@wipcomputer/wip-ldm-os 0.2.1 → 0.2.3

package/README.md

@@ -23,16 +23,23 @@ Open your AI and paste this:
 Read the SKILL.md at github.com/wipcomputer/wip-ldm-os/blob/main/SKILL.md.
 
 Then explain to me:
-1. What is LDM OS?
-2. What does it do?
-3. What would it change about how my AI works?
+1. What are these tools?
+2. What do they do?
+3. What would change about how we work together?
+4. What would it change about how all my AI work?
+
+Then ask me:
+- Do you have more questions?
+- Do you want to install it?
 
 If I say yes, run: ldm install --dry-run
 
-Show me exactly what will change. When I'm ready, install for real.
+And show me exactly what will change on my system.
+
+When I'm ready, I'll tell you to install for real.
 ```
 
-That's it. Your AI reads the spec, explains what LDM OS is, and walks you through a dry run before touching anything.
+That's it. Your AI reads the spec, explains what it does, and walks you through a dry run before touching anything.
 
 ## Included Skills
 

package/SKILL.md

@@ -5,7 +5,7 @@ license: MIT
 interface: [cli, skill]
 metadata:
   display-name: "LDM OS"
-  version: "0.2.1"
+  version: "0.2.3"
   homepage: "https://github.com/wipcomputer/wip-ldm-os"
   author: "Parker Todd Brooks"
   category: infrastructure
@@ -89,7 +89,13 @@ LDM OS ships with a skill catalog. Show the user what's available:
 |-------|-----------|--------|
 | **Memory Crystal** (recommended) | Persistent memory. Search, capture, consolidation. | Stable |
 | **AI DevOps Toolbox** | Release, deploy, license, repo management. | Stable |
-| **Agent Pay** | Micropayments for AI agents. Apple Pay. | Coming Soon |
+| **1Password** | 1Password secrets for AI agents. | Stable |
+| **Markdown Viewer** | Live markdown viewer for AI pair-editing. | Stable |
+| **xAI Grok** | xAI Grok API. Search the web, search X, generate images. | Stable |
+| **X Platform** | X Platform API. Read posts, search tweets, post, upload media. | Stable |
+| **OpenClaw** | AI agent platform. Run AI agents 24/7 with identity, memory, and tool access. | Stable |
+| **Dream Weaver Protocol** | Memory consolidation protocol for AI agents. | Stable |
+| **Bridge** | Cross-platform agent bridge. Claude Code to OpenClaw communication. | Stable |
 
 To install a skill:
 ```bash
@@ -103,6 +109,8 @@ ldm install wipcomputer/memory-crystal
 
 The installer detects what a repo supports (CLI, MCP Server, OpenClaw Plugin, Skill, CC Hook, Module) and deploys each interface to the right location automatically.
 
+**Note:** Skills installed before LDM OS (via `crystal init`, `wip-install`, or manual setup) may not appear in the registry. Run `ldm install <org/repo>` to re-register them.
+
 ### Step 3: Verify
 
 ```bash
@@ -158,5 +166,12 @@ LDM OS is the runtime. Skills plug into it:
 
 - **Memory Crystal** ... `wipcomputer/memory-crystal`
 - **AI DevOps Toolbox** ... `wipcomputer/wip-ai-devops-toolbox`
+- **1Password** ... `wipcomputer/wip-1password`
+- **Markdown Viewer** ... `wipcomputer/wip-markdown-viewer`
+- **xAI Grok** ... `wipcomputer/wip-xai-grok`
+- **X Platform** ... `wipcomputer/wip-xai-x`
+- **OpenClaw** ... `openclaw/openclaw`
+- **Dream Weaver Protocol** ... `wipcomputer/dream-weaver-protocol`
+- **Bridge** ... `wipcomputer/wip-bridge`
 
 Run `ldm install` anytime to add more skills.

