fix: harden and simplify Linux system install

Tighten shim detection, profile repair, and install ordering while
trimming over-specific doctor/info hints from the system-install path.

Co-authored-by: Cursor <cursoragent@cursor.com>

cmd/setup/doctor.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"slices"
 
 	"github.com/safedep/pmg/config"
 	"github.com/safedep/pmg/internal/alias"
@@ -120,12 +119,6 @@ func runCoreChecks(cfg *config.RuntimeConfig) []doctor.CheckResult {
 			Name:     checkShellAliases,
 			Category: "Shell Integration",
 			Run: func() doctor.CheckResult {
-				if shim.SystemShimsInstalled() {
-					return doctor.CheckResult{
-						Status:  doctor.StatusPass,
-						Message: "System shims installed (aliases optional)",
-					}
-				}
 				aliasCfg := alias.DefaultConfig()
 				rcFileManager, err := alias.NewDefaultRcFileManager(aliasCfg.RcFileName)
 				if err != nil {
@@ -142,15 +135,21 @@ func runCoreChecks(cfg *config.RuntimeConfig) []doctor.CheckResult {
 						Message: fmt.Sprintf("Could not determine alias status: %v", err),
 					}
 				}
-				if !installed {
+				if installed {
 					return doctor.CheckResult{
-						Status:  doctor.StatusFail,
-						Message: "Aliases not installed",
+						Status:  doctor.StatusPass,
+						Message: "Shell aliases installed",
+					}
+				}
+				if shim.SystemShimsInstalled() {
+					return doctor.CheckResult{
+						Status:  doctor.StatusWarn,
+						Message: "Aliases not installed (optional with system shims)",
 					}
 				}
 				return doctor.CheckResult{
-					Status:  doctor.StatusPass,
-					Message: "Shell aliases installed",
+					Status:  doctor.StatusFail,
+					Message: "Aliases not installed",
 				}
 			},
 		},
@@ -190,33 +189,29 @@ func runCoreChecks(cfg *config.RuntimeConfig) []doctor.CheckResult {
 			Category: "Shell Integration",
 			Run: func() doctor.CheckResult {
 				pathEntries := filepath.SplitList(os.Getenv("PATH"))
-				if shim.SystemShimsInstalled() {
-					systemDir := shim.SystemBinDir()
-					if slices.Contains(pathEntries, systemDir) {
-						return doctor.CheckResult{
-							Status:  doctor.StatusPass,
-							Message: "System shim directory is in PATH",
-						}
-					}
+				systemDir := shim.SystemBinDir()
+				if shim.SystemShimsInstalled() && pathContainsDir(pathEntries, systemDir) {
 					return doctor.CheckResult{
-						Status:  doctor.StatusFail,
-						Message: fmt.Sprintf("System shim directory not in PATH (add ENV PATH=\"%s:$PATH\" for Docker RUN)", systemDir),
+						Status:  doctor.StatusPass,
+						Message: "System shim directory is in PATH",
 					}
 				}
-				sm, err := shim.NewDefaultShimManager()
-				if err != nil {
-					return doctor.CheckResult{
-						Status:  doctor.StatusWarn,
-						Message: fmt.Sprintf("Could not check shims: %v", err),
-					}
+				userDir := ""
+				if home, err := os.UserHomeDir(); err == nil {
+					userDir = filepath.Join(home, ".pmg", "bin")
 				}
-				shimDir := sm.GetBinDir()
-				if slices.Contains(pathEntries, shimDir) {
+				if pathContainsDir(pathEntries, userDir) {
 					return doctor.CheckResult{
 						Status:  doctor.StatusPass,
 						Message: "Shim directory is in PATH",
 					}
 				}
+				if shim.SystemShimsInstalled() {
+					return doctor.CheckResult{
+						Status:  doctor.StatusFail,
+						Message: "System shim directory not in PATH",
+					}
+				}
 				return doctor.CheckResult{
 					Status:  doctor.StatusFail,
 					Message: "Shim directory not in PATH",
@@ -307,6 +302,19 @@ func runCoreChecks(cfg *config.RuntimeConfig) []doctor.CheckResult {
 	return doctor.RunChecks(checks)
 }
 
