@wipcomputer/wip-ldm-os 0.4.85-alpha.24 → 0.4.85-alpha.26

package/README.md

@@ -24,6 +24,7 @@ Read https://wip.computer/install/wip-ldm-os.txt
 
 Use the install document and live local checks as the source of truth.
 Do not search memory or prior notes for this install. Do not pre-load context from `MEMORY.md`, `crystal_search`, local skill dev guides, or other local memory before fetching the install document.
+Do not run GitHub commands during this install flow. Do not run or request approval for `gh release`, `gh api`, or `gh search`. If release notes are not available from local or npm metadata, say that and do not fetch them from GitHub.
 
 Check if LDM OS is installed (`which ldm && ldm --version`). Branch.
 

package/SKILL.md

@@ -33,7 +33,7 @@ Memory policy for install flows: do not consult `MEMORY.md`, do not run `crystal
 
 Use this install document and live local checks as the source of truth. Do not search memory or prior notes for this install.
 
-Do not run GitHub release commands during the install-state flow. Do not run `gh release list` or `gh release view` unless the user explicitly asks for release notes. Install-state answers should come from local commands, `ldm status`, and npm package metadata.
+Do not run GitHub commands during the install-state flow. Do not run or request approval for `gh release list`, `gh release view`, `gh api repos/*`, `gh search`, or any other GitHub query unless the user explicitly asks for release notes. Install-state answers should come from local commands, `ldm status`, and npm package metadata.
 
 ## Step 1: Check if installed
 
@@ -70,7 +70,14 @@ Always a table. Every component with an update gets its own row.
 
 **Do NOT skip this step.**
 
-Use the output of `ldm status`, installed package metadata, and npm metadata. Do not use GitHub release commands here.
+Use the output of `ldm status`, installed package metadata, and npm metadata. Do not use GitHub commands here.
+
+If npm metadata for a package does not include release notes:
+- Show the version difference, for example `wip-repos v1.9.69 -> v1.9.70`.
+- Say "release notes not available from local metadata."
+- Do not fetch from GitHub. Do not run `gh release`, `gh api`, `gh search`, or any other GitHub query.
+- Do not infer release-note content from package descriptions, commit messages, or repo READMEs.
+- If the user wants release-note details, wait for an explicit request in plain language. An approval dialog is not a user request.
 
 Translate available update information to user language. Every bullet answers "what changed for ME?" If the status output does not include enough detail for a component, say that clearly and do not invent release notes.
 

package/bin/ldm.js

@@ -22,7 +22,7 @@
 
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, cpSync, chmodSync, unlinkSync, readlinkSync, renameSync, statSync, lstatSync, symlinkSync } from 'node:fs';
 import { join, basename, resolve, dirname } from 'node:path';
-import { execFileSync, execSync, spawnSync } from 'node:child_process';
+import { execFile, execSync, spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 
 const __filename = fileURLToPath(import.meta.url);
@@ -3284,19 +3284,34 @@ async function cmdDoctor() {
 
 const STATUS_NPM_TIMEOUT_MS = parsePositiveInt(process.env.LDM_STATUS_NPM_TIMEOUT_MS, 5000);
 const STATUS_TOTAL_BUDGET_MS = parsePositiveInt(process.env.LDM_STATUS_TOTAL_BUDGET_MS, 60000);
+const STATUS_NPM_CONCURRENCY = parsePositiveInt(process.env.LDM_STATUS_NPM_CONCURRENCY, 8);
 
 function npmViewVersionForStatus(pkg, timeoutMs) {
-  return execFileSync('npm', ['view', pkg, 'version'], {
-    encoding: 'utf8',
-    timeout: timeoutMs,
-    stdio: ['ignore', 'pipe', 'ignore'],
-  }).trim();
+  return new Promise((resolvePromise, rejectPromise) => {
+    execFile('npm', ['view', pkg, 'version'], {
+      encoding: 'utf8',
+      timeout: timeoutMs,
+      maxBuffer: 1024 * 1024,
+    }, (error, stdout) => {
+      if (error) {
+        rejectPromise(error);
+        return;
+      }
+      resolvePromise(String(stdout || '').trim());
+    });
+  });
 }
 
 function remainingStatusBudgetMs(startedAt) {
   return Math.max(0, STATUS_TOTAL_BUDGET_MS - (Date.now() - startedAt));
 }
 