package/bin/ldm.mjs

@@ -349,48 +349,132 @@ async function cmdInstall() {
   await installFromPath(repoPath);
 }
 
-// ── ldm install (bare): show catalog + update registered ──
+// ── Auto-detect unregistered extensions ──
 
-async function cmdInstallCatalog() {
+function autoDetectExtensions() {
+  if (!existsSync(LDM_EXTENSIONS)) return;
   const registry = readJSON(REGISTRY_PATH);
-  const installed = Object.keys(registry?.extensions || {});
-  const components = loadCatalog();
+  if (!registry) return;
 
-  console.log('');
+  const registered = Object.keys(registry.extensions || {});
+  let found = 0;
 
-  // Show installed
-  if (installed.length > 0) {
-    console.log('  Installed components:');
-    for (const name of installed) {
-      const info = registry.extensions[name];
-      console.log(`    [x] ${name} v${info?.version || '?'}`);
+  try {
+    const dirs = readdirSync(LDM_EXTENSIONS, { withFileTypes: true });
+    for (const dir of dirs) {
+      if (!dir.isDirectory()) continue;
+      if (dir.name === '_trash' || dir.name.startsWith('.')) continue;
+
+      const extPath = join(LDM_EXTENSIONS, dir.name);
+      const pkgPath = join(extPath, 'package.json');
+      if (!existsSync(pkgPath)) continue;
+
+      // Check if already registered (by directory name or by ldmPath)
+      const alreadyRegistered = registered.some(name => {
+        const info = registry.extensions[name];
+        return name === dir.name || info?.ldmPath === extPath;
+      });
+      if (alreadyRegistered) continue;
+
+      // Auto-register
+      const pkg = readJSON(pkgPath);
+      if (!pkg) continue;
+
+      registry.extensions[dir.name] = {
+        name: dir.name,
+        version: pkg.version || '?',
+        source: null,
+        interfaces: [],
+        ldmPath: extPath,
+        updatedAt: new Date().toISOString(),
+        autoDetected: true,
+      };
+      found++;
     }
-    console.log('');
+  } catch {}
+
+  if (found > 0) {
+    writeJSON(REGISTRY_PATH, registry);
   }
+  return found;
+}
+
+// ── ldm install (bare): scan system, show real state, update if needed ──
+
+async function cmdInstallCatalog() {
+  autoDetectExtensions();
+
+  const { detectSystemState, reconcileState, formatReconciliation } = await import('../lib/state.mjs');
+  const state = detectSystemState();
+  const reconciled = reconcileState(state);
+
+  // Show the real system state
+  console.log(formatReconciliation(reconciled));
+
+  // Show catalog items not yet managed
+  const registry = readJSON(REGISTRY_PATH);
+  const registeredNames = Object.keys(registry?.extensions || {});
+  const components = loadCatalog();
+  const available = components.filter(c =>
+    c.status !== 'coming-soon'
+    && !registeredNames.includes(c.id)
+    // Also check if it's in reconciled as external (already installed outside LDM)
+    && !reconciled[c.id]
+  );
 
-  // Show available (not installed)
-  const available = components.filter(c => !installed.includes(c.id));
   if (available.length > 0) {
-    console.log('  Available components:');
-    let idx = 1;
-    const selectable = [];
+    console.log('  Available in catalog (not yet installed):');
     for (const c of available) {
-      if (c.status === 'coming-soon') {
-        console.log(`    [ ] ${c.name} (coming soon)`);
-      } else {
-        console.log(`    [ ] ${c.name}`);
-        selectable.push(c);
-      }
-      idx++;
+      console.log(`    [ ] ${c.name} ... ${c.description}`);
     }
     console.log('');
+  }
 
-    // Interactive prompt if TTY and not --yes/--none
-    if (selectable.length > 0 && !YES_FLAG && !NONE_FLAG && !DRY_RUN && process.stdin.isTTY) {
+  if (DRY_RUN) {
+    // Show what an update would do
+    const updatable = Object.values(reconciled).filter(e =>
+      e.status === 'healthy' && e.registryHasSource
