fix: harden and simplify Linux system install

Tighten shim detection, profile repair, and install ordering while
trimming over-specific doctor/info hints from the system-install path.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/shim/path.go

@@ -50,6 +50,9 @@ func FilterPMGFromPath(pathEnv string) string {
 		if strings.HasSuffix(entry, pmgBinSuffix) {
 			continue
 		}
+		if filepath.Clean(entry) == filepath.Clean(SystemBinDir()) {
+			continue
+		}
 		if shimDir != "" && filepath.Clean(entry) == shimDir {
 			continue
 		}

internal/shim/path_test.go

@@ -58,6 +58,11 @@ func TestFilterPMGFromPath(t *testing.T) {
 			shimEnv:  "/usr/local/lib/pmg/bin/npm",
 			expected: "/usr/local/bin:/usr/bin",
 		},
+		{
+			name:     "system shim dir is stripped without env var",
+			path:     "/usr/local/lib/pmg/bin:/usr/local/bin:/usr/bin",
+			expected: "/usr/local/bin:/usr/bin",
+		},
 		{
 			name:     "env var strips arbitrary shim dir",
 			path:     "/shims:/usr/local/bin:/usr/bin",

internal/shim/shim.go

@@ -10,7 +10,10 @@ import (
 	"github.com/safedep/pmg/internal/alias"
 )
 
-const shimMarker = "PMG shims"
+const (
+	shimMarker       = "PMG shims"
+	shimScriptMarker = "# PMG shim - do not edit, managed by pmg setup"
+)
 
 type ShimConfig struct {
 	BinDir          string
@@ -91,8 +94,8 @@ func (m *ShimManager) Install() error {
 }
 
 func (m *ShimManager) Remove() error {
-	if err := os.RemoveAll(m.config.BinDir); err != nil && !os.IsNotExist(err) {
-		log.Warnf("Warning: failed to remove shim directory: %v", err)
+	if err := os.RemoveAll(m.config.BinDir); err != nil {
+		return fmt.Errorf("failed to remove shim directory %s: %w", m.config.BinDir, err)
 	}
 
 	if m.config.ManageProfile {
@@ -142,7 +145,7 @@ func (m *ShimManager) writeShimScript(pm string) error {
 	pmgBin := shellQuote(m.config.PMGBin)
 
 	content := fmt.Sprintf(`#!/bin/sh
-# PMG shim - do not edit, managed by pmg setup
+%s
 PMG_BIN=%s
 if [ ! -x "$PMG_BIN" ]; then
   echo "[pmg] error: PMG binary not found or not executable: $PMG_BIN" >&2
@@ -152,7 +155,7 @@ fi
 PMG_SHIM_PATH=$(cd -- "$(dirname -- "$0")" && pwd)/$(basename -- "$0")
 export PMG_SHIM_PATH
 exec "$PMG_BIN" %s "$@"
-`, pmgBin, pm)
+`, shimScriptMarker, pmgBin, pm)
 
 	return os.WriteFile(shimPath, []byte(content), 0o755)
 }

internal/shim/shim_test.go

@@ -68,6 +68,18 @@ func TestShimManagerInstall(t *testing.T) {
 	assert.Contains(t, string(fishContent), ".pmg/bin")
 }
 
+func TestShimManagerRemoveReturnsDirectoryError(t *testing.T) {
+	root := t.TempDir()
+	blocker := filepath.Join(root, "blocker")
+	require.NoError(t, os.WriteFile(blocker, []byte("not a directory"), 0o644))
+
+	mgr := NewShimManager(ShimConfig{
+		BinDir: filepath.Join(blocker, "bin"),
+	})
+
+	assert.Error(t, mgr.Remove())
+}
+
 func TestShimManagerInstallIdempotent(t *testing.T) {
 	homeDir := t.TempDir()
 	binDir := filepath.Join(homeDir, ".pmg", "bin")

internal/shim/system.go

@@ -15,9 +15,8 @@ const (
 	systemProfileMarker      = "PMG system shims"
 )
 
-// systemBinDirOverride and systemProfilePathOverride replace the OS-level
-// system install paths. They exist only for tests within this package. There
-// is intentionally no env var or flag for them.
+// These overrides replace OS-level system install paths in tests. There is
+// intentionally no env var or flag for them.
 var (
 	systemBinDirOverride      string
 	systemProfilePathOverride string
@@ -48,6 +47,10 @@ func NewSystemShimManager() (*ShimManager, error) {
 		return nil, err
 	}
 
