@wipcomputer/wip-ldm-os 0.4.2 → 0.4.4

package/README.md

@@ -103,7 +103,7 @@ The OS connects your AIs. Add-ons are what they actually use. Each one is a full
 
 ## More Info
 
-- [Architecture, principles, and technical details](docs/universal-installer/TECHNICAL.md)
+- [Architecture, principles, and technical details](TECHNICAL.md)
 
 ## License
 

package/SKILL.md

@@ -5,7 +5,7 @@ license: MIT
 interface: [cli, skill]
 metadata:
   display-name: "LDM OS"
-  version: "0.4.2"
+  version: "0.4.4"
   homepage: "https://github.com/wipcomputer/wip-ldm-os"
   author: "Parker Todd Brooks"
   category: infrastructure

package/bin/ldm.js

@@ -17,7 +17,7 @@
  *   ldm --version         Show version
  */
 
-import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, cpSync, chmodSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, cpSync, chmodSync, unlinkSync } from 'node:fs';
 import { join, basename, resolve, dirname } from 'node:path';
 import { execSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
@@ -58,6 +58,38 @@ if (existsSync(VERSION_PATH)) {
   } catch {}
 }
 
+// ── Install lockfile (#57) ──
+
+const LOCK_PATH = join(LDM_ROOT, 'state', '.ldm-install.lock');
+
+function acquireInstallLock() {
+  try {
+    if (existsSync(LOCK_PATH)) {
+      const lock = JSON.parse(readFileSync(LOCK_PATH, 'utf8'));
+      // Check if PID is still alive
+      try {
+        process.kill(lock.pid, 0); // signal 0 = just check if alive
+        console.log(`  Another ldm install is running (PID ${lock.pid}, started ${lock.started}).`);
+        console.log(`  Wait for it to finish, or remove ~/.ldm/state/.ldm-install.lock`);
+        return false;
+      } catch {
+        // PID is dead, stale lock. Clean it up.
+      }
+    }
+    mkdirSync(dirname(LOCK_PATH), { recursive: true });
+    writeFileSync(LOCK_PATH, JSON.stringify({ pid: process.pid, started: new Date().toISOString() }));
+
+    // Clean up on exit
+    const cleanup = () => { try { if (existsSync(LOCK_PATH)) { const l = JSON.parse(readFileSync(LOCK_PATH, 'utf8')); if (l.pid === process.pid) unlinkSync(LOCK_PATH); } } catch {} };
+    process.on('exit', cleanup);
+    process.on('SIGINT', () => { cleanup(); process.exit(1); });
+    process.on('SIGTERM', () => { cleanup(); process.exit(1); });
+    return true;
+  } catch {
+    return true; // if lock fails, allow install anyway
+  }
+}
+
 const args = process.argv.slice(2);
 const command = args[0];
 const DRY_RUN = args.includes('--dry-run');
@@ -371,6 +403,8 @@ async function showCatalogPicker() {
 // ── ldm install ──
 
 async function cmdInstall() {
+  if (!DRY_RUN && !acquireInstallLock()) return;
+
   // Ensure LDM is initialized
   if (!existsSync(VERSION_PATH)) {
     console.log('  LDM OS not initialized. Running init first...');
@@ -522,7 +556,7 @@ function autoDetectExtensions() {
     const dirs = readdirSync(LDM_EXTENSIONS, { withFileTypes: true });
     for (const dir of dirs) {
       if (!dir.isDirectory()) continue;
-      if (dir.name === '_trash' || dir.name.startsWith('.')) continue;
+      if (dir.name === '_trash' || dir.name.startsWith('.') || dir.name.startsWith('ldm-install-')) continue;
 
       const extPath = join(LDM_EXTENSIONS, dir.name);
       const pkgPath = join(extPath, 'package.json');
@@ -561,6 +595,8 @@ function autoDetectExtensions() {
 // ── ldm install (bare): scan system, show real state, update if needed ──
 
 async function cmdInstallCatalog() {
+  if (!DRY_RUN && !acquireInstallLock()) return;
+
   autoDetectExtensions();
 
   const { detectSystemState, reconcileState, formatReconciliation } = await import('../lib/state.mjs');
@@ -603,14 +639,57 @@ async function cmdInstallCatalog() {
     console.log('');
   }
 
