@wipcomputer/wip-ldm-os 0.4.69 → 0.4.71

package/SKILL.md

@@ -9,7 +9,7 @@ license: MIT
 compatibility: Requires git, npm, node. Node.js 18+.
 metadata:
   display-name: "LDM OS"
-  version: "0.4.69"
+  version: "0.4.71"
   homepage: "https://github.com/wipcomputer/wip-ldm-os"
   author: "Parker Todd Brooks"
   category: infrastructure

package/bin/ldm.js

@@ -53,11 +53,16 @@ try {
   PKG_VERSION = JSON.parse(readFileSync(pkgPath, 'utf8')).version;
 } catch {}
 
-// Read catalog
-const catalogPath = join(__dirname, '..', 'catalog.json');
+// Read catalog: prefer ~/.ldm/catalog.json (user-editable), fall back to npm package (#262)
+const localCatalogPath = join(LDM_ROOT, 'catalog.json');
+const packageCatalogPath = join(__dirname, '..', 'catalog.json');
 let CATALOG = { components: [] };
 try {
-  CATALOG = JSON.parse(readFileSync(catalogPath, 'utf8'));
+  if (existsSync(localCatalogPath)) {
+    CATALOG = JSON.parse(readFileSync(localCatalogPath, 'utf8'));
+  } else {
+    CATALOG = JSON.parse(readFileSync(packageCatalogPath, 'utf8'));
+  }
 } catch {}
 
 // Auto-sync version.json when CLI version drifts (#33)
@@ -320,6 +325,19 @@ function loadCatalog() {
   return CATALOG.components || [];
 }
 
+// Seed ~/.ldm/catalog.json from the npm package if it doesn't exist (#262)
+function seedLocalCatalog() {
+  if (existsSync(localCatalogPath)) return false;
+  try {
+    const pkgCatalog = readFileSync(packageCatalogPath, 'utf8');
+    mkdirSync(LDM_ROOT, { recursive: true });
+    writeFileSync(localCatalogPath, pkgCatalog);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function findInCatalog(id) {
   const q = id.toLowerCase();
   // Strip org/ prefix for matching (e.g. "wipcomputer/openclaw-tavily" -> "openclaw-tavily")
@@ -357,7 +375,8 @@ function findInCatalog(id) {
 // Replaces the old execSync('ldm install ${c.repo}') which spawned
 // a full installer process for each component.
 async function installCatalogComponent(c) {
-  const { installFromPath } = await import('../lib/deploy.mjs');
+  const { installFromPath, setFlags: setDeployFlags } = await import('../lib/deploy.mjs');
+  setDeployFlags({ dryRun: DRY_RUN, jsonOutput: JSON_OUTPUT, origin: 'catalog' }); // #262
   const repoTarget = c.repo;
   const repoName = basename(repoTarget);
   const repoPath = join(LDM_TMP, repoName);
@@ -653,10 +672,15 @@ async function cmdInit() {
 
   // Seed registry if missing
   if (!existsSync(REGISTRY_PATH)) {
-    writeJSON(REGISTRY_PATH, { _format: 'v1', extensions: {} });
+    writeJSON(REGISTRY_PATH, { _format: 'v2', extensions: {} });
     console.log(`  + registry.json created`);
   }
 
+  // Seed local catalog from npm package (#262)
+  if (seedLocalCatalog()) {
+    console.log(`  + catalog.json seeded to ~/.ldm/catalog.json`);
+  }
+
   // Install global git pre-commit hook (blocks commits on main)
   const hooksDir = join(LDM_ROOT, 'hooks');
   const preCommitDest = join(hooksDir, 'pre-commit');
@@ -1064,7 +1088,7 @@ async function cmdInstall() {
   // Refresh harness detection (catches newly installed harnesses)
   detectHarnesses();
 
-  setFlags({ dryRun: DRY_RUN, jsonOutput: JSON_OUTPUT });
+  setFlags({ dryRun: DRY_RUN, jsonOutput: JSON_OUTPUT, origin: 'manual' });
 