+	if err := validateSystemExecutable(pmgBin); err != nil {
+		return nil, err
+	}
+
 	return &ShimManager{
 		config: ShimConfig{
 			BinDir:          SystemBinDir(),
@@ -59,6 +62,19 @@ func NewSystemShimManager() (*ShimManager, error) {
 	}, nil
 }
 
+// validateSystemExecutable rejects binaries other users cannot execute. System shims hard-code this path.
+func validateSystemExecutable(path string) error {
+	info, err := os.Stat(path)
+	if err != nil {
+		return fmt.Errorf("failed to inspect pmg executable %s: %w", path, err)
+	}
+
+	if info.Mode().Perm()&0o001 == 0 {
+		return fmt.Errorf("pmg executable %s is not executable by all users", path)
+	}
+	return nil
+}
+
 // SystemShimsInstalled reports whether the system shim directory contains at
 // least one shim script.
 func SystemShimsInstalled() bool {
@@ -71,7 +87,11 @@ func shimsPresent(dir string) bool {
 		return false
 	}
 	for _, e := range entries {
-		if !e.IsDir() {
+		if e.IsDir() {
+			continue
+		}
+		content, err := os.ReadFile(filepath.Join(dir, e.Name()))
+		if err == nil && strings.Contains(string(content), shimScriptMarker) {
 			return true
 		}
 	}
@@ -91,19 +111,25 @@ func SystemProfileInstalled() bool {
 func writeSystemProfile() error {
 	binDir := SystemBinDir()
 	path := SystemProfilePath()
+
 	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 		return fmt.Errorf("failed to create profile.d directory: %w", err)
 	}
 
-	if data, err := os.ReadFile(path); err == nil && strings.Contains(string(data), systemProfileMarker) {
-		return nil
-	}
-
 	content := fmt.Sprintf(`# %s - managed by pmg setup install --system
 # remove by running: pmg setup remove --system
 export PATH="%s:$PATH"
 `, systemProfileMarker, binDir)
 
+	data, err := os.ReadFile(path)
+	if err == nil && string(data) == content {
+		return nil
+	}
+
+	if err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("failed to read system profile %s: %w", path, err)
+	}
+
 	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
 		return fmt.Errorf("failed to write system profile %s: %w", path, err)
 	}

internal/shim/system_test.go

@@ -37,6 +37,8 @@ func TestSystemShimManagerInstallAndRemove(t *testing.T) {
 	content, err := os.ReadFile(npmShim)
 	require.NoError(t, err)
 	assert.Contains(t, string(content), "export PMG_SHIM_PATH")
+	assert.Contains(t, string(content), "pmg setup install")
+	assert.Contains(t, string(content), "pmg setup remove")
 
 	profile, err := os.ReadFile(SystemProfilePath())
 	require.NoError(t, err)
@@ -71,3 +73,48 @@ func TestSystemShimManagerDoesNotTouchUserRc(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, "# user bashrc\n", string(content))
 }
+
+func TestSystemShimsInstalledIgnoresUnmanagedFiles(t *testing.T) {
+	root := t.TempDir()
+	useSystemPaths(t, root)
+	require.NoError(t, os.MkdirAll(SystemBinDir(), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(SystemBinDir(), "README"), []byte("not a shim"), 0o644))
+
+	assert.False(t, SystemShimsInstalled())
+
+	require.NoError(t, os.WriteFile(
+		filepath.Join(SystemBinDir(), "npm"),
+		[]byte("#!/bin/sh\n# PMG shim - do not edit, managed by pmg setup\n"),
+		0o755,
+	))
+	assert.True(t, SystemShimsInstalled())
+}
+
+func TestWriteSystemProfileRepairsStalePath(t *testing.T) {
+	root := t.TempDir()
+	useSystemPaths(t, root)
+	require.NoError(t, os.MkdirAll(filepath.Dir(SystemProfilePath()), 0o755))
+	require.NoError(t, os.WriteFile(
+		SystemProfilePath(),
+		[]byte("# PMG system shims\nexport PATH=\"/stale/path:$PATH\"\n"),
+		0o644,
+	))
+
+	require.NoError(t, writeSystemProfile())
+
+	content, err := os.ReadFile(SystemProfilePath())
+	require.NoError(t, err)
+	assert.Contains(t, string(content), SystemBinDir())
+	assert.NotContains(t, string(content), "/stale/path")
+}
+
+func TestValidateSystemExecutableRejectsPrivateBinary(t *testing.T) {
+	privateDir := t.TempDir()
+	privateExecutable := filepath.Join(privateDir, "pmg")
+	require.NoError(t, os.WriteFile(privateExecutable, []byte("binary"), 0o700))
+
+	err := validateSystemExecutable(privateExecutable)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "not executable by all users")
+}