+func pathContainsDir(pathEntries []string, dir string) bool {
+	if dir == "" {
+		return false
+	}
+	cleanDir := filepath.Clean(dir)
+	for _, entry := range pathEntries {
+		if filepath.Clean(entry) == cleanDir {
+			return true
+		}
+	}
+	return false
+}
+
 func runProtectionChecks(coreResults []doctor.CheckResult) []doctor.CheckResult {
 	if !isInterceptionActive(coreResults) {
 		var results []doctor.CheckResult
@@ -366,15 +374,15 @@ var checkDisplayNames = map[string]string{
 var checkFixes = map[string]string{
 	checkConfigFile:         "pmg setup install",
 	checkEventLogDir:        "pmg setup install",
-	checkShellAliases:       "pmg setup install [--system]",
-	checkShimDirectory:      "pmg setup install [--system]",
-	checkShimInPath:         "Restart shell, source profile, or set ENV PATH for Docker",
+	checkShellAliases:       "pmg setup install",
+	checkShimDirectory:      "pmg setup install",
+	checkShimInPath:         "Restart shell or source profile",
 	checkProxyMode:          "Set proxy.enabled: true in config",
 	checkSandbox:            "Set sandbox.enabled: true in config",
 	checkDependencyCooldown: "Set dependency_cooldown.enabled: true in config",
 	checkEventLogging:       "Set skip_event_logging: false in config",
-	checkProtectionNpm:      "pmg setup install [--system]",
-	checkProtectionPip:      "pmg setup install [--system]",
+	checkProtectionNpm:      "pmg setup install",
+	checkProtectionPip:      "pmg setup install",
 	checkCA:                 "pmg setup cert install",
 }
 

cmd/setup/doctor_system_test.go

@@ -0,0 +1,23 @@
+package setup
+
+import (
+	"testing"
+
+	"github.com/safedep/pmg/internal/doctor"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPathContainsDir(t *testing.T) {
+	assert.True(t, pathContainsDir([]string{"/usr/local/lib/pmg/bin/"}, "/usr/local/lib/pmg/bin"))
+	assert.False(t, pathContainsDir([]string{"/usr/local/bin"}, "/usr/local/lib/pmg/bin"))
+	assert.False(t, pathContainsDir([]string{"/usr/bin"}, ""))
+}
+
+func TestSystemShimsWithoutPathDoNotActivateInterception(t *testing.T) {
+	results := []doctor.CheckResult{
+		{Name: checkShellAliases, Status: doctor.StatusWarn},
+		{Name: checkShimInPath, Status: doctor.StatusFail},
+	}
+
+	assert.False(t, isInterceptionActive(results))
+}

cmd/setup/info.go

@@ -80,10 +80,10 @@ func executeSetupInfo() error {
 	shellEntries["Detected Shell"] = shell
 	shellEntries["Alias Installed"] = strconv.FormatBool(isInstalled)
 	shellEntries["User Shims"] = strconv.FormatBool(shim.UserShimsInstalled())
-	shellEntries["System Shims"] = strconv.FormatBool(shim.SystemShimsInstalled())
-	shellEntries["System Profile"] = strconv.FormatBool(shim.SystemProfileInstalled())
 	if shim.SystemShimsInstalled() {
-		shellEntries["System Shim Dir"] = shim.SystemBinDir()
+		shellEntries["System Shims"] = shim.SystemBinDir()
+	} else {
+		shellEntries["System Shims"] = "not installed"
 	}
 	ui.PrintInfoSection("Shell Integration", shellEntries)
 

cmd/setup/setup.go

@@ -16,12 +16,6 @@ import (
 	"github.com/spf13/cobra"
 )
 
-var (
-	setupRemoveConfigFile bool
-	setupInstallSystem    bool
-	setupRemoveSystem     bool
-)
-
 var setupGeteuid = os.Geteuid
 
 func NewSetupCommand() *cobra.Command {
@@ -45,21 +39,22 @@ func NewSetupCommand() *cobra.Command {
 }
 
 func NewInstallCommand() *cobra.Command {
+	var system bool
 	cmd := &cobra.Command{
 		Use:          "install",
 		Short:        "Setup PMG config, aliases, and shims for package managers (npm, pnpm, pip, and more)",
 		SilenceUsage: true,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			fmt.Print(ui.GeneratePMGBanner(version.Version, version.Commit))
-			return install()
+			return install(system)
 		},
 	}
-	cmd.Flags().BoolVar(&setupInstallSystem, "system", false, "Install system-wide for all users (Linux, requires root)")
+	cmd.Flags().BoolVar(&system, "system", false, "Install system-wide for all users (Linux, requires root)")
 	return cmd
 }
 
