,6 +39,49 @@ func TestOwnershipUsesReceiptsAndFailsClosed(t *testing.T) {
 		t.Fatal("bare /usr/local/bin misclassified", o, err)
 	}
 }
+
+func TestNativeInstallerOwnership(t *testing.T) {
+	for _, platform := range []struct{ os, manager, extension string }{{"darwin", "pkg", ".pkg"}, {"windows", "msi", ".msi"}} {
+		t.Run(platform.os, func(t *testing.T) {
+			for _, helperMarker := range []bool{false, true} {
+				dir := t.TempDir()
+				helperDir := filepath.Join(dir, "bin")
+				if err := os.Mkdir(helperDir, 0755); err != nil {
+					t.Fatal(err)
+				}
+				l := Layout{filepath.Join(dir, "vip-next"), filepath.Join(helperDir, "go-search-replace")}
+				markerDir := dir
+				if helperMarker {
+					markerDir = helperDir
+				}
+				q := func(context.Context, string, ...string) ([]byte, error) {
+					t.Fatal("unexpected external query")
+					return nil, nil
+				}
+				o, err := inspectOwnership(context.Background(), l, platform.os, q)
+				if err != nil || o.Managed {
+					t.Fatal("portable install misclassified", o, err)
+				}
+				marker := filepath.Join(markerDir, ".vip-next-installer.json")
+				if err := os.WriteFile(marker, []byte(`{"schema":1,"manager":"`+platform.manager+`"}`), 0644); err != nil {
+					t.Fatal(err)
+				}
+				o, err = inspectOwnership(context.Background(), l, platform.os, q)
+				if err != nil || !o.Managed || !strings.Contains(o.Instructions, platform.extension) || !strings.Contains(o.Instructions, ReleasesURL) {
+					t.Fatal(o, err)
+				}
+				for _, contents := range []string{"{", `{"schema":2,"manager":"pkg"}`, `{"schema":1,"manager":"unknown"}`} {
+					if err := os.WriteFile(marker, []byte(contents), 0644); err != nil {
+						t.Fatal(err)
+					}
+					if _, err := inspectOwnership(context.Background(), l, platform.os, q); err == nil {
+						t.Fatal("invalid marker accepted", contents)
+					}
+				}
+			}
+		})
+	}
+}
 func TestResolveLayoutPreservesEntrypointSymlink(t *testing.T) {
 	l, _ := installFixture(t)
 	link := filepath.Join(t.TempDir(), "vip")