+    );
+    const unlinked = Object.values(reconciled).filter(e =>
+      e.status === 'installed-unlinked'
+    );
+
+    if (updatable.length > 0) {
+      console.log(`  Would update ${updatable.length} extension(s) from source repos.`);
+      console.log('  No data (crystal.db, secrets, agent files) would be touched.');
+      console.log('  Old versions would be moved to ~/.ldm/_trash/ (never deleted).');
+    } else {
+      console.log('  Nothing to update from source repos.');
+    }
+
+    if (unlinked.length > 0) {
+      console.log('');
+      console.log(`  ${unlinked.length} extension(s) are installed but have no source repo linked.`);
+      console.log('  These are safe. Link them with: ldm install <org/repo>');
+    }
+
+    console.log('');
+    console.log('  Dry run complete. No changes made.');
+    console.log('');
+    return;
+  }
+
+  // Real update: only touch things with linked source repos
+  const updatable = Object.values(reconciled).filter(e =>
+    e.registryHasSource
+  );
+
+  if (updatable.length === 0) {
+    console.log('  No extensions have linked source repos to update from.');
+    console.log('  Link them with: ldm install <org/repo>');
+    console.log('');
+
+    // Still offer catalog install if TTY
+    if (available.length > 0 && !YES_FLAG && !NONE_FLAG && process.stdin.isTTY) {
       const { createInterface } = await import('node:readline');
       const rl = createInterface({ input: process.stdin, output: process.stdout });
       const answer = await new Promise((resolve) => {
-        rl.question('  Install more? [number,all,none]: ', (a) => {
+        rl.question('  Install from catalog? [number,all,none]: ', (a) => {
           rl.close();
           resolve(a.trim().toLowerCase());
         });
@@ -399,10 +483,10 @@ async function cmdInstallCatalog() {
       if (answer && answer !== 'none' && answer !== 'n') {
         let toInstall = [];
         if (answer === 'all' || answer === 'a') {
-          toInstall = selectable;
+          toInstall = available;
         } else {
           const nums = answer.split(',').map(s => parseInt(s.trim(), 10)).filter(n => !isNaN(n));
-          toInstall = nums.map(n => selectable[n - 1]).filter(Boolean);
+          toInstall = nums.map(n => available[n - 1]).filter(Boolean);
         }
         for (const c of toInstall) {
           console.log(`  Installing ${c.name}...`);
@@ -414,55 +498,55 @@ async function cmdInstallCatalog() {
         }
       }
     }
+    return;
   }
 
-  // Update installed extensions
-  if (installed.length > 0) {
-    await cmdUpdateAll();
-  }
-
-  if (installed.length === 0 && available.filter(c => c.status !== 'coming-soon').length === 0) {
-    console.log('  No extensions registered. Nothing to update.');
-    console.log('  Use: ldm install <org/repo> or ldm install /path/to/repo');
-    console.log('');
-  }
-}
-
-async function cmdUpdateAll() {
-  const registry = readJSON(REGISTRY_PATH);
-  if (!registry?.extensions || Object.keys(registry.extensions).length === 0) return;
+  // Write revert manifest before starting
+  const { createRevertManifest } = await import('../lib/safe.mjs');
+  const manifestPath = createRevertManifest(
+    `ldm install (update ${updatable.length} extensions)`,
+    updatable.map(e => ({
+      action: 'update',
+      name: e.name,
+      currentVersion: e.ldmVersion || e.registryVersion,
+      source: e.registrySource,
+    }))
+  );
+  console.log(`  Revert plan saved: ${manifestPath}`);
+  console.log('');
 
   const { setFlags, installFromPath } = await import('../lib/deploy.mjs');
   setFlags({ dryRun: DRY_RUN, jsonOutput: JSON_OUTPUT });
 
-  const extensions = Object.entries(registry.extensions);
-  console.log(`  Updating ${extensions.length} registered extension(s)...`);