   // --help flag (#81)
   if (args.includes('--help') || args.includes('-h')) {
@@ -1108,6 +1132,7 @@ async function cmdInstall() {
   // Check if target is a catalog ID (e.g. "memory-crystal")
   const catalogEntry = findInCatalog(resolvedTarget);
   if (catalogEntry) {
+    setFlags({ dryRun: DRY_RUN, jsonOutput: JSON_OUTPUT, origin: 'catalog' }); // #262
     console.log('');
     console.log(`  Resolved "${target}" via catalog to ${catalogEntry.repo}`);
 
@@ -1234,6 +1259,98 @@ async function cmdInstall() {
   }
 }
 
+// ── Registry migration (#262) ──
+// Upgrades old v1 registry entries to v2 format with source info.
+// Runs once per install. Idempotent: entries that already have source are skipped.
+
+function migrateRegistry() {
+  const registry = readJSON(REGISTRY_PATH);
+  if (!registry?.extensions) return 0;
+
+  const components = loadCatalog();
+  let migrated = 0;
+
+  for (const [name, entry] of Object.entries(registry.extensions)) {
+    // Skip entries that have already been migrated to v2 format.
+    // An entry is fully migrated if it has: installed (object), paths, origin,
+    // and source is either structured (object with type) or explicitly null.
+    const hasV2Installed = entry.installed && typeof entry.installed === 'object' && entry.installed.version;
+    const sourceIsResolved = entry.source === null || (typeof entry.source === 'object' && entry.source?.type);
+    if (hasV2Installed && entry.paths && entry.origin && sourceIsResolved) continue;
+
+    const newSource = { type: 'github' };
+    let hasSource = false;
+
+    // Try 1: match against catalog for source info
+    const catalogMatch = components.find(c => {
+      const matches = c.registryMatches || [c.id];
+      return matches.includes(name) || c.id === name;
+    });
+    if (catalogMatch) {
+      if (catalogMatch.repo) { newSource.repo = catalogMatch.repo; hasSource = true; }
+      if (catalogMatch.npm) { newSource.npm = catalogMatch.npm; hasSource = true; }
+      if (!entry.origin) entry.origin = 'catalog';
+    }
+
+    // Try 2: read from the installed extension's package.json repository field
+    if (!hasSource || !newSource.repo) {
+      const extPkgPath = join(LDM_EXTENSIONS, name, 'package.json');
+      const extPkg = readJSON(extPkgPath);
+      if (extPkg?.name && !newSource.npm) {
+        newSource.npm = extPkg.name;
+        hasSource = true;
+      }
+      if (extPkg?.repository) {
+        const raw = typeof extPkg.repository === 'string'
+          ? extPkg.repository
+          : extPkg.repository.url || '';
+        const ghMatch = raw.match(/github\.com[:/]([^/]+\/[^/.]+)/);
+        if (ghMatch) {
+          newSource.repo = ghMatch[1].replace(/\.git$/, '');
+          hasSource = true;
+        }
+      }
+    }
+
+    if (hasSource) {
+      entry.source = newSource;
+    } else if (typeof entry.source === 'string') {
+      // Legacy string source (path or URL). Clear it since we couldn't build structured source.
+      entry.source = null;
+    }
+
+    // Migrate flat version to installed block
+    if (!entry.installed || typeof entry.installed !== 'object') {
+      entry.installed = {
+        version: entry.version || 'unknown',
+        installedAt: entry.updatedAt || new Date().toISOString(),
+        updatedAt: entry.updatedAt || new Date().toISOString(),
+      };
+    }
+
+    // Migrate flat paths to paths block
+    if (!entry.paths) {
+      entry.paths = {};
+      if (entry.ldmPath) entry.paths.ldm = entry.ldmPath;
+      if (entry.ocPath) entry.paths.openclaw = entry.ocPath;
+    }
+
+    // Set origin if missing
+    if (!entry.origin) {
+      entry.origin = 'manual';
+    }
+
+    migrated++;
+  }
+
+  if (migrated > 0) {
+    registry._format = 'v2';
+    writeJSON(REGISTRY_PATH, registry);
+  }
+
+  return migrated;
+}
+
 // ── Auto-detect unregistered extensions ──
 
 function autoDetectExtensions() {
@@ -1318,6 +1435,17 @@ async function cmdInstallCatalog() {
 
   autoDetectExtensions();
 