-  if (DRY_RUN) {
-    // Show what an update would do
-    const updatable = Object.values(reconciled).filter(e =>
-      e.registryHasSource
-    );
+  // Build the update plan: check ALL installed extensions against npm (#55)
+  const npmUpdates = [];
+
+  // Check every installed extension against npm via catalog
+  console.log('  Checking npm for updates...');
+  for (const [name, entry] of Object.entries(reconciled)) {
+    if (!entry.deployedLdm && !entry.deployedOc) continue; // not installed
+
+    // Get npm package name from the installed extension's own package.json
+    const extPkgPath = join(LDM_EXTENSIONS, name, 'package.json');
+    const extPkg = readJSON(extPkgPath);
+    const npmPkg = extPkg?.name;
+    if (!npmPkg || !npmPkg.startsWith('@')) continue; // skip unscoped packages
+
+    // Find catalog entry for the repo URL (used for clone if update needed)
+    const catalogEntry = components.find(c => {
+      const matches = c.registryMatches || [c.id];
+      return matches.includes(name) || c.id === name;
+    });
+
+    const currentVersion = entry.ldmVersion || entry.ocVersion;
+    if (!currentVersion) continue;
+
+    try {
+      const latestVersion = execSync(`npm view ${npmPkg} version 2>/dev/null`, {
+        encoding: 'utf8', timeout: 10000,
+      }).trim();
+
+      if (latestVersion && latestVersion !== currentVersion) {
+        npmUpdates.push({
+          ...entry,
+          catalogRepo: catalogEntry?.repo || null,
+          catalogNpm: npmPkg,
+          currentVersion,
+          latestVersion,
+          hasUpdate: true,
+        });
+      }
+    } catch {}
+  }
 
-    if (updatable.length > 0) {
-      console.log(`  Would update ${updatable.length} extension(s) from source repos.`);
+  const totalUpdates = npmUpdates.length;
+
+  if (DRY_RUN) {
+    if (npmUpdates.length > 0) {
+      console.log(`  Would update ${npmUpdates.length} extension(s) from npm:`);
+      for (const e of npmUpdates) {
+        console.log(`    ${e.name}: v${e.currentVersion} -> v${e.latestVersion} (${e.catalogNpm})`);
+      }
+    }
+    if (totalUpdates > 0) {
       console.log('  No data (crystal.db, agent files) would be touched.');
       console.log('  Old versions would be moved to ~/.ldm/_trash/ (never deleted).');
     } else {
@@ -623,18 +702,15 @@ async function cmdInstallCatalog() {
     return;
   }
 
-  // Real update: only touch things with linked source repos
-  const updatable = Object.values(reconciled).filter(e =>
-    e.registryHasSource
-  );
-
-  if (updatable.length === 0) {
-    console.log('  No extensions have linked source repos to update from.');
-    console.log('  Link them with: ldm install <org/repo>');
+  if (totalUpdates === 0 && available.length === 0) {
+    console.log('  Everything is up to date.');
     console.log('');
+    return;
+  }
 
-    // Still offer catalog install if TTY
-    if (available.length > 0 && !YES_FLAG && !NONE_FLAG && process.stdin.isTTY) {
+  if (totalUpdates === 0 && available.length > 0) {
+    // Nothing to update, but catalog items available
+    if (!YES_FLAG && !NONE_FLAG && process.stdin.isTTY) {
       const { createInterface } = await import('node:readline');
       const rl = createInterface({ input: process.stdin, output: process.stdout });
       const answer = await new Promise((resolve) => {
@@ -643,7 +719,6 @@ async function cmdInstallCatalog() {
           resolve(a.trim().toLowerCase());
         });
       });
-
       if (answer && answer !== 'none' && answer !== 'n') {
         let toInstall = [];
         if (answer === 'all' || answer === 'a') {
@@ -668,12 +743,13 @@ async function cmdInstallCatalog() {
   // Write revert manifest before starting
   const { createRevertManifest } = await import('../lib/safe.mjs');
   const manifestPath = createRevertManifest(
-    `ldm install (update ${updatable.length} extensions)`,
-    updatable.map(e => ({
-      action: 'update',
+    `ldm install (update ${totalUpdates} extensions)`,
+    npmUpdates.map(e => ({
+      action: 'update-from-catalog',
       name: e.name,
-      currentVersion: e.ldmVersion || e.registryVersion,
-      source: e.registrySource,
+      currentVersion: e.currentVersion,
+      latestVersion: e.latestVersion,
+      repo: e.catalogRepo,
     }))
   );
   console.log(`  Revert plan saved: ${manifestPath}`);
@@ -683,9 +759,16 @@ async function cmdInstallCatalog() {
   setFlags({ dryRun: DRY_RUN, jsonOutput: JSON_OUTPUT });
 