-func install() error {
-	if setupInstallSystem {
+func install(system bool) error {
+	if system {
 		return installSystem()
 	}
 
@@ -114,45 +109,50 @@ func installSystem() error {
 		return err
 	}
 
-	if err := config.WriteSystemTemplateConfig(); err != nil {
-		return fmt.Errorf("failed to write system config: %w", err)
-	}
-
 	shimMgr, err := shim.NewSystemShimManager()
 	if err != nil {
 		return fmt.Errorf("failed to create system shim manager: %w", err)
 	}
 
+	// Shims/profile first so a failed config write does not leave a managed
+	// config active without interception.
 	if err := shimMgr.Install(); err != nil {
 		return fmt.Errorf("failed to install system shims: %w", err)
 	}
+	if err := config.WriteSystemTemplateConfig(); err != nil {
+		return fmt.Errorf("failed to write system config: %w", err)
+	}
 
 	ui.PrintSetupSystemInstallCmdInfo(shimMgr.GetBinDir(), config.SystemConfigDir(), shim.SystemProfilePath())
 	return nil
 }
 
 func NewRemoveCommand() *cobra.Command {
+	var (
+		removeConfig bool
+		system       bool
+	)
 	cmd := &cobra.Command{
 		Use:          "remove",
 		Short:        "Removes pmg aliases and shims from the user's shell config.",
 		SilenceUsage: true,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			fmt.Print(ui.GeneratePMGBanner(version.Version, version.Commit))
-			return remove()
+			return remove(system, removeConfig)
 		},
 	}
 
-	cmd.Flags().BoolVar(&setupRemoveConfigFile, "config-file", false, "Remove the config file")
-	cmd.Flags().BoolVar(&setupRemoveSystem, "system", false, "Remove system-wide install (Linux, requires root)")
+	cmd.Flags().BoolVar(&removeConfig, "config-file", false, "Remove the config file")
+	cmd.Flags().BoolVar(&system, "system", false, "Remove system-wide install (Linux, requires root)")
 	return cmd
 }
 
-func remove() error {
-	if setupRemoveSystem {
-		return removeSystem()
+func remove(system, removeConfig bool) error {
+	if system {
+		return removeSystem(removeConfig)
 	}
 
-	if setupRemoveConfigFile {
+	if removeConfig {
 		// Only ever remove the per-user file; the globally managed
 		// config is not ours to delete from a per-user uninstall.
 		if err := config.RemoveUserConfigFile(); err != nil {
@@ -189,17 +189,11 @@ func remove() error {
 	return nil
 }
 
-func removeSystem() error {
+func removeSystem(removeConfig bool) error {
 	if err := errIfSystemInstallAllowed(); err != nil {
 		return err
 	}
 
-	if setupRemoveConfigFile {
-		if err := config.RemoveSystemConfigFile(); err != nil {
-			return err
-		}
-	}
-
 	shimMgr, err := shim.NewSystemShimManager()
 	if err != nil {
 		return fmt.Errorf("failed to create system shim manager: %w", err)
@@ -208,6 +202,11 @@ func removeSystem() error {
 	if err := shimMgr.Remove(); err != nil {
 		return fmt.Errorf("failed to remove system shims: %w", err)
 	}
+	if removeConfig {
+		if err := config.RemoveSystemConfigFile(); err != nil {
+			return err
+		}
+	}
 
 	fmt.Printf("%s %s\n", ui.Colors.Green("✓"), "PMG system install removed")
 	return nil

cmd/setup/setup_test.go

@@ -37,30 +37,19 @@ func TestErrIfSystemInstallAllowed(t *testing.T) {
 	}
 }
 
-func TestInstallSystemRequiresLinuxAndRoot(t *testing.T) {
+func TestInstallSystemRequiresRoot(t *testing.T) {
 	orig := setupGeteuid
-	t.Cleanup(func() {
-		setupGeteuid = orig
-		setupInstallSystem = false
-	})
+	t.Cleanup(func() { setupGeteuid = orig })
 
-	setupInstallSystem = true
-	setupGeteuid = func() int { return 0 }
-
-	err := install()
-	if runtime.GOOS == "linux" {
-		if err != nil {
-			usefulErr, ok := usefulerror.AsUsefulError(err)
-			if ok {
-				assert.NotEqual(t, errcodes.UnsupportedPlatform, usefulErr.Code())
-				assert.NotEqual(t, errcodes.PermissionDenied, usefulErr.Code())
-			}
-		}
-		return
-	}
+	setupGeteuid = func() int { return 1000 }
 
