@wipcomputer/wip-ldm-os 0.4.85-alpha.29 → 0.4.85-alpha.30

package/SKILL.md

@@ -77,6 +77,8 @@ First-time CLI bootstrap commands use the same selected track:
 - beta/latest beta: `npm install -g @wipcomputer/wip-ldm-os@beta`
 - alpha/latest alpha: `npm install -g @wipcomputer/wip-ldm-os@alpha`
 
+The `ldm install --<track>` command self-updates the LDM CLI to the matching npm dist-tag before running the install. **Do not run `npm install -g @wipcomputer/wip-ldm-os@latest` ahead of an alpha or beta install:** `@latest` resolves to the stable dist-tag and will downgrade an alpha-pinned CLI to stable.
+
 If the user already named a track, do not force a generic chooser. Show the exact package, available version, track, and command you will run. Then wait for dry-run or install consent as appropriate.
 
 If the user has not named a track, show what is installed and what is available, then ask which track they want to dry run or install.
@@ -276,6 +278,11 @@ Tell the user, scaled to the track they're on:
 - **beta**: stabilization candidate. Same shape as alpha but feature-frozen for the cut.
 - **stable**: production. The user should be on this unless they've asked otherwise.
 
+Roadmap caveats that apply to every track right now:
+
+- Registry source-type migration is mid-flight. After Phase 2 ships, `ldm status` will categorize every extension by source type (`npm` / `git` / `bundled` / `private`). Until then, some entries appear under "Untracked extensions" with a `ldm doctor --reclassify-sources` remediation pointer.
+- LDM OS is the canonical pattern source for child packages (Codex Remote Control, future tools). Install-prompt structure changes here propagate downstream; child packages should not lead the parent.
+
 ## Reference files
 
 For detailed information, read these on demand (not on every activation):

package/bin/ldm.js

@@ -1807,6 +1807,7 @@ async function migrateLegacyNpmSources({ dryRun = false } = {}) {
     planLegacyNpmSourcesMigration,
     summaryHasChanges,
     npmPackageExists,
+    executeDirectoryMoves,
   } = await import('../lib/registry-migrations.mjs');
 
   const registry = readJSON(REGISTRY_PATH);
@@ -1836,6 +1837,20 @@ async function migrateLegacyNpmSources({ dryRun = false } = {}) {
     copyFileSync(REGISTRY_PATH, backupPath);
     summary.backupPath = backupPath;
     writeJSON(REGISTRY_PATH, newRegistry);
+
+    // Execute directory moves AFTER the registry write. Each move sends a
+    // deduplicated extension's on-disk directory to ~/.ldm/_trash/<name>-
+    // deduplicated-<timestamp> so autoDetectExtensions (which only scans
+    // ~/.ldm/extensions/) cannot find it on the next install pass.
+    // Without this, the registry dedup reverts within the same install run.
+    // See ai/product/bugs/installer/2026-05-13--cc-mini--installer-dedup-reverts-between-installs.md
+    const { performed, skipped } = executeDirectoryMoves({
+      directoryMoves: summary.directoryMoves,
+      extensionsRoot: LDM_EXTENSIONS,
+      trashRoot: join(LDM_ROOT, '_trash'),
+    });
+    summary.directoryMovesPerformed.push(...performed);
+    summary.directoryMovesSkipped.push(...skipped);
   }
 
   return summary;
@@ -1879,6 +1894,29 @@ function printLegacyNpmSourcesSummary(summary, { dryRun = false } = {}) {
       console.log(`      ${d.removed} (canonical: ${d.keep})`);
     }
   }
+  if (summary.directoryMoves && summary.directoryMoves.length > 0) {
+    if (dryRun) {
+      console.log(`  + Would move ${summary.directoryMoves.length} duplicate director${summary.directoryMoves.length === 1 ? 'y' : 'ies'} to ~/.ldm/_trash/ (so autoDetectExtensions cannot re-register):`);
+      for (const m of summary.directoryMoves) {
+        console.log(`      ~/.ldm/extensions/${m.name} -> ~/.ldm/_trash/${m.trashName}`);
+      }
+    } else {
+      const performed = summary.directoryMovesPerformed || [];
+      const skipped = summary.directoryMovesSkipped || [];
+      if (performed.length > 0) {
+        console.log(`  + Moved ${performed.length} duplicate director${performed.length === 1 ? 'y' : 'ies'} to ~/.ldm/_trash/ (autoDetectExtensions cannot re-register):`);
+        for (const m of performed) {
+          console.log(`      ${m.name} -> ${m.destPath.replace(HOME, '~')}`);
+        }
+      }
+      if (skipped.length > 0) {
+        console.log(`  ! ${skipped.length} duplicate director${skipped.length === 1 ? 'y' : 'ies'} could not be moved (registry entries are removed; autoDetect may re-add on next install):`);
+        for (const m of skipped) {
+          console.log(`      ${m.name} (${m.reason})`);
+        }
+      }
+    }
+  }
   if (summary.probeFailures && summary.probeFailures.length > 0) {
     console.log(`  ! ${summary.probeFailures.length} npm probe${summary.probeFailures.length === 1 ? '' : 's'} could not complete (will retry on next install):`);
     for (const f of summary.probeFailures) {