-  console.log('');
-
   let updated = 0;
-  for (const [name, info] of extensions) {
-    const source = info.source;
-    if (!source || !existsSync(source)) {
-      console.log(`  x ${name}: source not found at ${source || '(none)'}`);
-      continue;
-    }
-
-    await installFromPath(source);
+  for (const entry of updatable) {
+    await installFromPath(entry.registrySource);
     updated++;
   }
 
   console.log('');
-  console.log(`  Updated ${updated}/${extensions.length} extension(s).`);
+  console.log(`  Updated ${updated}/${updatable.length} extension(s).`);
   console.log('');
 }
 
+async function cmdUpdateAll() {
+  // Delegate to the catalog flow which now has full state awareness
+  return cmdInstallCatalog();
+}
+
 // ── ldm doctor ──
 
-function cmdDoctor() {
+async function cmdDoctor() {
   console.log('');
   console.log('  ldm doctor');
   console.log('  ────────────────────────────────────');
 
+  // Auto-detect unregistered extensions before checking
+  const detected = autoDetectExtensions();
+  if (detected > 0) {
+    console.log(`  + Auto-detected ${detected} unregistered extension(s)`);
+  }
+
   let issues = 0;
 
   // 1. Check LDM root
@@ -482,43 +566,19 @@ function cmdDoctor() {
     console.log(`  + version.json: v${version.version} (installed ${version.installed?.split('T')[0]})`);
   }
 
-  // 3. Check registry
-  const registry = readJSON(REGISTRY_PATH);
-  if (!registry) {
-    console.log('  x registry.json missing');
-    issues++;
-  } else {
-    const extCount = Object.keys(registry.extensions || {}).length;
-    console.log(`  + registry.json: ${extCount} extension(s)`);
-
-    // Check each extension
-    for (const [name, info] of Object.entries(registry.extensions || {})) {
-      const ldmPath = info.ldmPath || join(LDM_EXTENSIONS, name);
-      const hasLdm = existsSync(ldmPath);
-      const hasPkg = hasLdm && existsSync(join(ldmPath, 'package.json'));
-
-      if (!hasLdm) {
-        console.log(`  x ${name}: not found at ${ldmPath}`);
-        issues++;
-      } else if (!hasPkg) {
-        console.log(`  x ${name}: deployed but missing package.json`);
-        issues++;
-      } else {
-        const pkg = readJSON(join(ldmPath, 'package.json'));
-        const ver = pkg?.version || '?';
-        const registeredVer = info.version || '?';
-        if (ver !== registeredVer) {
-          console.log(`  ! ${name}: deployed v${ver} but registry says v${registeredVer}`);
-        } else {
-          console.log(`  + ${name}: v${ver}`);
-        }
-      }
+  // 3. Full system state scan
+  const { detectSystemState, reconcileState, formatReconciliation } = await import('../lib/state.mjs');
+  const state = detectSystemState();
+  const reconciled = reconcileState(state);
 
-      // Check OC copy
-      if (info.ocPath && !existsSync(info.ocPath)) {
-        console.log(`    x OpenClaw copy missing at ${info.ocPath}`);
-        issues++;
-      }
+  // Show reconciled view
+  console.log(formatReconciliation(reconciled, { verbose: true }));
+
+  // Count issues from reconciliation
+  for (const entry of Object.values(reconciled)) {
+    if (entry.status === 'registered-missing') issues++;
+    if (entry.issues.length > 0 && entry.status !== 'installed-unlinked' && entry.status !== 'external') {
+      issues += entry.issues.length;
     }
   }
 
@@ -534,6 +594,7 @@ function cmdDoctor() {
       console.log(`  + ${s.label} exists`);
     } else {
       console.log(`  ! ${s.label} missing (run: ldm init)`);
+      issues++;
     }
   }
 
@@ -547,12 +608,14 @@ function cmdDoctor() {
     console.log(`  - Claude Code hooks: none configured`);
   }
 
-  // 6. Check MCP servers
-  const ccUserPath = join(HOME, '.claude.json');
-  const ccUser = readJSON(ccUserPath);
-  if (ccUser?.mcpServers) {