+function formatStatusElapsed(ms) {
+  if (!Number.isFinite(ms) || ms <= 0) return '0ms';
+  if (ms < 1000) return `${Math.round(ms)}ms`;
+  return `${(ms / 1000).toFixed(1)}s`;
+}
+
 function classifyStatusCheckError(error) {
   if (error?.signal === 'SIGTERM' || error?.code === 'ETIMEDOUT' || String(error?.message || '').includes('ETIMEDOUT')) {
     return 'timeout';
@@ -3304,7 +3319,48 @@ function classifyStatusCheckError(error) {
   return 'unavailable';
 }
 
-function cmdStatus() {
+async function runStatusProbesWithConcurrency(items, concurrency, statusStartedAt) {
+  if (items.length === 0) return [];
+
+  const results = new Array(items.length);
+  const workerCount = Math.max(1, Math.min(concurrency, items.length));
+  let nextIndex = 0;
+
+  async function worker() {
+    while (nextIndex < items.length) {
+      const index = nextIndex;
+      nextIndex += 1;
+      const item = items[index];
+      const remaining = remainingStatusBudgetMs(statusStartedAt);
+
+      if (remaining <= 0) {
+        results[index] = { ...item, status: 'skipped', reason: 'budget', elapsedMs: 0 };
+        continue;
+      }
+
+      const timeout = Math.min(STATUS_NPM_TIMEOUT_MS, remaining);
+      const probeStartedAt = Date.now();
+      console.log(`    ${item.name}: checking npm`);
+
+      try {
+        const latest = await npmViewVersionForStatus(item.npm, timeout);
+        results[index] = { ...item, status: 'ok', latest, elapsedMs: Date.now() - probeStartedAt };
+      } catch (error) {
+        results[index] = {
+          ...item,
+          status: 'skipped',
+          reason: classifyStatusCheckError(error),
+          elapsedMs: Date.now() - probeStartedAt,
+        };
+      }
+    }
+  }
+
+  await Promise.all(Array.from({ length: workerCount }, () => worker()));
+  return results;
+}
+
+async function cmdStatus() {
   const version = readJSON(VERSION_PATH);
   const registry = readJSON(REGISTRY_PATH);
   const extCount = Object.keys(registry?.extensions || {}).length;
@@ -3338,18 +3394,14 @@ function cmdStatus() {
   console.log('');
   console.log('  Checking updates:');
 