package/lib/registry-migrations.mjs

@@ -4,9 +4,18 @@
 // Called by bin/ldm.js during `ldm install`. Idempotent: entries that already
 // carry `updateSource` are skipped.
 //
+// `planLegacyNpmSourcesMigration` is pure (no filesystem I/O). The companion
+// `executeDirectoryMoves` IS side-effecting; the planner emits a list of
+// directory-move plans and the executor performs them. The split lets tests
+// drive the planner with in-memory fixtures and exercise the executor against
+// a real temp filesystem.
+//
 // See ai/product/bugs/installer/2026-05-13--cc-mini--installer-source-npm-honest-cleanup.md
 // and the parent design ai/product/bugs/installer/2026-05-13--cc-mini--installer-registry-source-types-architecture.md
 
+import { existsSync, mkdirSync, renameSync } from 'node:fs';
+import { join } from 'node:path';
+
 const DEFAULT_NPM_REGISTRY = 'https://registry.npmjs.org';
 
 // Phase 1 expedient. The known duplicate pairs surfaced on Parker's machine
@@ -31,6 +40,16 @@ export function emptyLegacyNpmSourcesSummary() {
     migrated: [],
     phantomsRemoved: [],
     duplicatesRemoved: [],
+    // Directory moves to perform AFTER the registry write. The planner
+    // emits these as a parallel list to duplicatesRemoved (1:1); the
+    // wrapper in bin/ldm.js executes them. See
+    // ai/product/bugs/installer/2026-05-13--cc-mini--installer-dedup-reverts-between-installs.md
+    // for the bug fix: without moving the on-disk directory out of
+    // ~/.ldm/extensions/, autoDetectExtensions re-registers the duplicate
+    // on the same install run and the dedup never persists.
+    directoryMoves: [],
+    directoryMovesPerformed: [],
+    directoryMovesSkipped: [],
     probedCount: 0,
     probeFailures: [],
     timestamp: new Date().toISOString(),
@@ -96,9 +115,20 @@ export async function planLegacyNpmSourcesMigration({
 
   // Step 2: dedupe known pairs. Pure structural fix; the canonical row stays
   // untouched. Future drift is the hygiene-audit ticket's job, not this one.
+  //
+  // Each removed duplicate also emits a directoryMoves entry: the wrapper
+  // moves ~/.ldm/extensions/<remove> to ~/.ldm/_trash/<remove>-deduplicated-<ts>
+  // after the registry write so autoDetectExtensions cannot re-register
+  // the duplicate on the same install run.
+  const trashStamp = summary.timestamp.replace(/[:.]/g, '-');
   for (const { keep, remove } of KNOWN_DUPLICATE_PAIRS) {
     if (newRegistry.extensions[keep] && newRegistry.extensions[remove]) {
       summary.duplicatesRemoved.push({ keep, removed: remove });
+      summary.directoryMoves.push({
+        name: remove,
+        reason: 'deduplicated',
+        trashName: `${remove}-deduplicated-${trashStamp}`,
+      });
       delete newRegistry.extensions[remove];
     }
   }
@@ -159,6 +189,58 @@ export async function planLegacyNpmSourcesMigration({
   return { newRegistry, summary };
 }
 