+	err := install(true)
 	require.Error(t, err)
 	usefulErr, ok := usefulerror.AsUsefulError(err)
 	require.True(t, ok)
-	assert.Equal(t, errcodes.UnsupportedPlatform, usefulErr.Code())
+	if runtime.GOOS == "linux" {
+		assert.Equal(t, errcodes.PermissionDenied, usefulErr.Code())
+	} else {
+		assert.Equal(t, errcodes.UnsupportedPlatform, usefulErr.Code())
+	}
 }

docs/system-install.md

@@ -14,6 +14,7 @@ sudo pmg setup remove --system --config-file   # also remove the system config f
 ```
 
 Per-user `pmg setup install` remains available and does not conflict with a system install.
+The PMG executable used during setup must be executable by every user. Install PMG under a system path such as `/usr/local/bin`.
 
 ## Files created
 
@@ -56,7 +57,7 @@ pmg setup doctor
 Docker `RUN` does not load `/etc/profile.d`. After system install you **must** set `ENV PATH` so build steps and the runtime container see the shims:
 
 ```dockerfile
-FROM ubuntu:24.04
+FROM node:22-bookworm
 
 RUN curl -fsSL https://raw.githubusercontent.com/safedep/pmg/main/install.sh | sh \
  && pmg setup install --system
@@ -65,7 +66,10 @@ RUN curl -fsSL https://raw.githubusercontent.com/safedep/pmg/main/install.sh | s
 ENV PATH="/usr/local/lib/pmg/bin:$PATH"
 
