@wipcomputer/wip-ldm-os 0.4.85-alpha.3 → 0.4.85-alpha.32

package/scripts/test-doctor-hook-dedupe.mjs

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+// Regression test: `ldm doctor` duplicate-hook + invalid-model checks.
+//
+// Covers the 2026-07-04 tickets:
+//   ai/product/bugs/installer/open-tickets/2026-07-04--cc-mini--installer-sessionstart-hook-duplicate-registration.md
+//   ai/product/bugs/guard/2026-07-04--cc-mini--no-blessed-recipe-for-live-settings-remediation.md
+//
+// Cases:
+//   1. Duplicate-laden settings: doctor reports, does NOT write without --fix.
+//   2. --fix collapses duplicates to 1, writes a timestamped backup first,
+//      preserves unrelated hooks and unknown keys.
+//   3. Invalid model value ("opus" + real ESC 0x1B + "[1m"): reported, removed under --fix.
+//   4. Malformed settings.json: warns and skips, file untouched, no crash.
+//
+// Follows the test-doctor-cron-target.mjs pattern: real bin/ldm.js doctor
+// against a temp HOME, crontab/npm shimmed on PATH so the operator's real
+// state is never read.
+
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+
+const repo = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const cli = join(repo, 'bin', 'ldm.js');
+const pkg = JSON.parse(readFileSync(join(repo, 'package.json'), 'utf8'));
+
+let failed = 0;
+function assert(cond, label, output = '') {
+  if (cond) {
+    console.log(`  [PASS] ${label}`);
+  } else {
+    console.log(`  [FAIL] ${label}`);
+    if (output) console.log(`         --- output (last lines) ---\n         ${output.trim().split('\n').slice(-25).join('\n         ')}`);
+    failed++;
+  }
+}
+
+function setupHome(settingsFactory) {
+  const home = mkdtempSync(join(tmpdir(), 'ldm-doctor-dedupe-'));
+  const ldmRoot = join(home, '.ldm');
+  const fakeBin = join(home, 'fakebin');
+  mkdirSync(join(ldmRoot, 'extensions'), { recursive: true });
+  mkdirSync(join(home, '.claude'), { recursive: true });
+  mkdirSync(fakeBin, { recursive: true });
+
+  writeFileSync(join(ldmRoot, 'version.json'), JSON.stringify({ version: pkg.version }, null, 2) + '\n');
+  writeFileSync(join(ldmRoot, 'extensions', 'registry.json'), JSON.stringify({ _format: 'v2', extensions: {} }, null, 2) + '\n');
+
+  // Hook scripts must exist on disk: doctor --fix runs the stale-path
+  // cleanup (#30) before the dedupe pass, and missing targets would be
+  // removed as stale instead of collapsed as duplicates.
+  const bootScript = join(ldmRoot, 'shared', 'boot', 'boot-hook.mjs');
+  const guardScript = join(ldmRoot, 'extensions', 'wip-branch-guard', 'guard.mjs');
+  const stopScript = join(ldmRoot, 'extensions', 'stop-hook.mjs');
+  for (const f of [bootScript, guardScript, stopScript]) {
+    mkdirSync(dirname(f), { recursive: true });
+    writeFileSync(f, 'process.exit(0);\n');
+  }
+
+  const paths = { bootScript, guardScript, stopScript };
+  const settingsContent = settingsFactory(paths);
+  const settingsPath = join(home, '.claude', 'settings.json');
+  writeFileSync(settingsPath, typeof settingsContent === 'string'
+    ? settingsContent
+    : JSON.stringify(settingsContent, null, 2) + '\n');
+
+  // Empty crontab + no-op npm on PATH (never touch operator state/network).
