@wipcomputer/wip-ldm-os 0.4.73-alpha.5 → 0.4.73-alpha.7

package/bin/ldm.js

@@ -1321,23 +1321,31 @@ async function cmdInstall() {
 
   // Check if target looks like an npm package (starts with @ or is a plain name without /)
   if (resolvedTarget.startsWith('@') || (!resolvedTarget.includes('/') && !existsSync(resolve(resolvedTarget)))) {
-    // Try npm install to temp dir
+    // Try npm pack + tar extract to temp dir
+    // npm install --prefix silently fails for scoped packages in temp directories...
+    // it creates the lock file but doesn't extract files. npm pack is reliable.
     const npmName = resolvedTarget;
     const tempDir = join(LDM_TMP, `npm-${Date.now()}`);
     console.log('');
     console.log(`  Installing ${npmName} from npm...`);
     try {
       mkdirSync(tempDir, { recursive: true });
-      execSync(`npm install ${npmName} --prefix "${tempDir}"`, { stdio: 'pipe' });
-      // Find the installed package in node_modules (strip @tag suffix like @alpha)
-      const pkgName = npmName.replace(/@(alpha|beta|latest|next|\d[\d.]*[-\w.]*)$/, '');
-      const installed = join(tempDir, 'node_modules', pkgName);
-      if (existsSync(installed)) {
-        console.log(`  + Installed from npm`);
-        repoPath = installed;
+      // Use npm pack + tar instead of npm install --prefix
+      const tarball = execSync(`npm pack ${npmName} --pack-destination "${tempDir}" 2>/dev/null`, {
+        encoding: 'utf8', timeout: 60000, cwd: tempDir,
+      }).trim();
+      const tarPath = join(tempDir, tarball);
+      if (existsSync(tarPath)) {
+        execSync(`tar xzf "${tarPath}" -C "${tempDir}"`, { stdio: 'pipe' });
+        const extracted = join(tempDir, 'package');
+        if (existsSync(extracted)) {
+          console.log(`  + Installed from npm`);
+          repoPath = extracted;
+        } else {
+          console.error(`  x npm pack succeeded but extraction failed`);
+        }
       } else {
-        console.error(`  x Package installed but not found at expected path`);
-        process.exit(1);
+        console.error(`  x npm pack failed: tarball not found`);
       }
     } catch (e) {
       // npm failed, fall through to git clone or path resolution

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-ldm-os",
-  "version": "0.4.73-alpha.5",
+  "version": "0.4.73-alpha.7",
   "type": "module",
   "description": "LDM OS: identity, memory, and sovereignty infrastructure for AI agents",
   "engines": {

package/shared/docs/how-install-works.md.tmpl

@@ -16,11 +16,31 @@ Your AI reads the spec, explains what LDM OS is, checks if it's already installe
 1. **Self-update.** Checks npm for a newer version of itself. Updates first, then re-runs with new code.
 2. **System scan.** Reads `~/.ldm/extensions/`, `~/.openclaw/extensions/`, Claude Code MCP config, CLI binaries on PATH.
 3. **Catalog check.** Matches installed extensions against the catalog. Shows what's available, what's behind.
-4. **npm version check.** Checks every installed extension against npm for newer versions.
-5. **Update.** Clones from GitHub, builds if needed, deploys to extensions dirs, registers MCP/hooks/skills.
+4. **npm version check.** Checks every installed extension against npm for newer versions (uses dist-tags for alpha/beta).
+5. **Update.** Resolves the install source (see Source Resolution below), deploys to extensions dirs, registers MCP/hooks/skills.
 6. **Health check.** Verifies CLIs exist, no broken symlinks, no stale configs.
 7. **Cleanup.** Removes staging dirs, prunes ghost entries from registry.
 
+## Release Tracks
+
+```bash
+ldm install              # stable (npm @latest)
+ldm install --alpha      # alpha track (npm @alpha)
+ldm install --beta       # beta track (npm @beta)
+```
+
+Each track overwrites whatever is installed. Alpha, beta, and stable all use the same install path. The flag only changes which npm dist-tag is checked for updates.
+
+## Source Resolution
+
+When updating, the installer finds the package in priority order:
+
+1. **npm** (when `--alpha` or `--beta`): downloads from npm dist-tag. Works on any machine.
+2. **Local private repo** (developer machine): finds the repo at `~/wipcomputerinc/repos/ldm-os/`. Works offline, no npm or internet needed.
+3. **GitHub clone** (fallback): clones the public repo. Existing behavior.
+
+Alpha/beta installs never require `deploy-public`. Merge to private main, `wip-release alpha`, `ldm install --alpha`, done.
+
 ## Dry Run
 