   let updated = 0;
-  for (const entry of updatable) {
-    await installFromPath(entry.registrySource);
-    updated++;
+
+  // Update from npm via catalog repos (#55)
+  for (const entry of npmUpdates) {
+    console.log(`  Updating ${entry.name} v${entry.currentVersion} -> v${entry.latestVersion} (from ${entry.catalogRepo})...`);
+    try {
+      execSync(`ldm install ${entry.catalogRepo}`, { stdio: 'inherit' });
+      updated++;
+    } catch (e) {
+      console.error(`  x Failed to update ${entry.name}: ${e.message}`);
+    }
   }
 
   // Sync boot hook from npm package (#49)
@@ -694,7 +777,7 @@ async function cmdInstallCatalog() {
   }
 
   console.log('');
-  console.log(`  Updated ${updated}/${updatable.length} extension(s).`);
+  console.log(`  Updated ${updated}/${totalUpdates} extension(s).`);
 
   // Check if CLI itself is outdated (#29)
   checkCliVersion();
@@ -780,6 +863,30 @@ async function cmdDoctor() {
     }
   }
 
+  // --fix: clean registry entries with /tmp/ sources or ldm-install- names (#54)
+  if (FIX_FLAG) {
+    const registry = readJSON(REGISTRY_PATH);
+    if (registry?.extensions) {
+      const staleNames = [];
+      for (const [name, info] of Object.entries(registry.extensions)) {
+        const src = info?.source || '';
+        const isTmpSource = src.startsWith('/tmp/') || src.startsWith('/private/tmp/');
+        const isTmpName = name.startsWith('ldm-install-');
+        if (isTmpSource || isTmpName) {
+          staleNames.push(name);
+        }
+      }
+      for (const name of staleNames) {
+        delete registry.extensions[name];
+        console.log(`  + Removed stale registry entry: ${name} (/tmp/ clone)`);
+        issues = Math.max(0, issues - 1);
+      }
+      if (staleNames.length > 0) {
+        writeFileSync(REGISTRY_PATH, JSON.stringify(registry, null, 2) + '\n');
+      }
+    }
+  }
+
   // 4. Check sacred locations
   const sacred = [
     { path: join(LDM_ROOT, 'memory'), label: 'memory/' },

package/docs/skills/README.md

@@ -79,4 +79,4 @@ Your AIs are only as powerful as what you give them. Here's everything available
 
 ---
 
-[Technical Reference](./TECHNICAL.md)
+[Technical Reference](../universal-installer/TECHNICAL.md)

package/docs/universal-installer/TECHNICAL.md

@@ -243,6 +243,49 @@ The `ai/` folder is the development process. It is not part of the published pro
 
 **Public/private split:** If a repo is public, the `ai/` folder should not ship. The recommended pattern is to maintain a private working repo (with `ai/`) and a public repo (everything except `ai/`). The public repo has everything an LLM or human needs to understand and use the tool. The `ai/` folder is operational context for the team building it.
 