+  writeFileSync(join(fakeBin, 'crontab'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'crontab'), 0o755);
+  writeFileSync(join(fakeBin, 'npm'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'npm'), 0o755);
+
+  return { home, fakeBin, settingsPath, paths };
+}
+
+function runDoctor({ home, fakeBin }, fix = false) {
+  const args = ['doctor'];
+  if (fix) args.push('--fix');
+  try {
+    return execFileSync('node', [cli, ...args], {
+      env: { ...process.env, HOME: home, PATH: `${fakeBin}:${process.env.PATH}`, LDM_SELF_UPDATED: '1' },
+      encoding: 'utf-8',
+      timeout: 30000,
+    });
+  } catch (err) {
+    return (err.stdout || '') + (err.stderr || '');
+  }
+}
+
+const bootCmd = (paths) => `node ${paths.bootScript}`;
+const bootEntry = (paths) => ({ matcher: '*', hooks: [{ type: 'command', command: bootCmd(paths), timeout: 15 }] });
+const guardEntry = (paths) => ({ hooks: [{ type: 'command', command: `node ${paths.guardScript}`, timeout: 10 }] });
+
+function dupeLadenSettings(paths) {
+  return {
+    unknownTopLevelKey: { keep: 'me' },
+    permissions: { defaultMode: 'default' },
+    hooks: {
+      SessionStart: [
+        ...Array.from({ length: 5 }, () => bootEntry(paths)),
+        guardEntry(paths),
+        ...Array.from({ length: 5 }, () => bootEntry(paths)),
+      ],
+      Stop: [{ hooks: [{ type: 'command', command: `node ${paths.stopScript}` }] }],
+    },
+  };
+}
+
+console.log('Test 1: duplicates reported, no write without --fix');
+{
+  const w = setupHome(dupeLadenSettings);
+  const before = readFileSync(w.settingsPath, 'utf-8');
+  const out = runDoctor(w);
+  const after = readFileSync(w.settingsPath, 'utf-8');
+  assert(/SessionStart: 10 identical hook entries/.test(out), 'reports 10 identical SessionStart entries', out);
+  assert(/ldm doctor --fix to collapse 9 duplicate hook entries/.test(out), 'suggests --fix with count', out);
+  assert(before === after, 'settings.json untouched without --fix');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 2: --fix collapses, backs up first, preserves everything else');
+{
+  const w = setupHome(dupeLadenSettings);
+  const out = runDoctor(w, true);
+  const s = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  const bootCount = s.hooks.SessionStart.filter((e) => e.hooks?.[0]?.command === bootCmd(w.paths)).length;
+  const backups = readdirSync(join(w.home, '.claude')).filter((f) => f.startsWith('settings.json.bak-'));
+  assert(/Collapsed 9 duplicate hook entries/.test(out), 'reports 9 collapsed', out);
+  assert(bootCount === 1, `boot-hook entries collapsed to 1 (got ${bootCount})`);
+  assert(s.hooks.SessionStart.length === 2, 'boot hook + branch guard remain');
+  assert(s.hooks.Stop.length === 1, 'unrelated Stop hook preserved');
+  assert(s.unknownTopLevelKey?.keep === 'me', 'unknown top-level key preserved');
+  assert(backups.length === 1, `timestamped backup written (found ${backups.length})`);
+  if (backups.length === 1) {
+    const bak = JSON.parse(readFileSync(join(w.home, '.claude', backups[0]), 'utf-8'));
+    assert(bak.hooks.SessionStart.length === 11, 'backup holds the pre-fix state');
+  }
+  const again = runDoctor(w, true);
+  assert(!/Collapsed/.test(again), 'second --fix run finds nothing to collapse', again);
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 3: invalid model value reported and removed under --fix');
+{
+  // The corruption fixture carries a REAL ESC control char (0x1B): "opus"
+  // plus an ANSI bold fragment, which is what a terminal paste persists.
+  // Printable brackets alone are NOT corruption (see Test 4).