-  let cliUpdate = null;
-  try {
-    const timeout = Math.min(STATUS_NPM_TIMEOUT_MS, remainingStatusBudgetMs(statusStartedAt));
-    if (timeout <= 0) throw new Error('status update-check budget exhausted');
-    console.log('    ldm cli: checking npm');
-    const latest = npmViewVersionForStatus('@wipcomputer/wip-ldm-os', timeout);
-    if (latest && semverNewer(latest, PKG_VERSION)) cliUpdate = latest;
-  } catch (error) {
-    skipped.push({ name: 'ldm cli', npm: '@wipcomputer/wip-ldm-os', reason: classifyStatusCheckError(error) });
-  }
-
   // Check extensions against npm using registry source info (#262)
+  const probeItems = [{
+    kind: 'cli',
+    name: 'ldm cli',
+    npm: '@wipcomputer/wip-ldm-os',
+    current: PKG_VERSION,
+  }];
+
   const updates = [];
   for (const [name, info] of Object.entries(registry?.extensions || {})) {
     // Use registry source.npm (v2) or fall back to extension's package.json
@@ -3362,19 +3414,37 @@ function cmdStatus() {
     if (!npmPkg) continue;
     const currentVersion = info?.installed?.version || info.version;
     if (!currentVersion) continue;
-    try {
-      const timeout = Math.min(STATUS_NPM_TIMEOUT_MS, remainingStatusBudgetMs(statusStartedAt));
-      if (timeout <= 0) {
-        skipped.push({ name, npm: npmPkg, reason: 'budget' });
-        continue;
-      }
-      console.log(`    ${name}: checking npm`);
-      const latest = npmViewVersionForStatus(npmPkg, timeout);
-      if (latest && semverNewer(latest, currentVersion)) {
-        updates.push({ name, current: currentVersion, latest, npm: npmPkg });
-      }
-    } catch (error) {
-      skipped.push({ name, npm: npmPkg, reason: classifyStatusCheckError(error) });
+    probeItems.push({
+      kind: 'extension',
+      name,
+      npm: npmPkg,
+      current: currentVersion,
+    });
+  }
+
+  let cliUpdate = null;
+  const probeResults = await runStatusProbesWithConcurrency(probeItems, STATUS_NPM_CONCURRENCY, statusStartedAt);
+  for (const result of probeResults) {
+    if (!result) continue;
+    if (result.status === 'skipped') {
+      skipped.push({
+        name: result.name,
+        npm: result.npm,
+        reason: result.reason,
+        elapsedMs: result.elapsedMs,
+      });
+      continue;
+    }
+
+    if (result.kind === 'cli') {
+      if (result.latest && semverNewer(result.latest, PKG_VERSION)) cliUpdate = result.latest;
+    } else if (result.latest && semverNewer(result.latest, result.current)) {
+      updates.push({
+        name: result.name,
+        current: result.current,
+        latest: result.latest,
+        npm: result.npm,
+      });
     }
   }
 
@@ -3407,7 +3477,7 @@ function cmdStatus() {
     console.log('');
     console.log('  Update checks skipped:');
     for (const item of skipped) {
-      console.log(`    ${item.name}: [${item.reason}] ${item.npm}`);
+      console.log(`    ${item.name}: [${item.reason} ${formatStatusElapsed(item.elapsedMs)}] ${item.npm}`);
     }
   }
 
@@ -4866,7 +4936,7 @@ async function main() {
       await cmdDoctor();
       break;
     case 'status':
-      cmdStatus();
+      await cmdStatus();
       break;
     case 'sessions':
       await cmdSessions();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-ldm-os",
-  "version": "0.4.85-alpha.24",
+  "version": "0.4.85-alpha.26",
   "type": "module",
   "description": "LDM OS: identity, memory, and sovereignty infrastructure for AI agents",
   "engines": {
@@ -18,11 +18,12 @@
   "scripts": {
     "build:bridge": "cd src/bridge && npm install && npx tsup core.ts mcp-server.ts cli.ts openclaw.ts --format esm --dts --clean --outDir ../../dist/bridge",
     "build": "npm run build:bridge",
-    "prepublishOnly": "npm run build:bridge && npm run validate:bin-manifest && npm run test:install-prompt-policy && npm run test:ldm-status-timeout",
+    "prepublishOnly": "npm run build:bridge && npm run validate:bin-manifest && npm run test:install-prompt-policy && npm run test:ldm-status-timeout && npm run test:ldm-status-concurrency",
     "validate:bin-manifest": "node scripts/validate-bin-manifest.mjs",
     "test:skill-frontmatter": "node scripts/test-skill-frontmatter.mjs",
     "test:install-prompt-policy": "node scripts/test-install-prompt-policy.mjs",
     "test:ldm-status-timeout": "node scripts/test-ldm-status-timeout.mjs",
+    "test:ldm-status-concurrency": "node scripts/test-ldm-status-concurrency.mjs",
     "test:installer-update-tracks": "node scripts/test-installer-update-tracks.mjs",
     "test:installer-hook-toolname": "node scripts/test-installer-hook-toolname.mjs",
     "test:installer-target-self-update": "node scripts/test-installer-target-self-update.mjs",