 # Optional: switch user; PATH from ENV still applies
-USER appuser
+RUN mkdir -p /app && chown node:node /app
+WORKDIR /app
+USER node
+COPY --chown=node:node package*.json ./
 RUN npm ci
 ```
 
@@ -73,6 +77,8 @@ Derived images inherit that `ENV`. Later `RUN npm install` / `RUN pip install` g
 
 If a child Dockerfile sets `ENV PATH=...` again, keep `/usr/local/lib/pmg/bin` ahead of the real `npm`/`pip` directories. Leaving it out (or behind those toolchains) drops interception.
 
+PMG running on the Docker host cannot inspect package installations inside `docker build`. PMG must be installed in the image as shown above.
+
 ## Configuration
 
 The system config file is authoritative for every user. A per-user `config.yml` is ignored while `/etc/safedep/pmg/config.yml` exists.
@@ -86,8 +92,8 @@ Optional lockdown (`global_lockdown: true`) is documented in [config.md](./confi
 - **Virtualenv.** After `source .venv/bin/activate`, bare `pip` uses the venv binary and skips PMG shims. Call `pmg pip …` explicitly.
 - **No shell aliases.** System install only installs PATH shims. There is no `~/.pmg.rc` alias layer.
 - **Config changes.** `pmg config set` and `pmg config edit` are unavailable while the system config is active. Edit `/etc/safedep/pmg/config.yml` as root, or redeploy the file.
-- **Custom sandbox** `policy_templates`**.** Relative paths in the system config resolve under each user's config directory, not `/etc/safedep/pmg`. Prefer absolute paths.
-- `pmg sandbox allow`**.** Blocked when the system config sets `global_lockdown: true`.
+- **Custom sandbox `policy_templates`.** Relative paths in the system config resolve under each user's config directory, not `/etc/safedep/pmg`. Prefer absolute paths.
+- **`pmg sandbox allow`.** Blocked when the system config sets `global_lockdown: true`.
 
 
 ## User data directories

internal/shim/path.go

@@ -50,6 +50,9 @@ func FilterPMGFromPath(pathEnv string) string {
 		if strings.HasSuffix(entry, pmgBinSuffix) {
 			continue
 		}
+		if filepath.Clean(entry) == filepath.Clean(SystemBinDir()) {
+			continue
+		}
 		if shimDir != "" && filepath.Clean(entry) == shimDir {
 			continue
 		}

internal/shim/path_test.go

@@ -58,6 +58,11 @@ func TestFilterPMGFromPath(t *testing.T) {
 			shimEnv:  "/usr/local/lib/pmg/bin/npm",
 			expected: "/usr/local/bin:/usr/bin",
 		},
+		{
+			name:     "system shim dir is stripped without env var",
+			path:     "/usr/local/lib/pmg/bin:/usr/local/bin:/usr/bin",
+			expected: "/usr/local/bin:/usr/bin",
+		},
 		{
 			name:     "env var strips arbitrary shim dir",
 			path:     "/shims:/usr/local/bin:/usr/bin",

internal/shim/shim.go

@@ -10,7 +10,10 @@ import (
 	"github.com/safedep/pmg/internal/alias"
 )
 
-const shimMarker = "PMG shims"
+const (
+	shimMarker       = "PMG shims"
+	shimScriptMarker = "# PMG shim - do not edit, managed by pmg setup"
+)
 
 type ShimConfig struct {
 	BinDir          string
@@ -91,8 +94,8 @@ func (m *ShimManager) Install() error {
 }
 
 func (m *ShimManager) Remove() error {
-	if err := os.RemoveAll(m.config.BinDir); err != nil && !os.IsNotExist(err) {
-		log.Warnf("Warning: failed to remove shim directory: %v", err)
+	if err := os.RemoveAll(m.config.BinDir); err != nil {
+		return fmt.Errorf("failed to remove shim directory %s: %w", m.config.BinDir, err)
 	}
 
 	if m.config.ManageProfile {
@@ -142,7 +145,7 @@ func (m *ShimManager) writeShimScript(pm string) error {
 	pmgBin := shellQuote(m.config.PMGBin)
 
 	content := fmt.Sprintf(`#!/bin/sh
-# PMG shim - do not edit, managed by pmg setup
+%s
 PMG_BIN=%s
 if [ ! -x "$PMG_BIN" ]; then
   echo "[pmg] error: PMG binary not found or not executable: $PMG_BIN" >&2
@@ -152,7 +155,7 @@ fi
 PMG_SHIM_PATH=$(cd -- "$(dirname -- "$0")" && pwd)/$(basename -- "$0")
 export PMG_SHIM_PATH
 exec "$PMG_BIN" %s "$@"
-`, pmgBin, pm)
+`, shimScriptMarker, pmgBin, pm)
 
 	return os.WriteFile(shimPath, []byte(content), 0o755)
 }

internal/shim/shim_test.go

@@ -68,6 +68,18 @@ func TestShimManagerInstall(t *testing.T) {
 	assert.Contains(t, string(fishContent), ".pmg/bin")
 }
 
+func TestShimManagerRemoveReturnsDirectoryError(t *testing.T) {
+	root := t.TempDir()
+	blocker := filepath.Join(root, "blocker")
+	require.NoError(t, os.WriteFile(blocker, []byte("not a directory"), 0o644))
+
+	mgr := NewShimManager(ShimConfig{
+		BinDir: filepath.Join(blocker, "bin"),
+	})
+
+	assert.Error(t, mgr.Remove())
+}
+
 func TestShimManagerInstallIdempotent(t *testing.T) {
 	homeDir := t.TempDir()
 	binDir := filepath.Join(homeDir, ".pmg", "bin")

internal/shim/system.go

@@ -15,9 +15,8 @@ const (
 	systemProfileMarker      = "PMG system shims"
 )
 
-// systemBinDirOverride and systemProfilePathOverride replace the OS-level
-// system install paths. They exist only for tests within this package. There
-// is intentionally no env var or flag for them.
+// These overrides replace OS-level system install paths in tests. There is