-    const mcpCount = Object.keys(ccUser.mcpServers).length;
-    console.log(`  + MCP servers (user): ${mcpCount} registered`);
+  // 6. MCP servers
+  const mcpCount = Object.keys(state.mcp).length;
+  console.log(`  + MCP servers: ${mcpCount} registered`);
+
+  // 7. CLI binaries
+  const binCount = Object.keys(state.cliBinaries).length;
+  if (binCount > 0) {
+    console.log(`  + CLI binaries: ${Object.keys(state.cliBinaries).join(', ')}`);
   }
 
   console.log('');

package/lib/deploy.mjs

@@ -17,6 +17,7 @@ import {
 import { join, basename, resolve, dirname } from 'node:path';
 import { tmpdir } from 'node:os';
 import { detectInterfaces, describeInterfaces, detectToolbox } from './detect.mjs';
+import { moveToTrash, appendToManifest } from './safe.mjs';
 
 const HOME = process.env.HOME || '';
 const LDM_ROOT = join(HOME, '.ldm');
@@ -199,9 +200,10 @@ function safeDeployDir(repoPath, destDir, name) {
     }
     renameSync(tempPath, finalPath);
 
-    // 5. Clean up backup
+    // 5. Trash the old version (never delete)
     if (existsSync(backupPath)) {
-      rmSync(backupPath, { recursive: true, force: true });
+      const trashed = moveToTrash(backupPath);
+      if (trashed) ok(`Old version moved to ${trashed}`);
     }
 
     return true;

package/lib/safe.mjs

@@ -0,0 +1,113 @@
+/**
+ * lib/safe.mjs
+ * Safe file operations. Never delete. Always trash. Always write revert plans.
+ * Follows the _trash/ pattern from the DevOps Toolkit.
+ * Zero dependencies.
+ */
+
+import { existsSync, mkdirSync, renameSync, writeFileSync, readFileSync, cpSync } from 'node:fs';
+import { join, basename, dirname } from 'node:path';
+
+const HOME = process.env.HOME || '';
+const LDM_ROOT = join(HOME, '.ldm');
+const TRASH_ROOT = join(LDM_ROOT, '_trash');
+
+function readJSON(path) {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+// ── Trash ──
+
+/**
+ * Move a file or directory to ~/.ldm/_trash/YYYY-MM-DD/ instead of deleting.
+ * Returns the trash destination path, or null if source didn't exist.
+ */
+export function moveToTrash(sourcePath) {
+  if (!existsSync(sourcePath)) return null;
+
+  const date = new Date().toISOString().split('T')[0];
+  const trashDir = join(TRASH_ROOT, date);
+  const name = basename(sourcePath);
+
+  mkdirSync(trashDir, { recursive: true });
+
+  let dest = join(trashDir, name);
+  if (existsSync(dest)) {
+    dest = join(trashDir, `${name}-${Date.now()}`);
+  }
+
+  renameSync(sourcePath, dest);
+  return dest;
+}
+
+// ── Revert Manifests ──
+
+/**
+ * Create a revert manifest before a batch of operations.
+ * Each operation: { action, name, description, originalPath, trashPath }
+ * Returns the manifest file path.
+ */
+export function createRevertManifest(description, operations = []) {
+  const date = new Date().toISOString().split('T')[0];
+  const time = new Date().toISOString().replace(/[:.]/g, '-');
+  const manifestDir = join(TRASH_ROOT, date);
+  const manifestPath = join(manifestDir, `revert-${time}.json`);
+
+  mkdirSync(manifestDir, { recursive: true });
+
+  const manifest = {
+    timestamp: new Date().toISOString(),
+    description,
+    operations,
+    howToRevert: 'For each operation with a trashPath, move it back to originalPath.',
+  };
+
+  writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
+  return manifestPath;
+}
+
+/**
+ * Append a completed operation to an existing revert manifest.
+ */
+export function appendToManifest(manifestPath, operation) {
+  if (!existsSync(manifestPath)) return;
+
+  try {
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+    manifest.operations.push(operation);
+    writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
+  } catch {}
+}
+
+// ── Safe copy (backup before overwrite) ──
+
+/**
+ * Copy a directory, but if the destination already exists, trash it first.