+// Execute the directory-move plans emitted by planLegacyNpmSourcesMigration.
+// Side-effecting: moves directories from `extensionsRoot/<name>` to
+// `trashRoot/<trashName>`. Creates `trashRoot` if needed. Skips moves whose
+// source is missing or whose rename fails. Idempotent: a second call with the
+// same plan returns all-skipped (source-missing) once the moves are done.
+//
+// Returns `{ performed: [...], skipped: [...] }` for the caller to append to
+// the migration summary. Each performed entry gains a `destPath`; each skipped
+// entry gains a `reason`.
+//
+// The contract is split from the planner so:
+//   - the planner stays pure and trivially testable with in-memory fixtures,
+//   - the executor can be exercised against a real temp filesystem in a test
+//     fixture without spawning a full `ldm install` run,
+//   - tests can inject `fs` primitives via the optional `fs` option for
+//     paranoid scenarios.
+export function executeDirectoryMoves({
+  directoryMoves,
+  extensionsRoot,
+  trashRoot,
+  fs,
+}) {
+  const _existsSync = fs?.existsSync || existsSync;
+  const _mkdirSync = fs?.mkdirSync || mkdirSync;
+  const _renameSync = fs?.renameSync || renameSync;
+
+  const performed = [];
+  const skipped = [];
+  if (!directoryMoves || directoryMoves.length === 0) {
+    return { performed, skipped };
+  }
+
+  _mkdirSync(trashRoot, { recursive: true });
+
+  for (const move of directoryMoves) {
+    const src = join(extensionsRoot, move.name);
+    const dest = join(trashRoot, move.trashName);
+    if (!_existsSync(src)) {
+      skipped.push({ ...move, reason: 'source-missing' });
+      continue;
+    }
+    try {
+      _renameSync(src, dest);
+      performed.push({ ...move, destPath: dest });
+    } catch (err) {
+      skipped.push({ ...move, reason: `rename-failed: ${err.message}` });
+    }
+  }
+
+  return { performed, skipped };
+}
+
 // Real npm-registry probe. Returns true/false/null per the planner contract.
 // Mirrors the fetch pattern used by npmViewVersionForStatus in bin/ldm.js.
 export async function npmPackageExists(pkgName, opts = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-ldm-os",
-  "version": "0.4.85-alpha.29",
+  "version": "0.4.85-alpha.30",
   "type": "module",
   "description": "LDM OS: identity, memory, and sovereignty infrastructure for AI agents",
   "engines": {

package/scripts/test-legacy-npm-sources-migration.mjs

@@ -3,10 +3,15 @@
 // See lib/registry-migrations.mjs and
 // ai/product/bugs/installer/2026-05-13--cc-mini--installer-source-npm-honest-cleanup.md
 
+import { mkdtempSync, mkdirSync, writeFileSync, existsSync, readdirSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
 import {
   planLegacyNpmSourcesMigration,
   summaryHasChanges,
   emptyLegacyNpmSourcesSummary,
+  executeDirectoryMoves,
 } from '../lib/registry-migrations.mjs';
 
 function fail(msg) {
@@ -181,6 +186,29 @@ const FIXED_NOW = () => new Date('2026-05-13T18:00:00.000Z');
   if (!newRegistry.extensions['cc-session-export']) fail('canonical cc-session-export removed');
   if (!newRegistry.extensions['wip-branch-guard']) fail('canonical wip-branch-guard removed');
 