+// intentionally no env var or flag for them.
 var (
 	systemBinDirOverride      string
 	systemProfilePathOverride string
@@ -48,6 +47,10 @@ func NewSystemShimManager() (*ShimManager, error) {
 		return nil, err
 	}
 
+	if err := validateSystemExecutable(pmgBin); err != nil {
+		return nil, err
+	}
+
 	return &ShimManager{
 		config: ShimConfig{
 			BinDir:          SystemBinDir(),
@@ -59,6 +62,19 @@ func NewSystemShimManager() (*ShimManager, error) {
 	}, nil
 }
 
+// validateSystemExecutable rejects binaries other users cannot execute. System shims hard-code this path.
+func validateSystemExecutable(path string) error {
+	info, err := os.Stat(path)
+	if err != nil {
+		return fmt.Errorf("failed to inspect pmg executable %s: %w", path, err)
+	}
+
+	if info.Mode().Perm()&0o001 == 0 {
+		return fmt.Errorf("pmg executable %s is not executable by all users", path)
+	}
+	return nil
+}
+
 // SystemShimsInstalled reports whether the system shim directory contains at
 // least one shim script.
 func SystemShimsInstalled() bool {
@@ -71,7 +87,11 @@ func shimsPresent(dir string) bool {
 		return false
 	}
 	for _, e := range entries {
-		if !e.IsDir() {
+		if e.IsDir() {
+			continue
+		}
+		content, err := os.ReadFile(filepath.Join(dir, e.Name()))
+		if err == nil && strings.Contains(string(content), shimScriptMarker) {
 			return true
 		}
 	}
@@ -91,19 +111,25 @@ func SystemProfileInstalled() bool {
 func writeSystemProfile() error {
 	binDir := SystemBinDir()
 	path := SystemProfilePath()
+
 	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 		return fmt.Errorf("failed to create profile.d directory: %w", err)
 	}
 
-	if data, err := os.ReadFile(path); err == nil && strings.Contains(string(data), systemProfileMarker) {
-		return nil
-	}
-
 	content := fmt.Sprintf(`# %s - managed by pmg setup install --system
 # remove by running: pmg setup remove --system
 export PATH="%s:$PATH"
 `, systemProfileMarker, binDir)
 
+	data, err := os.ReadFile(path)
+	if err == nil && string(data) == content {
+		return nil
+	}
+
+	if err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("failed to read system profile %s: %w", path, err)
+	}
+
 	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
 		return fmt.Errorf("failed to write system profile %s: %w", path, err)
 	}

internal/shim/system_test.go

@@ -37,6 +37,8 @@ func TestSystemShimManagerInstallAndRemove(t *testing.T) {
 	content, err := os.ReadFile(npmShim)
 	require.NoError(t, err)
 	assert.Contains(t, string(content), "export PMG_SHIM_PATH")
+	assert.Contains(t, string(content), "pmg setup install")
+	assert.Contains(t, string(content), "pmg setup remove")
 
 	profile, err := os.ReadFile(SystemProfilePath())
 	require.NoError(t, err)
@@ -71,3 +73,48 @@ func TestSystemShimManagerDoesNotTouchUserRc(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, "# user bashrc\n", string(content))
 }
+
+func TestSystemShimsInstalledIgnoresUnmanagedFiles(t *testing.T) {
+	root := t.TempDir()
+	useSystemPaths(t, root)
+	require.NoError(t, os.MkdirAll(SystemBinDir(), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(SystemBinDir(), "README"), []byte("not a shim"), 0o644))
+
+	assert.False(t, SystemShimsInstalled())
+
+	require.NoError(t, os.WriteFile(
+		filepath.Join(SystemBinDir(), "npm"),
+		[]byte("#!/bin/sh\n# PMG shim - do not edit, managed by pmg setup\n"),
+		0o755,
+	))
+	assert.True(t, SystemShimsInstalled())
+}
+
+func TestWriteSystemProfileRepairsStalePath(t *testing.T) {
+	root := t.TempDir()
+	useSystemPaths(t, root)
+	require.NoError(t, os.MkdirAll(filepath.Dir(SystemProfilePath()), 0o755))
+	require.NoError(t, os.WriteFile(
+		SystemProfilePath(),
+		[]byte("# PMG system shims\nexport PATH=\"/stale/path:$PATH\"\n"),
+		0o644,
+	))
+
+	require.NoError(t, writeSystemProfile())
+
+	content, err := os.ReadFile(SystemProfilePath())
+	require.NoError(t, err)
+	assert.Contains(t, string(content), SystemBinDir())
+	assert.NotContains(t, string(content), "/stale/path")
+}
+
+func TestValidateSystemExecutableRejectsPrivateBinary(t *testing.T) {
+	privateDir := t.TempDir()
+	privateExecutable := filepath.Join(privateDir, "pmg")
+	require.NoError(t, os.WriteFile(privateExecutable, []byte("binary"), 0o700))
+
+	err := validateSystemExecutable(privateExecutable)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "not executable by all users")
+}

main.go

@@ -103,9 +103,10 @@ func main() {
 			}
 
 			if eventlogErr != nil {
-				// Soft-fail: unusable HOME (e.g. system accounts, some containers)
-				// must not prevent package-manager commands from running.
 				log.Warnf("failed to initialize event logging: %v", eventlogErr)
+				// Soft-fail: unusable HOME must not block package-manager commands.
+				ui.Infof("%s Event logging unavailable (%v); continuing without recording this run",
+					ui.Colors.Yellow("⚠"), eventlogErr)
 			}
 
 			if err := audit.Initialize(config.Get()); err != nil {