+ * Returns { trashPath, destPath } or null on failure.
+ */
+export function safeCopy(srcPath, destPath) {
+  let trashPath = null;
+
+  if (existsSync(destPath)) {
+    trashPath = moveToTrash(destPath);
+  }
+
+  try {
+    mkdirSync(dirname(destPath), { recursive: true });
+    cpSync(srcPath, destPath, {
+      recursive: true,
+      filter: (s) => !s.includes('.git') && !s.includes('node_modules') && !s.includes('/ai/'),
+    });
+    return { trashPath, destPath };
+  } catch (e) {
+    // Rollback: restore from trash if copy failed
+    if (trashPath && existsSync(trashPath) && !existsSync(destPath)) {
+      try { renameSync(trashPath, destPath); } catch {}
+    }
+    throw e;
+  }
+}

package/lib/state.mjs

@@ -0,0 +1,306 @@
+/**
+ * lib/state.mjs
+ * System state detection and reconciliation.
+ * Scans the actual system (MCP servers, extensions, CLIs) to find what's
+ * really installed, regardless of what the LDM registry thinks.
+ * Zero dependencies.
+ */
+
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join, basename } from 'node:path';
+import { execSync } from 'node:child_process';
+
+const HOME = process.env.HOME || '';
+const LDM_ROOT = join(HOME, '.ldm');
+const LDM_EXTENSIONS = join(LDM_ROOT, 'extensions');
+const OC_ROOT = join(HOME, '.openclaw');
+const OC_EXTENSIONS = join(OC_ROOT, 'extensions');
+const CC_USER_PATH = join(HOME, '.claude.json');
+const REGISTRY_PATH = join(LDM_EXTENSIONS, 'registry.json');
+
+function readJSON(path) {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+// ── Scanners ──
+
+function detectMCPServers() {
+  const ccUser = readJSON(CC_USER_PATH);
+  const servers = {};
+  if (!ccUser?.mcpServers) return servers;
+
+  for (const [name, config] of Object.entries(ccUser.mcpServers)) {
+    const args = config.args || [];
+    servers[name] = {
+      name,
+      command: config.command,
+      args,
+      path: args[0] || null,
+      env: config.env || {},
+    };
+  }
+  return servers;
+}
+
+function scanExtensionDir(dir) {
+  const extensions = {};
+  if (!existsSync(dir)) return extensions;
+
+  try {
+    const entries = readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.name === 'registry.json') continue;
+      if (entry.name.startsWith('.') || entry.name.startsWith('_')) continue;
+      if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
+
+      const dirPath = join(dir, entry.name);
+      const pkg = readJSON(join(dirPath, 'package.json'));
+      const plugin = readJSON(join(dirPath, 'openclaw.plugin.json'));
+
+      extensions[entry.name] = {
+        name: entry.name,
+        path: dirPath,
+        version: pkg?.version || null,
+        packageName: pkg?.name || null,
+        pluginId: plugin?.id || null,
+        hasPackageJson: !!pkg,
+        hasPluginJson: !!plugin,
+        hasMcpServer: existsSync(join(dirPath, 'mcp-server.mjs'))
+                      || existsSync(join(dirPath, 'mcp-server.js'))
+                      || existsSync(join(dirPath, 'dist', 'mcp-server.js')),
+        hasSkill: existsSync(join(dirPath, 'SKILL.md')),
+        isSymlink: entry.isSymbolicLink(),
+      };
+    }
+  } catch {}
+  return extensions;
+}
+
+function detectCLIBinaries() {
+  const knownBins = [
+    'crystal', 'mdview', 'wip-release', 'wip-repos', 'wip-file-guard',
+    'ldm', 'ldm-scaffold', 'wip-install', 'wip-license',
+  ];
+
+  const binaries = {};
+  for (const bin of knownBins) {
+    try {
+      const path = execSync(`which ${bin} 2>/dev/null`, { encoding: 'utf8' }).trim();
+      if (path) {
+        binaries[bin] = { path };
+        try {