+  const w = setupHome((paths) => ({ model: 'opus\x1b[1m', hooks: { SessionStart: [bootEntry(paths)] } }));
+  const out = runDoctor(w);
+  assert(/model value is invalid/.test(out), 'reports invalid model', out);
+  const before = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  assert(typeof before.model === 'string', 'model untouched without --fix');
+  const fixOut = runDoctor(w, true);
+  const s = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  assert(/Removed invalid model value/.test(fixOut), 'reports removal under --fix', fixOut);
+  assert(!('model' in s), 'model key removed from disk');
+  assert(s.hooks.SessionStart.length === 1, 'hooks untouched by model fix');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 4: valid model values are left alone (including bracketed 1M-context IDs)');
+{
+  const w = setupHome(() => ({ model: 'claude-fable-5[1m]', hooks: {} }));
+  const out = runDoctor(w, true);
+  const s = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  assert(!/model value is invalid/.test(out), 'no invalid-model report for bracketed 1M id', out);
+  assert(s.model === 'claude-fable-5[1m]', 'legitimate 1M-context model preserved');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 5: malformed settings.json warns, skips, file untouched');
+{
+  const w = setupHome(() => '{ this is not json\n');
+  const before = readFileSync(w.settingsPath, 'utf-8');
+  const out = runDoctor(w, true);
+  const after = readFileSync(w.settingsPath, 'utf-8');
+  assert(/not valid JSON; skipping hook\/model checks/.test(out), 'warns about malformed JSON', out);
+  assert(before === after, 'malformed file untouched');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+if (failed > 0) {
+  console.log(`\n${failed} assertion(s) failed`);
+  process.exit(1);
+}
+console.log('\nAll doctor hook-dedupe tests passed');

package/scripts/test-install-prompt-policy.mjs

@@ -0,0 +1,84 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = fileURLToPath(new URL("..", import.meta.url));
+
+const files = [
+  "README.md",
+  "SKILL.md",
+  "shared/templates/install-prompt.md",
+];
+
+const contents = Object.fromEntries(
+  files.map((file) => [file, readFileSync(join(repoRoot, file), "utf8")]),
+);
+
+const failures = [];
+
+for (const file of ["README.md", "shared/templates/install-prompt.md"]) {
+  const text = contents[file];
+  for (const phrase of [
+    "Use the install document and live local checks as the source of truth.",
+    "Do not search memory or prior notes for this install. Do not pre-load context from `MEMORY.md`, `crystal_search`, local skill dev guides, or other local memory before fetching the install document.",
+    "Do not run GitHub commands during this install flow. Do not run or request approval for `gh release`, `gh api`, or `gh search`.",
+    "If release notes are not available from local or npm metadata, say that and do not fetch them from GitHub.",
+    "If installed: run `ldm status`",
+    "check available npm tracks from the install document",
+    "If yes to dry run, use the selected track's dry-run path from the install document.",
+    "If I say install, use the selected track's install path from the install document, then run `ldm doctor`.",
+    "install the CLI first using the selected track's bootstrap command from the install document",
+    "Then run:\n`ldm init --dry-run`",
+    "If I say install, run:\n`ldm init`",
+  ]) {
+    if (!text.includes(phrase)) {
+      failures.push(`${file} missing install prompt phrase: ${phrase}`);
+    }
+  }
+  if (text.includes("If it is, run ldm install --dry-run")) {
+    failures.push(`${file} still tells installed users to start with ldm install --dry-run`);
+  }
+}
+
+const skill = contents["SKILL.md"];
+for (const phrase of [
+  "Memory policy for install flows: do not consult `MEMORY.md`, do not run `crystal_search`, and do not search prior notes when this skill is invoked, including in any parallel or batched exploration step.",
+  "The only context sources for this install flow are `https://wip.computer/install/wip-ldm-os.txt` and the live local commands that document prescribes.",
+  "Read that document and run those commands. Do not pre-load other context.",
+  "Do not run GitHub commands during the install-state flow.",