+  // Each removed duplicate must also produce a directoryMoves entry. The
+  // wrapper in bin/ldm.js executes these moves after the registry write so
+  // autoDetectExtensions cannot re-register the duplicate on the same install
+  // run. Without this contract, the registry dedup reverts (see
+  // ai/product/bugs/installer/2026-05-13--cc-mini--installer-dedup-reverts-between-installs.md).
+  assertEqual(summary.directoryMoves.length, 2, 'directoryMoves.length');
+  const moveNames = summary.directoryMoves.map(m => m.name).sort();
+  assertDeepEqual(moveNames, ['package', 'session-export'], 'directoryMoves names');
+  for (const m of summary.directoryMoves) {
+    assertEqual(m.reason, 'deduplicated', `directoryMoves[${m.name}].reason`);
+    if (!m.trashName.startsWith(`${m.name}-deduplicated-`)) {
+      fail(`directoryMoves[${m.name}].trashName should start with "${m.name}-deduplicated-" but was "${m.trashName}"`);
+    }
+    if (!m.trashName.includes('2026-05-13T18-00-00-000Z')) {
+      fail(`directoryMoves[${m.name}].trashName should embed the fixed-now timestamp but was "${m.trashName}"`);
+    }
+  }
+
+  // The planner is pure: it must NOT pre-populate directoryMovesPerformed or
+  // directoryMovesSkipped. Those are wrapper outputs from real filesystem I/O.
+  assertEqual(summary.directoryMovesPerformed.length, 0, 'directoryMovesPerformed should be empty from pure planner');
+  assertEqual(summary.directoryMovesSkipped.length, 0, 'directoryMovesSkipped should be empty from pure planner');
+
   // Migrated entries: cc-session-export, compaction-indicator, lesa-bridge,
   // run, plus the two custom-path entries (custom-path-untracked,
   // legacy-custom-path). `session-export` and `package` were deduped before
@@ -275,6 +303,7 @@ const FIXED_NOW = () => new Date('2026-05-13T18:00:00.000Z');
   assertEqual(summary.migrated.length, 0, 'migrated.length on idempotent run');
   assertEqual(summary.phantomsRemoved.length, 0, 'phantomsRemoved.length on idempotent run');
   assertEqual(summary.duplicatesRemoved.length, 0, 'duplicatesRemoved.length on idempotent run');
+  assertEqual(summary.directoryMoves.length, 0, 'directoryMoves.length on idempotent run');
   assertEqual(summaryHasChanges(summary), false, 'summaryHasChanges on empty summary');
   assertDeepEqual(
     Object.keys(newRegistry.extensions).sort(),
@@ -287,6 +316,9 @@ const FIXED_NOW = () => new Date('2026-05-13T18:00:00.000Z');
 {
   const e = emptyLegacyNpmSourcesSummary();
   assertDeepEqual(Object.keys(e).sort(), [
+    'directoryMoves',
+    'directoryMovesPerformed',
+    'directoryMovesSkipped',
     'duplicatesRemoved',
     'migrated',
     'phantomsRemoved',
@@ -294,6 +326,135 @@ const FIXED_NOW = () => new Date('2026-05-13T18:00:00.000Z');
     'probedCount',
     'timestamp',
   ], 'empty summary keys');
+  // Wrapper-output fields start empty even though the planner doesn't
+  // populate them ... the wrapper is responsible for appending.
+  assertEqual(e.directoryMoves.length, 0, 'empty.directoryMoves');
+  assertEqual(e.directoryMovesPerformed.length, 0, 'empty.directoryMovesPerformed');
+  assertEqual(e.directoryMovesSkipped.length, 0, 'empty.directoryMovesSkipped');
+}
+
+// ── Test 4: executeDirectoryMoves against a real temp filesystem ──────────
+// Regression guard for the bug fixed by this PR
+// (ai/product/bugs/installer/2026-05-13--cc-mini--installer-dedup-reverts-between-installs.md).
+// The planner emits directoryMoves entries; the executor must actually move
+// the on-disk directories into trash so autoDetectExtensions cannot
+// re-register them on the next install scan.
+{
+  const tmpHome = mkdtempSync(join(tmpdir(), 'ldm-dedup-trash-'));
+  try {
+    const extensionsRoot = join(tmpHome, 'extensions');
+    const trashRoot = join(tmpHome, '_trash');
+    mkdirSync(extensionsRoot, { recursive: true });
+
+    // Stand up the two duplicate directories the planner would dedup.
+    for (const name of ['session-export', 'package']) {
+      const dir = join(extensionsRoot, name);
+      mkdirSync(dir, { recursive: true });
+      writeFileSync(join(dir, 'package.json'), JSON.stringify({ name, version: '1.0.0' }) + '\n');
+    }
+    // And a non-duplicate that must be left alone (proxy for cc-session-export).
+    const ccsePath = join(extensionsRoot, 'cc-session-export');
+    mkdirSync(ccsePath, { recursive: true });
+    writeFileSync(join(ccsePath, 'package.json'), JSON.stringify({ name: 'cc-session-export', version: '1.0.0' }) + '\n');
+