+          const ver = execSync(`${bin} --version 2>/dev/null`, { encoding: 'utf8' }).trim().split('\n')[0];
+          binaries[bin].version = ver;
+        } catch {}
+      }
+    } catch {}
+  }
+  return binaries;
+}
+
+function detectSkills() {
+  const skillsDir = join(OC_ROOT, 'skills');
+  const skills = {};
+  if (!existsSync(skillsDir)) return skills;
+
+  try {
+    const entries = readdirSync(skillsDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const skillPath = join(skillsDir, entry.name, 'SKILL.md');
+      if (existsSync(skillPath)) {
+        skills[entry.name] = { path: skillPath };
+      }
+    }
+  } catch {}
+  return skills;
+}
+
+// ── Main detection ──
+
+export function detectSystemState() {
+  const registry = readJSON(REGISTRY_PATH) || { _format: 'v1', extensions: {} };
+
+  return {
+    mcp: detectMCPServers(),
+    ldmExtensions: scanExtensionDir(LDM_EXTENSIONS),
+    ocExtensions: scanExtensionDir(OC_EXTENSIONS),
+    cliBinaries: detectCLIBinaries(),
+    skills: detectSkills(),
+    registry: registry.extensions || {},
+  };
+}
+
+// ── Reconciliation ──
+
+export function reconcileState(systemState) {
+  const all = new Set();
+
+  // Collect all known names from every source
+  for (const name of Object.keys(systemState.registry)) all.add(name);
+  for (const name of Object.keys(systemState.ldmExtensions)) all.add(name);
+  for (const name of Object.keys(systemState.ocExtensions)) all.add(name);
+  for (const name of Object.keys(systemState.mcp)) all.add(name);
+
+  const reconciled = {};
+
+  for (const name of all) {
+    const reg = systemState.registry[name];
+    const ldm = systemState.ldmExtensions[name];
+    const oc = systemState.ocExtensions[name];
+    const mcp = systemState.mcp[name];
+
+    const entry = {
+      name,
+      // Registry
+      inRegistry: !!reg,
+      registryVersion: reg?.version || null,
+      registrySource: reg?.source || null,
+      registryHasSource: !!(reg?.source && existsSync(reg.source)),
+      registryInterfaces: reg?.interfaces || [],
+      // Deployed
+      deployedLdm: !!ldm,
+      ldmVersion: ldm?.version || null,
+      deployedOc: !!oc,
+      ocVersion: oc?.version || null,
+      // MCP
+      mcpRegistered: !!mcp,
+      mcpPath: mcp?.path || null,
+      // Computed
+      status: 'unknown',
+      issues: [],
+    };
+
+    // ── Determine status ──
+
+    if (entry.inRegistry && entry.deployedLdm && entry.registryHasSource) {
+      entry.status = 'healthy';
+    } else if (entry.inRegistry && (entry.deployedLdm || entry.deployedOc) && !entry.registryHasSource) {
+      // Deployed and registered, but no source repo linked
+      entry.status = 'installed-unlinked';
+      if (!reg?.source) {
+        entry.issues.push('No source repo linked. Run: ldm install <org/repo> to link.');
+      } else {
+        entry.issues.push(`Source not found at: ${reg.source}`);
+      }
+    } else if (entry.inRegistry && !entry.deployedLdm && !entry.deployedOc) {
+      entry.status = 'registered-missing';
+      entry.issues.push('In registry but not deployed anywhere.');
+    } else if (!entry.inRegistry && (entry.deployedLdm || entry.deployedOc)) {
+      entry.status = 'deployed-unregistered';
+      entry.issues.push('Deployed but not in LDM registry.');
+    } else if (!entry.inRegistry && !entry.deployedLdm && !entry.deployedOc && entry.mcpRegistered) {
+      entry.status = 'mcp-only';
+      entry.issues.push('MCP server registered but not managed by LDM.');
+    }
+
+    // Version mismatches
+    if (entry.ldmVersion && entry.ocVersion && entry.ldmVersion !== entry.ocVersion) {