+  "Do not run or request approval for `gh release list`, `gh release view`, `gh api repos/*`, `gh search`, or any other GitHub query unless the user explicitly asks for release notes.",
+  "npm view @wipcomputer/wip-ldm-os dist-tags --json",
+  "The README prompt should stay short. This install document owns the detailed track rules.",
+  "stable/current/latest: `ldm install --dry-run`",
+  "beta/latest beta: `ldm install --beta --dry-run`",
+  "alpha/latest alpha: `ldm install --alpha --dry-run`",
+  "beta/latest beta: `npm install -g @wipcomputer/wip-ldm-os@beta`",
+  "alpha/latest alpha: `npm install -g @wipcomputer/wip-ldm-os@alpha`",
+  "Use the output of `ldm status`, installed package metadata, and npm metadata.",
+  "Do not use GitHub commands here.",
+  "If npm metadata for a package does not include release notes:",
+  "Say \"release notes not available from local metadata.\"",
+  "Do not infer release-note content from package descriptions, commit messages, or repo READMEs.",
+  "An approval dialog is not a user request.",
+]) {
+  if (!skill.includes(phrase)) {
+    failures.push(`SKILL.md missing install policy phrase: ${phrase}`);
+  }
+}
+
+if (/gh release (list|view) --repo/.test(skill)) {
+  failures.push("SKILL.md still includes concrete gh release commands in the install flow");
+}
+
+const temporalMemoryPolicyPhrase = "your first action is " + "to fetch";
+if (skill.includes(temporalMemoryPolicyPhrase)) {
+  failures.push("SKILL.md still uses temporal first-action memory-policy phrasing");
+}
+
+if (failures.length > 0) {
+  console.error("install prompt policy checks failed:");
+  for (const failure of failures) console.error(`  - ${failure}`);
+  process.exit(1);
+}
+
+console.log("install-prompt-policy: LDM OS prompt and install doc agree");

package/scripts/test-installer-skill-directory.mjs

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+const home = mkdtempSync(join(tmpdir(), 'ldm-skill-dir-home-'));
+const source = mkdtempSync(join(tmpdir(), 'ldm-skill-dir-source-'));
+
+function assert(condition, message) {
+  if (!condition) throw new Error(message);
+}
+
+try {
+  process.env.HOME = home;
+
+  for (const dir of ['.claude', '.openclaw', '.codex', '.agents']) {
+    mkdirSync(join(home, dir), { recursive: true });
+  }
+
+  const skillDir = join(source, 'skills', 'wip-ai-chat-ui');
+  mkdirSync(join(skillDir, 'references'), { recursive: true });
+  mkdirSync(join(skillDir, 'agents'), { recursive: true });
+  writeFileSync(join(skillDir, 'SKILL.md'), '---\nname: wip-ai-chat-ui\ndescription: "test skill"\n---\n\n# Test Skill\n');
+  writeFileSync(join(skillDir, 'references', 'stack.md'), '# Stack\n');
+  writeFileSync(join(skillDir, 'agents', 'openai.yaml'), 'display_name: "WIP AI Chat UI"\n');
+
+  const { detectInterfacesJSON } = await import('../lib/detect.mjs');
+  const detected = detectInterfacesJSON(source);
+  assert(detected.interfaceCount === 1, 'skill directory repo should expose one interface');
+  assert(detected.interfaces.skill?.skills?.[0]?.name === 'wip-ai-chat-ui', 'skill directory name should be detected');
+
+  const { installFromPath } = await import('../lib/deploy.mjs');
+  const result = await installFromPath(source);
+  assert(result.interfaces === 1, 'skill directory install should process one interface');
+
+  for (const target of [
+    join(home, '.claude', 'skills', 'wip-ai-chat-ui'),
+    join(home, '.openclaw', 'skills', 'wip-ai-chat-ui'),
+    join(home, '.codex', 'skills', 'wip-ai-chat-ui'),
+    join(home, '.agents', 'skills', 'wip-ai-chat-ui'),
+  ]) {
+    assert(existsSync(join(target, 'SKILL.md')), `${target} should include SKILL.md`);
+    assert(existsSync(join(target, 'references', 'stack.md')), `${target} should include references`);
+    assert(existsSync(join(target, 'agents', 'openai.yaml')), `${target} should include agents metadata`);
+    assert(!lstatSync(target).isSymbolicLink(), `${target} should be a deployed directory, not a symlink`);
+  }
+
+  const codexSkill = readFileSync(join(home, '.codex', 'skills', 'wip-ai-chat-ui', 'SKILL.md'), 'utf8');
+  assert(codexSkill.includes('name: wip-ai-chat-ui'), 'Codex target should contain the expected skill');
+
+  console.log('installer skill directory regression passed');
+} finally {
+  rmSync(home, { recursive: true, force: true });