+    // Run the planner with the fixture to get a real directoryMoves plan.
+    const registry = {
+      extensions: {
+        'cc-session-export': { source: { npm: 'session-export' }, installed: { version: '1.0.0' } },
+        'session-export':    { source: { npm: 'session-export' }, installed: { version: '1.0.0' } },
+        'wip-branch-guard':  { source: { npm: '@wipcomputer/wip-branch-guard' }, installed: { version: '1.0.0' } },
+        'package':           { source: { npm: '@wipcomputer/wip-branch-guard' }, installed: { version: '1.0.0' } },
+      },
+    };
+    const { summary } = await planLegacyNpmSourcesMigration({
+      registry,
+      probeNpm: (name) => Promise.resolve(name === '@wipcomputer/wip-branch-guard'),
+      extensionExists: () => true,
+      now: FIXED_NOW,
+    });
+    assertEqual(summary.directoryMoves.length, 2, 'dedup plan produces 2 directoryMoves');
+
+    // Execute the moves against the temp filesystem.
+    const { performed, skipped } = executeDirectoryMoves({
+      directoryMoves: summary.directoryMoves,
+      extensionsRoot,
+      trashRoot,
+    });
+    assertEqual(performed.length, 2, 'executor performed 2 moves');
+    assertEqual(skipped.length, 0, 'executor did not skip any moves');
+
+    // Source directories are gone.
+    if (existsSync(join(extensionsRoot, 'session-export'))) {
+      fail('session-export directory should have been moved out of extensions/');
+    }
+    if (existsSync(join(extensionsRoot, 'package'))) {
+      fail('package directory should have been moved out of extensions/');
+    }
+
+    // Trash directory now has the moved entries with the deduplicated suffix.
+    const trashContents = readdirSync(trashRoot);
+    if (!trashContents.some(name => name.startsWith('session-export-deduplicated-'))) {
+      fail(`trash should contain session-export-deduplicated-* but had: ${trashContents.join(', ')}`);
+    }
+    if (!trashContents.some(name => name.startsWith('package-deduplicated-'))) {
+      fail(`trash should contain package-deduplicated-* but had: ${trashContents.join(', ')}`);
+    }
+
+    // Non-duplicate must NOT have been touched.
+    if (!existsSync(ccsePath)) fail('cc-session-export directory should be untouched');
+
+    // autoDetectExtensions simulation: a fresh scan of extensionsRoot must
+    // NOT see the moved duplicates. We replicate the production logic
+    // (bin/ldm.js autoDetectExtensions): scan top-level dirs in
+    // extensionsRoot, skip dirs named `_trash` or starting with `.` or
+    // `ldm-install-`, and treat any remaining dir with a package.json as a
+    // candidate for auto-registration.
+    const candidatesAfterMove = readdirSync(extensionsRoot, { withFileTypes: true })
+      .filter(d => d.isDirectory())
+      .map(d => d.name)
+      .filter(name => name !== '_trash' && !name.startsWith('.') && !name.startsWith('ldm-install-'))
+      .filter(name => existsSync(join(extensionsRoot, name, 'package.json')))
+      .sort();
+    assertDeepEqual(
+      candidatesAfterMove,
+      ['cc-session-export'],
+      'autoDetect should see only the non-duplicate after the moves; duplicates must be gone',
+    );
+
+    // Idempotency: running executeDirectoryMoves again must skip all
+    // (source-missing) and not fail.
+    const second = executeDirectoryMoves({
+      directoryMoves: summary.directoryMoves,
+      extensionsRoot,
+      trashRoot,
+    });
+    assertEqual(second.performed.length, 0, 'second execute call performs nothing');
+    assertEqual(second.skipped.length, 2, 'second execute call skips both moves');
+    for (const s of second.skipped) {
+      assertEqual(s.reason, 'source-missing', `second-call skip reason for ${s.name}`);
+    }
+  } finally {
+    rmSync(tmpHome, { recursive: true, force: true });
+  }
+}
+
+// ── Test 5: executeDirectoryMoves with no moves is a no-op ───────────────
+{
+  const tmpHome = mkdtempSync(join(tmpdir(), 'ldm-dedup-trash-empty-'));
+  try {
+    const result = executeDirectoryMoves({
+      directoryMoves: [],
+      extensionsRoot: join(tmpHome, 'extensions'),
+      trashRoot: join(tmpHome, '_trash'),
+    });
+    assertEqual(result.performed.length, 0, 'empty plan -> no performed');
+    assertEqual(result.skipped.length, 0, 'empty plan -> no skipped');
+    if (existsSync(join(tmpHome, '_trash'))) {
+      fail('executor should not pre-create trashRoot when there are no moves');
+    }
+  } finally {
+    rmSync(tmpHome, { recursive: true, force: true });
+  }
 }
 
 console.log('test-legacy-npm-sources-migration: all tests passed');