+  // Migrate old registry entries to v2 format (#262)
+  const migrated = migrateRegistry();
+  if (migrated > 0) {
+    console.log(`  + Migrated ${migrated} registry entries to v2 format (source info added)`);
+  }
+
+  // Seed local catalog if missing (#262)
+  if (seedLocalCatalog()) {
+    console.log(`  + catalog.json seeded to ~/.ldm/catalog.json`);
+  }
+
   // Deploy bridge files after self-update or on every catalog install (#245, #251)
   // After npm install -g, the new bridge files are in the npm package but not
   // in the extension directories. This copies them to both LDM and OpenClaw targets.
@@ -1528,7 +1656,9 @@ async function cmdInstallCatalog() {
     console.log('');
   }
 
-  // Build the update plan: check ALL installed extensions against npm (#55)
+  // Build the update plan from REGISTRY entries (#262)
+  // The registry is the source of truth. Each entry has source info (npm, repo)
+  // that tells us where to check for updates.
   const npmUpdates = [];
 
   // Check CLI self-update (#132)
@@ -1548,59 +1678,104 @@ async function cmdInstallCatalog() {
     }
   } catch {}
 
-  // Check every installed extension against npm via catalog
-  console.log('  Checking npm for updates...');
-  for (const [name, entry] of Object.entries(reconciled)) {
-    if (!entry.deployedLdm && !entry.deployedOc) continue; // not installed
+  // Check every registered extension for updates (#262)
+  // Source of truth: registry entry's source.npm and source.repo fields.
+  // Fallback: extension's package.json (for old entries without source info).
+  console.log('  Checking for updates...');
+  const registryEntries = Object.entries(registry?.extensions || {});
+  const checkedNames = new Set(); // track what we've checked
 
-    // Get npm package name from the installed extension's own package.json
-    const extPkgPath = join(LDM_EXTENSIONS, name, 'package.json');
-    const extPkg = readJSON(extPkgPath);
-    const npmPkg = extPkg?.name;
-    if (!npmPkg) continue; // no package name, skip
+  for (const [name, regEntry] of registryEntries) {
+    // Skip entries with no installed version
+    const currentVersion = regEntry?.installed?.version || regEntry?.version;
+    if (!currentVersion) continue;
 
-    // Find catalog entry for the repo URL (used for clone if update needed)
+    // Skip pinned components (e.g. OpenClaw)
     const catalogEntry = components.find(c => {
       const matches = c.registryMatches || [c.id];
       return matches.includes(name) || c.id === name;
     });
-
-    // Skip pinned components (e.g. OpenClaw). Upgrades must be explicit.
     if (catalogEntry?.pinned) continue;
 
-    // Fallback: use repository.url from extension's package.json (#82)
-    let repoUrl = catalogEntry?.repo || null;
-    if (!repoUrl && extPkg?.repository) {
-      const raw = typeof extPkg.repository === 'string'
-        ? extPkg.repository
-        : extPkg.repository.url || '';
-      const ghMatch = raw.match(/github\.com[:/]([^/]+\/[^/.]+)/);
-      if (ghMatch) repoUrl = ghMatch[1];
+    // Get npm package name from registry source (v2) or extension's package.json (legacy)
+    const sourceNpm = regEntry?.source?.npm;
+    const sourceRepo = regEntry?.source?.repo;
+    let npmPkg = sourceNpm || null;
+
+    // Fallback: read from installed extension's package.json
+    if (!npmPkg) {
+      const extPkgPath = join(LDM_EXTENSIONS, name, 'package.json');
+      const extPkg = readJSON(extPkgPath);
+      npmPkg = extPkg?.name || null;
     }
 
-    const currentVersion = entry.ldmVersion || entry.ocVersion;
-    if (!currentVersion) continue;
+    // Determine repo URL for cloning updates
+    let repoUrl = sourceRepo || catalogEntry?.repo || null;
+    if (!repoUrl) {
+      const extPkgPath = join(LDM_EXTENSIONS, name, 'package.json');
+      const extPkg = readJSON(extPkgPath);
+      if (extPkg?.repository) {
+        const raw = typeof extPkg.repository === 'string'
+          ? extPkg.repository
+          : extPkg.repository.url || '';
+        const ghMatch = raw.match(/github\.com[:/]([^/]+\/[^/.]+)/);
+        if (ghMatch) repoUrl = ghMatch[1];
+      }
+    }
 