+  rmSync(source, { recursive: true, force: true });
+}

package/scripts/test-installer-skill-dry-run-destinations.mjs

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+const home = mkdtempSync(join(tmpdir(), 'ldm-skill-dry-run-home-'));
+const source = mkdtempSync(join(tmpdir(), 'ldm-skill-dry-run-source-'));
+
+function assert(condition, message) {
+  if (!condition) throw new Error(message);
+}
+
+try {
+  process.env.HOME = home;
+
+  for (const dir of ['.claude', '.openclaw', '.codex', '.agents']) {
+    mkdirSync(join(home, dir), { recursive: true });
+  }
+
+  const workspace = join(home, 'workspace');
+  mkdirSync(workspace, { recursive: true });
+  mkdirSync(join(home, '.ldm'), { recursive: true });
+  writeFileSync(join(home, '.ldm', 'config.json'), JSON.stringify({
+    workspace,
+    harnesses: {
+      'claude-code': {
+        detected: true,
+        home: join(home, '.claude'),
+        skills: join(home, '.claude', 'skills'),
+      },
+      openclaw: {
+        detected: true,
+        home: join(home, '.openclaw'),
+        skills: join(home, '.openclaw', 'skills'),
+      },
+      codex: {
+        detected: true,
+        home: join(home, '.codex'),
+        skills: join(home, '.codex', 'skills'),
+      },
+      'wip-agents': {
+        detected: true,
+        home: join(home, '.agents'),
+        skills: join(home, '.agents', 'skills'),
+      },
+    },
+  }, null, 2));
+
+  mkdirSync(join(source, 'references'), { recursive: true });
+  mkdirSync(join(source, 'agents'), { recursive: true });
+  writeFileSync(join(source, 'package.json'), JSON.stringify({
+    name: '@wipcomputer/wip-ai-chat-ui',
+    version: '0.1.1',
+  }, null, 2));
+  writeFileSync(join(source, 'SKILL.md'), '---\nname: wip-ai-chat-ui\ndescription: "test skill"\n---\n\n# Test Skill\n');
+  writeFileSync(join(source, 'references', 'stack.md'), '# Stack\n');
+  writeFileSync(join(source, 'agents', 'openai.yaml'), 'display_name: "WIP AI Chat UI"\n');
+
+  const { setFlags, installFromPath } = await import('../lib/deploy.mjs');
+
+  const lines = [];
+  const originalLog = console.log;
+  console.log = (...args) => lines.push(args.join(' '));
+
+  try {
+    setFlags({ dryRun: true, jsonOutput: false });
+    const result = await installFromPath(source);
+    assert(result.interfaces === 1, 'dry run should process one skill interface');
+  } finally {
+    console.log = originalLog;
+  }
+
+  const output = lines.join('\n');
+
+  for (const expected of [
+    'Would copy:',
+    '- SKILL.md',
+    '- references/',
+    '- agents/',
+    'Permanent copy:',
+    join(home, '.ldm', 'extensions', 'wip-ai-chat-ui', 'SKILL.md'),
+    join(home, '.ldm', 'extensions', 'wip-ai-chat-ui', 'references/'),
+    'Agent skill targets:',
+    `claude-code: ${join(home, '.claude', 'skills', 'wip-ai-chat-ui')}`,
+    join(home, '.claude', 'skills', 'wip-ai-chat-ui', 'SKILL.md'),
+    `openclaw: ${join(home, '.openclaw', 'skills', 'wip-ai-chat-ui')}`,
+    join(home, '.openclaw', 'skills', 'wip-ai-chat-ui', 'references/'),
+    `codex: ${join(home, '.codex', 'skills', 'wip-ai-chat-ui')}`,
+    `wip-agents: ${join(home, '.agents', 'skills', 'wip-ai-chat-ui')}`,
+    'Workspace docs target:',
+    `${join(workspace, 'settings', 'docs', 'skills', 'wip-ai-chat-ui')} (references/ only)`,
+  ]) {
+    assert(output.includes(expected), `dry-run output should include ${expected}\n\n${output}`);
+  }
+
+  console.log('installer skill dry-run destinations regression passed');
+} finally {
+  rmSync(home, { recursive: true, force: true });
+  rmSync(source, { recursive: true, force: true });
+}

package/scripts/test-installer-target-self-update.mjs

@@ -0,0 +1,131 @@
+#!/usr/bin/env node
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const root = dirname(dirname(fileURLToPath(import.meta.url)));
+const cli = readFileSync(join(root, 'bin', 'ldm.js'), 'utf8');
+
+const helperName = 'function maybeSelfUpdateLdmCliBeforeInstall()';
+const helperIdx = cli.indexOf(helperName);
+if (helperIdx === -1) {
+  throw new Error('Missing shared LDM OS self-update preflight helper');
+}
+
+const helperBlock = cli.slice(helperIdx, cli.indexOf('// ── Dead backup trigger cleanup', helperIdx));
+if (!helperBlock.includes('Dry run only: continuing with v${PKG_VERSION}.')) {