package/scripts/test-install-prompt-policy.mjs

@@ -21,6 +21,8 @@ for (const file of ["README.md", "shared/templates/install-prompt.md"]) {
   for (const phrase of [
     "Use the install document and live local checks as the source of truth.",
     "Do not search memory or prior notes for this install. Do not pre-load context from `MEMORY.md`, `crystal_search`, local skill dev guides, or other local memory before fetching the install document.",
+    "Do not run GitHub commands during this install flow. Do not run or request approval for `gh release`, `gh api`, or `gh search`.",
+    "If release notes are not available from local or npm metadata, say that and do not fetch them from GitHub.",
     "If installed: run `ldm status`",
     "If yes to dry run, run `ldm install --dry-run`.",
     "`npm install -g @wipcomputer/wip-ldm-os@latest && ldm install && ldm doctor`",
@@ -41,10 +43,14 @@ for (const phrase of [
   "Memory policy for install flows: do not consult `MEMORY.md`, do not run `crystal_search`, and do not search prior notes when this skill is invoked, including in any parallel or batched exploration step.",
   "The only context sources for this install flow are `https://wip.computer/install/wip-ldm-os.txt` and the live local commands that document prescribes.",
   "Read that document and run those commands. Do not pre-load other context.",
-  "Do not run GitHub release commands during the install-state flow.",
-  "Do not run `gh release list` or `gh release view` unless the user explicitly asks for release notes.",
+  "Do not run GitHub commands during the install-state flow.",
+  "Do not run or request approval for `gh release list`, `gh release view`, `gh api repos/*`, `gh search`, or any other GitHub query unless the user explicitly asks for release notes.",
   "Use the output of `ldm status`, installed package metadata, and npm metadata.",
-  "Do not use GitHub release commands here.",
+  "Do not use GitHub commands here.",
+  "If npm metadata for a package does not include release notes:",
+  "Say \"release notes not available from local metadata.\"",
+  "Do not infer release-note content from package descriptions, commit messages, or repo READMEs.",
+  "An approval dialog is not a user request.",
 ]) {
   if (!skill.includes(phrase)) {
     failures.push(`SKILL.md missing install policy phrase: ${phrase}`);