-    try {
-      const latestVersion = execSync(`npm view ${npmPkg} version 2>/dev/null`, {
-        encoding: 'utf8', timeout: 10000,
-      }).trim();
+    // Check npm for updates (fast, one HTTP call)
+    if (npmPkg) {
+      try {
+        const latestVersion = execSync(`npm view ${npmPkg} version 2>/dev/null`, {
+          encoding: 'utf8', timeout: 10000,
+        }).trim();
 
-      if (latestVersion && latestVersion !== currentVersion) {
-        npmUpdates.push({
-          ...entry,
-          catalogRepo: repoUrl,
-          catalogNpm: npmPkg,
-          currentVersion,
-          latestVersion,
-          hasUpdate: true,
+        if (latestVersion && latestVersion !== currentVersion) {
+          npmUpdates.push({
+            name,
+            catalogRepo: repoUrl,
+            catalogNpm: npmPkg,
+            currentVersion,
+            latestVersion,
+            hasUpdate: true,
+          });
+        }
+      } catch {}
+      checkedNames.add(name);
+      continue;
+    }
+
+    // No npm package. Check GitHub tags via git ls-remote (#262).
+    // Works for private repos with SSH access.
+    if (repoUrl) {
+      try {
+        const sshUrl = `git@github.com:${repoUrl}.git`;
+        const tags = execSync(`git ls-remote --tags --sort=-v:refname "${sshUrl}" 2>/dev/null`, {
+          encoding: 'utf8', timeout: 15000,
         });
-      }
-    } catch {}
+        // Parse latest semver tag
+        const tagMatch = tags.match(/refs\/tags\/v?(\d+\.\d+\.\d+)/);
+        if (tagMatch) {
+          const latestVersion = tagMatch[1];
+          if (latestVersion !== currentVersion) {
+            npmUpdates.push({
+              name,
+              catalogRepo: repoUrl,
+              catalogNpm: repoUrl, // display repo URL since no npm package
+              currentVersion,
+              latestVersion,
+              hasUpdate: true,
+            });
+          }
+        }
+      } catch {}
+      checkedNames.add(name);
+    }
   }
 
-  // Check global CLIs not tracked by extension loop (#81)
+  // Check global CLIs not tracked by registry (#81)
   for (const [binName, binInfo] of Object.entries(state.cliBinaries || {})) {
+    if (checkedNames.has(binName)) continue;
     const catalogComp = components.find(c =>
       (c.cliMatches || []).includes(binName)
     );
@@ -1635,18 +1810,17 @@ async function cmdInstallCatalog() {
   // Check parent packages for toolbox-style repos (#132)
   // If sub-tools are installed but the parent npm package has a newer version,
   // report the parent as needing an update (not the individual sub-tool).
-  // Don't skip packages already found by the extension loop. The parent check
-  // REPLACES sub-tool entries with the parent name.
   const checkedParentNpm = new Set();
   for (const comp of components) {
     if (!comp.npm || checkedParentNpm.has(comp.npm)) continue;
     if (!comp.registryMatches || comp.registryMatches.length === 0) continue;
 
     // If any registryMatch is installed, check the parent package
-    const installedMatch = comp.registryMatches.find(m => reconciled[m]);
+    const installedMatch = comp.registryMatches.find(m => registry?.extensions?.[m]);
     if (!installedMatch) continue;
 
-    const currentVersion = reconciled[installedMatch]?.ldmVersion || reconciled[installedMatch]?.ocVersion || '?';
+    const matchEntry = registry.extensions[installedMatch];
+    const currentVersion = matchEntry?.installed?.version || matchEntry?.version || '?';
 
     try {
       const latest = execSync(`npm view ${comp.npm} version 2>/dev/null`, {
@@ -1654,8 +1828,6 @@ async function cmdInstallCatalog() {
       }).trim();
       if (latest && latest !== currentVersion) {
         // Remove any sub-tool entries that belong to this parent.
-        // Match by name in registryMatches (sub-tools have their own npm names,
-        // not the parent's, so catalogNpm comparison doesn't work).
         const parentMatches = new Set(comp.registryMatches || []);
         for (let i = npmUpdates.length - 1; i >= 0; i--) {
           if (!npmUpdates[i].isCLI && parentMatches.has(npmUpdates[i].name)) {
@@ -1841,7 +2013,7 @@ async function cmdInstallCatalog() {
   const manifestPath = createRevertManifest(
     `ldm install (update ${totalUpdates} extensions)`,
     npmUpdates.map(e => ({
-      action: 'update-from-catalog',
+      action: 'update-from-registry',
       name: e.name,
       currentVersion: e.currentVersion,
       latestVersion: e.latestVersion,
@@ -1852,11 +2024,11 @@ async function cmdInstallCatalog() {
   console.log('');
 