+  throw new Error('Self-update helper must warn on dry run without updating');
+}
+
+if (!helperBlock.includes("execSync(`npm install -g @wipcomputer/wip-ldm-os@${latest}`")) {
+  throw new Error('Self-update helper must update LDM OS before real installs');
+}
+
+if (!helperBlock.includes("spawnSync('ldm'")) {
+  throw new Error('Self-update helper must re-run the original install command without shell joining args');
+}
+
+if (helperBlock.includes('process.argv.slice(2).join')) {
+  throw new Error('Self-update helper must preserve argv boundaries when re-running install');
+}
+
+const cmdInstallIdx = cli.indexOf('async function cmdInstall()');
+const lockIdx = cli.indexOf('acquireInstallLock()', cmdInstallIdx);
+const initIdx = cli.indexOf('LDM OS not initialized. Running init first', cmdInstallIdx);
+const targetIdx = cli.indexOf('// Find the target (skip flags)', cmdInstallIdx);
+const preflightCallIdx = cli.indexOf('maybeSelfUpdateLdmCliBeforeInstall();', cmdInstallIdx);
+if (cmdInstallIdx === -1 || targetIdx === -1 || preflightCallIdx === -1) {
+  throw new Error('Could not find cmdInstall self-update placement');
+}
+
+if (preflightCallIdx > lockIdx || preflightCallIdx > initIdx) {
+  throw new Error('Self-update preflight must run before lock acquisition and init work');
+}
+
+if (preflightCallIdx > targetIdx) {
+  throw new Error('Self-update preflight must run before target resolution so app installs are covered');
+}
+
+const catalogIdx = cli.indexOf('async function cmdInstallCatalog()');
+const oldCatalogBlock = cli.indexOf('Self-update: check if CLI itself is outdated', catalogIdx);
+const autoDetectIdx = cli.indexOf('autoDetectExtensions();', catalogIdx);
+if (oldCatalogBlock !== -1 && oldCatalogBlock < autoDetectIdx) {
+  throw new Error('Catalog install should not own the only self-update block');
+}
+
+const tempRoot = mkdtempSync(join(tmpdir(), 'ldm-target-self-update-'));
+try {
+  const home = join(tempRoot, 'home');
+  const fakeBin = join(tempRoot, 'bin');
+  const target = join(tempRoot, 'target skill with spaces');
+
+  mkdirSync(join(home, '.ldm'), { recursive: true });
+  writeFileSync(join(home, '.ldm', 'version.json'), JSON.stringify({
+    version: '0.0.0',
+    installed: new Date().toISOString(),
+    updated: new Date().toISOString(),
+  }, null, 2) + '\n');
+
+  mkdirSync(fakeBin, { recursive: true });
+  const fakeNpm = join(fakeBin, 'npm');
+  writeFileSync(fakeNpm, `#!/usr/bin/env bash
+if [ "$1" = "view" ] && [ "$2" = "@wipcomputer/wip-ldm-os" ] && [ "$3" = "dist-tags.alpha" ]; then
+  echo "99.0.0-alpha.1"
+  exit 0
+fi
+echo "unexpected npm command: $*" >&2
+exit 64
+`);
+  chmodSync(fakeNpm, 0o755);
+
+  mkdirSync(target, { recursive: true });
+  writeFileSync(join(target, 'SKILL.md'), `---
+name: test-target-skill
+description: Test target skill for installer self-update dry-run checks.
+---
+
+# Test Target Skill
+`);
+
+  const result = spawnSync(process.execPath, [
+    join(root, 'bin', 'ldm.js'),
+    'install',
+    '--alpha',
+    '--dry-run',
+    target,
+  ], {
+    cwd: root,
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      HOME: home,
+      PATH: `${fakeBin}:${process.env.PATH || ''}`,
+    },
+  });
+
+  if (result.status !== 0) {
+    throw new Error(`Runtime dry-run exited ${result.status}\nstdout:\n${result.stdout}\nstderr:\n${result.stderr}`);
+  }
+
+  if (!result.stdout.includes('LDM OS CLI v')) {
+    throw new Error(`Runtime dry-run did not print the LDM OS skew warning\nstdout:\n${result.stdout}`);
+  }
+
+  if (!result.stdout.includes('-> v99.0.0-alpha.1 (alpha track) is available.')) {
+    throw new Error(`Runtime dry-run did not include the selected alpha track version\nstdout:\n${result.stdout}`);
+  }
+
+  if (!result.stdout.includes('Dry run only: continuing with v')) {
+    throw new Error(`Runtime dry-run did not say it would continue without updating\nstdout:\n${result.stdout}`);
+  }
+
+  if (!result.stdout.includes('Installing: target skill with spaces (dry run)')) {
+    throw new Error(`Runtime dry-run did not continue to the targeted install preview\nstdout:\n${result.stdout}`);
+  }
+} finally {
+  rmSync(tempRoot, { recursive: true, force: true });
+}
+
+console.log('targeted install self-update regression checks passed');