package/scripts/test-ldm-status-concurrency.mjs

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const root = dirname(dirname(fileURLToPath(import.meta.url)));
+const tempRoot = mkdtempSync(join(tmpdir(), 'ldm-status-concurrency-'));
+const sourceVersion = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')).version;
+
+function assert(condition, message) {
+  if (!condition) throw new Error(message);
+}
+
+function writeFixture(home, fakeBin) {
+  const extensions = join(home, '.ldm', 'extensions');
+  mkdirSync(extensions, { recursive: true });
+  writeFileSync(join(home, '.ldm', 'version.json'), JSON.stringify({
+    version: '0.0.0-test',
+    installed: '2026-05-12T00:00:00.000Z',
+    updated: '2026-05-12T00:00:00.000Z',
+  }, null, 2) + '\n');
+
+  const registry = { extensions: {} };
+  for (let i = 1; i <= 8; i += 1) {
+    registry.extensions[`ext-${i}`] = {
+      source: { npm: `ext-${i}` },
+      installed: { version: '1.0.0' },
+    };
+  }
+  writeFileSync(join(extensions, 'registry.json'), JSON.stringify(registry, null, 2) + '\n');
+
+  mkdirSync(fakeBin, { recursive: true });
+  const fakeNpm = join(fakeBin, 'npm');
+  writeFileSync(fakeNpm, `#!/usr/bin/env bash
+if [ "$1" = "view" ]; then
+  sleep "\${FAKE_NPM_SLEEP:-1}"
+  echo "1.0.0"
+  exit 0
+fi
+echo "unexpected npm command: $*" >&2
+exit 64
+`);
+  chmodSync(fakeNpm, 0o755);
+}
+
+function runStatus({ concurrency, sleepSeconds, timeoutMs }) {
+  const home = join(tempRoot, `home-${concurrency}-${sleepSeconds}`);
+  const fakeBin = join(tempRoot, `bin-${concurrency}-${sleepSeconds}`);
+  writeFixture(home, fakeBin);
+
+  const startedAt = Date.now();
+  const result = spawnSync(process.execPath, [join(root, 'bin', 'ldm.js'), 'status'], {
+    cwd: root,
+    encoding: 'utf8',
+    timeout: timeoutMs,
+    env: {
+      ...process.env,
+      HOME: home,
+      PATH: `${fakeBin}:${process.env.PATH || ''}`,
+      FAKE_NPM_SLEEP: String(sleepSeconds),
+      LDM_STATUS_NPM_CONCURRENCY: String(concurrency),
+      LDM_STATUS_NPM_TIMEOUT_MS: '2000',
+      LDM_STATUS_TOTAL_BUDGET_MS: '10000',
+    },
+  });
+  return { result, elapsedMs: Date.now() - startedAt };
+}
+
+try {
+  const concurrent = runStatus({ concurrency: 4, sleepSeconds: 1, timeoutMs: 7000 });
+  assert(concurrent.result.status === 0, `concurrent ldm status exited ${concurrent.result.status}\nstdout:\n${concurrent.result.stdout}\nstderr:\n${concurrent.result.stderr}`);
+  assert(concurrent.elapsedMs < 6500, `concurrent ldm status should finish well before serial runtime; elapsed ${concurrent.elapsedMs}ms`);
+  assert(concurrent.result.stdout.includes(`LDM OS v${sourceVersion}`), `status should print installed LDM OS version\n${concurrent.result.stdout}`);
+  assert(concurrent.result.stdout.includes('Extensions: 8'), `status should print extension count\n${concurrent.result.stdout}`);
+  assert(concurrent.result.stdout.includes('ext-8: checking npm'), `status should check every staged extension\n${concurrent.result.stdout}`);
+  assert(!concurrent.result.stdout.includes('Update checks skipped:'), `concurrent status should not skip checks in this fixture\n${concurrent.result.stdout}`);
+
+  const serialFallback = runStatus({ concurrency: 1, sleepSeconds: 0.05, timeoutMs: 5000 });
+  assert(serialFallback.result.status === 0, `serial fallback ldm status exited ${serialFallback.result.status}\nstdout:\n${serialFallback.result.stdout}\nstderr:\n${serialFallback.result.stderr}`);
+  assert(serialFallback.result.stdout.includes('ext-8: checking npm'), `serial fallback should still check every staged extension\n${serialFallback.result.stdout}`);
+  assert(!serialFallback.result.stdout.includes('Update checks skipped:'), `serial fallback should not skip checks in this fixture\n${serialFallback.result.stdout}`);
+} finally {
+  rmSync(tempRoot, { recursive: true, force: true });
+}
+
+console.log('ldm status concurrency regression passed');

package/scripts/test-ldm-status-timeout.mjs

@@ -72,7 +72,7 @@ exit 64
   assert(result.stdout.includes('Checking updates:'), `status should show progress before update checks\n${result.stdout}`);
   assert(result.stdout.includes('hung-extension: checking npm'), `status should print the extension name before probing it\n${result.stdout}`);
   assert(result.stdout.includes('Update checks skipped:'), `status should report skipped checks instead of hanging\n${result.stdout}`);
-  assert(result.stdout.includes('hung-extension: [timeout] hung-extension'), `hung extension should be reported as a timeout\n${result.stdout}`);
+  assert(/hung-extension: \[timeout \d+(ms|\.\d+s)\] hung-extension/.test(result.stdout), `hung extension should be reported as a timeout with elapsed time\n${result.stdout}`);
 } finally {
   rmSync(tempRoot, { recursive: true, force: true });
 }

package/shared/templates/install-prompt.md

@@ -8,6 +8,7 @@ Read https://wip.computer/install/wip-ldm-os.txt
 
 Use the install document and live local checks as the source of truth.
 Do not search memory or prior notes for this install. Do not pre-load context from `MEMORY.md`, `crystal_search`, local skill dev guides, or other local memory before fetching the install document.
+Do not run GitHub commands during this install flow. Do not run or request approval for `gh release`, `gh api`, or `gh search`. If release notes are not available from local or npm metadata, say that and do not fetch them from GitHub.
 
 Check if LDM OS is installed (`which ldm && ldm --version`). Branch.