   const { setFlags, installFromPath } = await import('../lib/deploy.mjs');
-  setFlags({ dryRun: DRY_RUN, jsonOutput: JSON_OUTPUT });
+  setFlags({ dryRun: DRY_RUN, jsonOutput: JSON_OUTPUT, origin: 'catalog' }); // #262
 
   let updated = 0;
 
-  // Update from npm via catalog repos (#55) and CLIs (#81)
+  // Update from registry sources (#262, replaces old catalog-based update loop)
   for (const entry of npmUpdates) {
     // CLI self-update is handled by the self-update block at the top of cmdInstallCatalog()
     if (entry.isCLI) continue;
@@ -1882,14 +2054,20 @@ async function cmdInstallCatalog() {
       execSync(`ldm install ${entry.catalogRepo}`, { stdio: 'inherit' });
       updated++;
 
-      // For parent packages, update registry version for all sub-tools (#139)
+      // For parent packages, update registry version for all sub-tools (#139, #262)
       if (entry.isParent && entry.registryMatches) {
         const registry = readJSON(REGISTRY_PATH);
         if (registry?.extensions) {
+          const now = new Date().toISOString();
           for (const subTool of entry.registryMatches) {
             if (registry.extensions[subTool]) {
               registry.extensions[subTool].version = entry.latestVersion;
-              registry.extensions[subTool].updatedAt = new Date().toISOString();
+              registry.extensions[subTool].updatedAt = now;
+              // Also update v2 installed block
+              if (registry.extensions[subTool].installed) {
+                registry.extensions[subTool].installed.version = entry.latestVersion;
+                registry.extensions[subTool].installed.updatedAt = now;
+              }
             }
           }
           writeFileSync(REGISTRY_PATH, JSON.stringify(registry, null, 2));
@@ -2293,14 +2471,18 @@ function cmdStatus() {
     if (latest && latest !== PKG_VERSION) cliUpdate = latest;
   } catch {}
 
-  // Check extensions against npm
+  // Check extensions against npm using registry source info (#262)
   const updates = [];
   for (const [name, info] of Object.entries(registry?.extensions || {})) {
-    const extPkgPath = join(LDM_EXTENSIONS, name, 'package.json');
-    const extPkg = readJSON(extPkgPath);
-    const npmPkg = extPkg?.name;
+    // Use registry source.npm (v2) or fall back to extension's package.json
+    let npmPkg = info?.source?.npm || null;
+    if (!npmPkg) {
+      const extPkgPath = join(LDM_EXTENSIONS, name, 'package.json');
+      const extPkg = readJSON(extPkgPath);
+      npmPkg = extPkg?.name;
+    }
     if (!npmPkg) continue;
-    const currentVersion = extPkg.version || info.version;
+    const currentVersion = info?.installed?.version || info.version;
     if (!currentVersion) continue;
     try {
       const latest = execSync(`npm view ${npmPkg} version 2>/dev/null`, {

package/catalog.json

@@ -301,6 +301,24 @@
       "installs": {
         "ocPlugin": "Web search and content extraction"
       }
+    },
+    {
+      "id": "private-mode",
+      "name": "Private Mode",
+      "description": "Privacy controls for AI agents. Pause memory capture, scan storage, wipe history.",
+      "npm": "private-mode",
+      "repo": "wipcomputer/wip-private-mode-private",
+      "registryMatches": [
+        "private-mode",
+        "wip-private-mode"
+      ],
+      "cliMatches": [],
+      "recommended": false,
+      "status": "stable",
+      "postInstall": null,
+      "installs": {
+        "ocPlugin": "Private mode toggle, memory status indicator, wipe scan/search/execute"
+      }
     }
   ]
 }

package/lib/deploy.mjs

@@ -30,10 +30,12 @@ const REGISTRY_PATH = join(LDM_EXTENSIONS, 'registry.json');
 