+## Catalog
+
+Skills are defined in `catalog.json` at the LDM OS root. Each entry has:
+
+```json
+{
+  "id": "memory-crystal",
+  "name": "Memory Crystal",
+  "description": "Persistent memory for your AI.",
+  "npm": "@wipcomputer/memory-crystal",
+  "repo": "wipcomputer/memory-crystal",
+  "registryMatches": ["memory-crystal"],
+  "cliMatches": ["crystal"],
+  "recommended": true,
+  "status": "stable"
+}
+```
+
+## Stacks
+
+Stacks group skills for team installs. Defined in `catalog.json`:
+
+```json
+{
+  "stacks": {
+    "core": {
+      "name": "WIP Core",
+      "components": ["memory-crystal", "wip-ai-devops-toolbox", "wip-1password", "wip-markdown-viewer"],
+      "mcpServers": []
+    },
+    "web": {
+      "name": "Web Development",
+      "components": [],
+      "mcpServers": [
+        { "name": "playwright", "command": "npx", "args": ["-y", "@playwright/mcp@latest"] }
+      ]
+    }
+  }
+}
+```
+
+Stacks are composable via the `includes` field.
+
 ## The Installer
 
 `ldm install` scans any repo, detects which interfaces exist, and installs them all. One command.

package/lib/deploy.mjs

@@ -682,10 +682,18 @@ export function installSingleTool(toolPath) {
   }
 
   let installed = 0;
+  // Don't store /tmp/ clone paths as source (#54). Use the repo URL from package.json if available.
+  let source = toolPath;
+  const isTmpPath = toolPath.startsWith('/tmp/') || toolPath.startsWith('/private/tmp/');
+  if (isTmpPath && pkg?.repository?.url) {
+    source = pkg.repository.url.replace(/^git\+/, '').replace(/\.git$/, '');
+  } else if (isTmpPath) {
+    source = null; // better than a /tmp/ path
+  }
   const registryInfo = {
     name: toolName,
     version: pkg?.version || 'unknown',
-    source: toolPath,
+    source,
     interfaces: ifaceNames,
   };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-ldm-os",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "type": "module",
   "description": "LDM OS: identity, memory, and sovereignty infrastructure for AI agents",
   "main": "src/boot/boot-hook.mjs",

package/docs/skills/TECHNICAL.md

@@ -1,67 +0,0 @@
-# Skills ... Technical Reference
-
-## Catalog
-
-Skills are defined in `catalog.json` at the LDM OS root. Each entry has:
-
-```json
-{
-  "id": "memory-crystal",
-  "name": "Memory Crystal",
-  "description": "Persistent memory for your AI.",
-  "npm": "@wipcomputer/memory-crystal",
-  "repo": "wipcomputer/memory-crystal",
-  "registryMatches": ["memory-crystal"],
-  "cliMatches": ["crystal"],
-  "recommended": true,
-  "status": "stable"
-}
-```
-
-## Stacks
-
-Stacks group skills for team installs. Defined in `catalog.json`:
-
-```json
-{
-  "stacks": {
-    "core": {
-      "name": "WIP Core",
-      "components": ["memory-crystal", "wip-ai-devops-toolbox", "wip-1password", "wip-markdown-viewer"],
-      "mcpServers": []
-    },
-    "web": {
-      "name": "Web Development",
-      "components": [],
-      "mcpServers": [
-        { "name": "playwright", "command": "npx", "args": ["-y", "@playwright/mcp@latest"] }
-      ]
-    }
-  }
-}
-```
-
-Stacks are composable via the `includes` field.
-
-## Interface Detection
-
-`ldm install` auto-detects which interfaces a repo supports:
-
-| Pattern | Interface | Install Action |
-|---------|-----------|---------------|
-| `package.json` with `bin` | CLI | `npm install -g` from registry |
-| `main` or `exports` | Module | Reports import path |
-| `mcp-server.mjs` | MCP | `claude mcp add --scope user` |
-| `openclaw.plugin.json` | OpenClaw Plugin | Deploy to `~/.ldm/extensions/` + `~/.openclaw/extensions/` |
-| `SKILL.md` | Skill | Deploy to `~/.openclaw/skills/` |
-| `guard.mjs` or `claudeCode.hook` | CC Hook | Add to `~/.claude/settings.json` |
-| `.claude-plugin/plugin.json` | CC Plugin | Register with marketplace |
-
-## Key Files
-
-| File | What |
-|------|------|
-| `catalog.json` | Component + stack definitions |
-| `lib/detect.mjs` | Interface detection engine |
-| `lib/deploy.mjs` | Deployment engine |
-| `bin/ldm.js` | `ldm stack` and `ldm install` commands |