+      entry.issues.push(`Version mismatch: LDM v${entry.ldmVersion} vs OC v${entry.ocVersion}`);
+    }
+    if (entry.registryVersion && entry.ldmVersion && entry.registryVersion !== entry.ldmVersion) {
+      entry.issues.push(`Registry says v${entry.registryVersion} but deployed is v${entry.ldmVersion}`);
+    }
+
+    // MCP path sanity
+    if (entry.mcpRegistered && entry.deployedLdm && entry.mcpPath) {
+      const expectedBase = join(LDM_EXTENSIONS, name);
+      if (!entry.mcpPath.startsWith(expectedBase)) {
+        entry.issues.push(`MCP path does not match LDM extension location.`);
+      }
+    }
+
+    reconciled[name] = entry;
+  }
+
+  return reconciled;
+}
+
+// ── Display ──
+
+export function formatReconciliation(reconciled, { verbose = false } = {}) {
+  const healthy = [];
+  const unlinked = [];
+  const needsAttention = [];
+  const external = [];
+
+  for (const entry of Object.values(reconciled)) {
+    switch (entry.status) {
+      case 'healthy':
+        healthy.push(entry);
+        break;
+      case 'installed-unlinked':
+        unlinked.push(entry);
+        break;
+      case 'mcp-only':
+      case 'deployed-unregistered':
+        external.push(entry);
+        break;
+      default:
+        needsAttention.push(entry);
+    }
+  }
+
+  const sort = (a, b) => a.name.localeCompare(b.name);
+  const lines = [];
+
+  lines.push('');
+  lines.push('  System State');
+  lines.push('  ────────────────────────────────────');
+
+  if (healthy.length > 0) {
+    lines.push('');
+    lines.push(`  Managed by LDM (${healthy.length}):`);
+    for (const e of healthy.sort(sort)) {
+      const ver = e.ldmVersion || e.registryVersion || '?';
+      const ifaces = e.registryInterfaces.length > 0 ? ` (${e.registryInterfaces.join(', ')})` : '';
+      const mcp = e.mcpRegistered ? ' [MCP]' : '';
+      lines.push(`    [x] ${e.name} v${ver}${ifaces}${mcp}`);
+    }
+  }
+
+  if (unlinked.length > 0) {
+    lines.push('');
+    lines.push(`  Installed, no source repo linked (${unlinked.length}):`);
+    lines.push(`  (These work fine. Link them to enable updates via ldm install.)`);
+    for (const e of unlinked.sort(sort)) {
+      const ver = e.ldmVersion || e.ocVersion || e.registryVersion || '?';
+      const mcp = e.mcpRegistered ? ' [MCP]' : '';
+      lines.push(`    [-] ${e.name} v${ver}${mcp}`);
+      if (verbose) {
+        for (const issue of e.issues) {
+          lines.push(`        ${issue}`);
+        }
+      }
+    }
+  }
+
+  if (external.length > 0) {
+    lines.push('');
+    lines.push(`  Not managed by LDM (${external.length}):`);
+    for (const e of external.sort(sort)) {
+      const ver = e.ldmVersion || e.ocVersion || '?';
+      const detail = e.mcpRegistered ? 'MCP registered' : 'extension deployed';
+      lines.push(`    [ ] ${e.name} v${ver} ... ${detail}`);
+    }
+  }
+
+  if (needsAttention.length > 0) {
+    lines.push('');
+    lines.push(`  Needs attention (${needsAttention.length}):`);
+    for (const e of needsAttention.sort(sort)) {
+      const ver = e.ldmVersion || e.ocVersion || e.registryVersion || '?';
+      lines.push(`    [!] ${e.name} v${ver} ... ${e.status}`);
+      for (const issue of e.issues) {
+        lines.push(`        ${issue}`);
+      }
+    }
+  }
+
+  lines.push('');
+  return lines.join('\n');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-ldm-os",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "type": "module",
   "description": "LDM OS: identity, memory, and sovereignty infrastructure for AI agents",
   "main": "src/boot/boot-hook.mjs",