 let DRY_RUN = false;
 let JSON_OUTPUT = false;
+let INSTALL_ORIGIN = 'manual'; // #262: tracks how an extension was installed
 
 export function setFlags(opts = {}) {
   DRY_RUN = opts.dryRun || false;
   JSON_OUTPUT = opts.jsonOutput || false;
+  if (opts.origin) INSTALL_ORIGIN = opts.origin;
 }
 
 function log(msg) { if (!JSON_OUTPUT) console.log(`  ${msg}`); }
@@ -164,16 +166,104 @@ function getHarnesses() {
 function updateRegistry(name, info) {
   const registry = loadRegistry();
   const existing = registry.extensions[name];
-  const isCore = CORE_EXTENSIONS.has(name);
+  const now = new Date().toISOString();
+
+  // Build the v2 registry entry (#262)
+  // Merge source info: keep existing source unless new info provides it
+  const existingSource = existing?.source;
+  let newSource = info._source || existingSource || null;
+  // Legacy: info.source was a string (path or URL). Convert to object.
+  if (typeof existingSource === 'string' && !newSource) {
+    newSource = null; // Drop legacy string source, migration will fix it
+  }
+  if (typeof info.source === 'string') {
+    // Legacy caller passing a string. Don't overwrite structured source.
+    if (!newSource || typeof newSource === 'string') newSource = null;
+  }
+
+  // Build paths object from ldmPath/ocPath
+  const paths = existing?.paths || {};
+  if (info.ldmPath) paths.ldm = info.ldmPath;
+  if (info.ocPath) paths.openclaw = info.ocPath;
+  // Backwards compat: also keep flat ldmPath/ocPath
+  const ldmPath = info.ldmPath || existing?.ldmPath || paths.ldm;
+  const ocPath = info.ocPath || existing?.ocPath || paths.openclaw;
+
+  // Build installed block
+  const installed = existing?.installed || {};
+  if (typeof installed === 'object' && installed !== null) {
+    installed.version = info.version || installed.version || existing?.version;
+    if (!installed.installedAt) installed.installedAt = now;
+    installed.updatedAt = now;
+  }
+
+  // Origin: keep existing, or use from info, or default to "manual"
+  const origin = info._origin || existing?.origin || 'manual';
+
   registry.extensions[name] = {
-    ...existing,
-    ...info,
-    enabled: existing?.enabled ?? true,  // New installs are enabled by default. User runs ldm disable to turn off.
-    updatedAt: new Date().toISOString(),
+    // v2 structured fields (#262)
+    source: newSource,
+    installed,
+    paths,
+    interfaces: info.interfaces || existing?.interfaces || [],
+    origin,
+    // Backwards-compatible flat fields (read by existing code)
+    name: info.name || existing?.name || name,
+    version: info.version || existing?.version || 'unknown',
+    ldmPath,
+    ocPath,
+    enabled: existing?.enabled ?? true,
+    updatedAt: now,
   };
   saveRegistry(registry);
 }
 
+/**
+ * Build structured source info from a repo path and package.json (#262).
+ * Returns { type, repo, npm } or null if we can't determine the source.
+ */
+function buildSourceInfo(repoPath, pkg) {
+  const source = { type: 'github' };
+  let hasInfo = false;
+
+  // Extract GitHub repo from package.json repository field
+  if (pkg?.repository) {
+    const raw = typeof pkg.repository === 'string'
+      ? pkg.repository
+      : pkg.repository.url || '';
+    const ghMatch = raw.match(/github\.com[:/]([^/]+\/[^/.]+)/);
+    if (ghMatch) {
+      source.repo = ghMatch[1].replace(/\.git$/, '');
+      hasInfo = true;
+    }
+  }
+
+  // Extract npm package name
+  if (pkg?.name) {
+    source.npm = pkg.name;
+    hasInfo = true;
+  }
+
+  // If the repo path is inside ~/.ldm/tmp/, it was cloned from somewhere.
+  // Try to get the remote URL from git.
+  if (!source.repo) {
+    try {
+      const remote = execSync('git remote get-url origin 2>/dev/null', {
+        cwd: repoPath,
+        encoding: 'utf8',
+        timeout: 5000,
+      }).trim();
+      const ghMatch = remote.match(/github\.com[:/]([^/]+\/[^/.]+)/);
+      if (ghMatch) {
+        source.repo = ghMatch[1].replace(/\.git$/, '');
+        hasInfo = true;
+      }
+    } catch {}
+  }
+
+  return hasInfo ? source : null;
+}
+
 // ── Migration detection ──
 