 Always preview first:

package/shared/docs/how-releases-work.md.tmpl

@@ -1,77 +1,91 @@
 # How Releases Work
 
-## The Pipeline
+## Four Release Tracks
 
-Every release follows these steps. No shortcuts.
+| Track | npm tag | Who | Purpose |
+|-------|---------|-----|---------|
+| **Alpha** | `@alpha` | Developer | Moving fast. Fix, test, iterate. No deploy-public needed. |
+| **Beta** | `@beta` | Testers | Testing the distribution pipeline. npm + installer verified. |
+| **Hotfix** | `@latest` | Everyone | Emergency fix. Goes straight to stable. No deploy-public. |
+| **Stable** | `@latest` | Everyone | Full release. deploy-public syncs the public repo. |
 
-### 1. Branch and Code
+## The Alpha Flow (Development)
 
-Create a worktree, make your changes, commit:
-```bash
-ldm worktree add my-prefix/feature-name
-cd _worktrees/repo--my-prefix--feature-name/
-# edit files
-git add <files>
-git commit -m "description"
-```
-
-### 2. Write Release Notes
-
-Create `RELEASE-NOTES-v{version}.md` (dashes, not dots) in the repo root. Commit it on the branch with the code. It gets reviewed in the PR.
-
-### 3. Push and PR
+This is the fast path. Most work happens here.
 
 ```bash
-git push -u origin my-prefix/feature-name
-gh pr create --title "..." --body "..."
-gh pr merge --merge --delete-branch
-```
+# 1. Branch and code
+git worktree add .worktrees/repo--my-prefix--feature -b my-prefix/feature
+cd .worktrees/repo--my-prefix--feature/
+# edit, commit
 
-Never squash merge. Always `--merge`.
+# 2. Push, PR, merge
+git push -u origin my-prefix/feature
+gh pr create && gh pr merge --merge
 
-### 4. Release
+# 3. Alpha release
+cd /path/to/repo && git checkout main && git pull
+wip-release alpha --notes="what changed"
 
-```bash
-cd /path/to/repo    # main working tree, not worktree
-git checkout main && git pull
-wip-release patch   # auto-detects the release notes file
+# 4. Install and test
+ldm install --alpha
 ```
 
-`wip-release` handles: version bump, CHANGELOG.md, SKILL.md version sync, npm publish, GitHub release, website skill publish.
+Done. No deploy-public. No public repo sync. The installer pulls from npm @alpha (or finds the local private repo if offline).
 
-### 5. Deploy to Public
+**Sub-tool versions:** If you changed a sub-tool's code, bump its `package.json` version in the PR. Same version = same code. `wip-release` warns if files changed without a version bump.
+
+## The Stable Flow (Public Release)
 
 ```bash
-bash deploy-public.sh /path/to/private-repo org/public-repo
-```
+# 1-3. Same as alpha: branch, PR, merge
 
-Syncs everything except `ai/` to the public repo. Creates matching release with notes.
+# 4. Write release notes on the branch
+# RELEASE-NOTES-v{version}.md in repo root, committed with the code
 
-### 6. Install (Dogfood)
+# 5. Stable release
+git checkout main && git pull
+wip-release patch   # auto-detects release notes
 
-Open a new AI session and paste:
-```
-Read https://wip.computer/install/wip-ldm-os.txt
+# 6. Deploy to public
+deploy-public /path/to/private-repo org/public-repo
+
+# 7. Dogfood
+ldm install
 ```
 
-The AI walks through: explain, dry run, install. Never `npm install -g` directly.
+`wip-release` handles: version bump, CHANGELOG.md, SKILL.md sync, npm publish, GitHub release.
+
+`deploy-public` syncs everything except `ai/` to the public repo. Creates a matching release.
 
 ## Quality Gates
 
-`wip-release` enforces before publishing:
+`wip-release` enforces before publishing (stable only):
 - Release notes must be a file (not a flag)
-- Must reference a GitHub issue
 - Product docs must be updated
-- Technical docs must be updated if source changed
 - No stale merged branches
 - Must run from main working tree (not worktree)
 
+Alpha/beta skip most gates for speed.
+
+## Source Resolution
+
+The installer resolves sources in priority order:
+
+1. **npm** (with dist-tag for alpha/beta): works on any machine with internet
+2. **Local private repo**: works offline on developer machines
+3. **GitHub clone**: fallback for stable installs and third-party tools
+
+## Version Immutability
+
+Same version = same code. Always. If code changed, the version must change. The installer uses version comparison to decide whether to deploy. `wip-release` validates that sub-tools with changed files have bumped versions.
+
 ## Three Separate Steps
 
 | Step | What happens | What it means |
 |------|-------------|---------------|
 | Merge | PR merged to main | Code lands. Nothing else changes. |
-| Deploy | wip-release + deploy-public | Published to npm + GitHub. Not on your machine yet. |
-| Install | Run the install prompt | Extensions updated on your machine. |
+| Release | `wip-release alpha/beta/patch` | Published to npm. Available for install. |
+| Install | `ldm install [--alpha/--beta]` | Extensions updated on your machine. |
 
-After Deploy, stop. Don't copy files. Don't npm install. Dogfood the install prompt.
+For stable releases, add a fourth step: `deploy-public` to sync the public GitHub repo.