 function findExistingInstalls(toolName, pkg, ocPluginConfig) {
@@ -240,17 +330,17 @@ function resolveLocalDeps(repoPath) {
     const extDir = join(LDM_EXTENSIONS, name);
     if (existsSync(extDir)) {
       const targetModules = join(repoPath, 'node_modules', name);
-      if (!existsSync(targetModules)) {
-        mkdirSync(join(repoPath, 'node_modules'), { recursive: true });
-        // Handle scoped packages (e.g. @scope/name)
-        const scopeDir = dirname(targetModules);
-        if (scopeDir !== join(repoPath, 'node_modules')) {
-          mkdirSync(scopeDir, { recursive: true });
-        }
-        symlinkSync(extDir, targetModules);
-        log(`Linked local dep: ${name} -> ${extDir}`);
-        resolved++;
+      mkdirSync(join(repoPath, 'node_modules'), { recursive: true });
+      // Handle scoped packages (e.g. @scope/name)
+      const scopeDir = dirname(targetModules);
+      if (scopeDir !== join(repoPath, 'node_modules')) {
+        mkdirSync(scopeDir, { recursive: true });
       }
+      // Remove existing entry (broken symlink or dir from npm) before creating fresh symlink
+      try { rmSync(targetModules, { recursive: true, force: true }); } catch {}
+      symlinkSync(extDir, targetModules);
+      log(`Linked local dep: ${name} -> ${extDir}`);
+      resolved++;
     } else {
       log(`Dep ${name} not installed at ${extDir}, build may fail for this feature`);
     }
@@ -905,18 +995,15 @@ export function installSingleTool(toolPath) {
   }
 
   let installed = 0;
-  // Don't store /tmp/ clone paths as source (#54). Use the repo URL from package.json if available.
-  let source = toolPath;
-  const isTmpPath = toolPath.startsWith('/tmp/') || toolPath.startsWith('/private/tmp/');
-  if (isTmpPath && pkg?.repository?.url) {
-    source = pkg.repository.url.replace(/^git\+/, '').replace(/\.git$/, '');
-  } else if (isTmpPath) {
-    source = null; // better than a /tmp/ path
-  }
+
+  // Build structured source info for registry (#262)
+  const sourceInfo = buildSourceInfo(toolPath, pkg);
   const registryInfo = {
     name: toolName,
     version: pkg?.version || 'unknown',
-    source,
+    source: null, // legacy field, kept for backwards compat
+    _source: sourceInfo,  // v2 structured source, consumed by updateRegistry
+    _origin: INSTALL_ORIGIN, // #262: "catalog", "manual", or "dependency"
     interfaces: ifaceNames,
   };
 
@@ -1140,4 +1227,4 @@ export function disableExtension(name) {
 
 // ── Exports for ldm CLI ──
 
-export { loadRegistry, saveRegistry, updateRegistry, readJSON, writeJSON, runBuildIfNeeded, resolveLocalDeps, CORE_EXTENSIONS };
+export { loadRegistry, saveRegistry, updateRegistry, readJSON, writeJSON, runBuildIfNeeded, resolveLocalDeps, buildSourceInfo, CORE_EXTENSIONS };

package/lib/state.mjs

@@ -160,7 +160,7 @@ export function reconcileState(systemState) {
       inRegistry: !!reg,
       registryVersion: reg?.version || null,
       registrySource: reg?.source || null,
-      registryHasSource: !!(reg?.source && existsSync(reg.source)),
+      registryHasSource: !!(reg?.source && (typeof reg.source === 'string' ? existsSync(reg.source) : !!reg.source.repo)),
       registryInterfaces: reg?.interfaces || [],
       // Deployed
       deployedLdm: !!ldm,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-ldm-os",
-  "version": "0.4.69",
+  "version": "0.4.71",
   "type": "module",
   "description": "LDM OS: identity, memory, and sovereignty infrastructure for AI agents",
   "engines": {