fix(install): version-pattern fragility flagged by Gemini on PR #19 (#20)

Gemini Code Assist correctly noted that the case statement introduced in
PR #19 still uses literal-dot + single-digit [1-9] patterns, which fail
on multi-digit components like 2.0.10.0, 2.10.0.0, 100.0.0. A future
v2.0.10.0 install at the legacy path would fall through both arms and
produce a false-positive "not a recognized install" warning.

Replace the skip arm with multi-digit-safe patterns:

  2.0.[1-9]*|2.[1-9]*|[3-9]*|1[0-9]*

Refinement vs Gemini's exact suggestion: 1[0-9]* (no literal dot) instead
of 1[0-9].* — covers 100.0.0 too, no false positives since the legacy
arm matches `1.*` not `1[0-9]`.

Mirrored in bin/idstack-doctor and setup.

Adds test/test-version-classifier.sh — pins the case statement against
20 representative versions (legacy + modern + multi-digit). Wired into
smoke-test.sh. This is the second time Gemini caught a version-pattern
bug in this code path; the test stops the third.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: savvides

bin/idstack-doctor

@@ -107,9 +107,11 @@ elif [ -d "$LEGACY_DIR" ]; then
   if [ -f "$LEGACY_DIR/VERSION" ]; then
     v=$(tr -d '[:space:]' < "$LEGACY_DIR/VERSION")
     # Two arms: explicitly skip modern/future versions first, then flag the
-    # legacy ones. Mirrors setup; future-proof if v3.x or v10.x ever ships.
+    # legacy ones. Mirrors setup. Patterns avoid literal dots and single-digit
+    # ranges so multi-digit components (2.0.10.0, 2.10.0.0, 100.0.0) work.
+    # Covered by test/test-version-classifier.sh.
     case "$v" in
-      2.0.1.*|2.[1-9].*|[3-9].*|1[0-9].*) ;;
+      2.0.[1-9]*|2.[1-9]*|[3-9]*|1[0-9]*) ;;
       0.*|1.*|2.0.0.*|2.0.0) signature="${signature:+$signature, }VERSION=$v" ;;
     esac
   fi

setup

@@ -70,10 +70,11 @@ elif [ -d "$LEGACY_SKILLS_LINK" ] && [ "$LEGACY_SKILLS_LINK" != "$IDSTACK_DIR" ]
   if [ -f "$LEGACY_SKILLS_LINK/VERSION" ]; then
     legacy_version=$(tr -d '[:space:]' < "$LEGACY_SKILLS_LINK/VERSION")
     # Two arms: explicitly skip modern/future versions first, then flag the
-    # legacy ones. Self-documenting and future-proof if a v3.x or v10.x ever
-    # ships through this path.
+    # legacy ones. Patterns avoid literal dots and single-digit ranges so
+    # multi-digit components (2.0.10.0, 2.10.0.0, 100.0.0) work.
+    # Covered by test/test-version-classifier.sh.
     case "$legacy_version" in
-      2.0.1.*|2.[1-9].*|[3-9].*|1[0-9].*) ;;
+      2.0.[1-9]*|2.[1-9]*|[3-9]*|1[0-9]*) ;;
       0.*|1.*|2.0.0.*|2.0.0) legacy_is_old_version=1 ;;
     esac
   fi

test/smoke-test.sh

@@ -111,6 +111,13 @@ if [ -x "$IDSTACK_DIR/test/test-manifest-merge.sh" ]; then
   check "manifest-merge unit tests pass" "'$IDSTACK_DIR/test/test-manifest-merge.sh'"
 fi
 
+# Version classifier (shared by setup + bin/idstack-doctor) must classify
+# multi-digit versions correctly. Pinned to catch the pattern-fragility
+# regression Gemini flagged twice.
+if [ -x "$IDSTACK_DIR/test/test-version-classifier.sh" ]; then
+  check "version-classifier unit tests pass" "'$IDSTACK_DIR/test/test-version-classifier.sh'"
+fi
+
 # Check generated files have auto-generated header
 for skill in $SKILLS; do
   check "$skill SKILL.md has auto-generated header" "grep -q 'AUTO-GENERATED from SKILL.md.tmpl' '$IDSTACK_DIR/skills/$skill/SKILL.md'"

test/test-version-classifier.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# Unit tests for the legacy-VERSION classifier shared by setup and
+# bin/idstack-doctor. Both files use the same two-arm case statement to
+# decide whether a VERSION file under the legacy install path means
+# "modern install — leave alone" (skip) or "pre-v2.0.1.0 install — flag
+# for cleanup" (legacy).
+#
+# Why this test exists: Gemini Code Assist has flagged this case statement
+# twice now. The patterns are subtle (bash globs, not regex) and an off-by-one
+# in a character class silently flips classifications for multi-digit
+# components. This test pins the contract so it can't drift again.
+#
+# Run from the repo root or via smoke-test.sh.
+
+set -e
+
+PASS=0
+FAIL=0
+TOTAL=0
+
+# Mirror of the case statement in setup and bin/idstack-doctor. Keep these
+# patterns in lockstep with both files — if you change one, change all three.
+classify_version() {
+  case "$1" in
+    2.0.[1-9]*|2.[1-9]*|[3-9]*|1[0-9]*) echo "skip" ;;
+    0.*|1.*|2.0.0.*|2.0.0) echo "legacy" ;;
+    *) echo "unknown" ;;
+  esac
+}
+
+check() {
+  TOTAL=$((TOTAL + 1))
+  local version="$1"
+  local expected="$2"
+  local got
+  got="$(classify_version "$version")"
+  if [ "$got" = "$expected" ]; then
+    PASS=$((PASS + 1))
+    echo "  PASS: $version -> $got"
+  else
+    FAIL=$((FAIL + 1))
+    echo "  FAIL: $version -> $got (expected $expected)"
+  fi
+}
+
+echo "test-version-classifier"
+echo ""
+
+# Legacy versions that ever shipped.
+check "0.1.0"     legacy
+check "0.5.0"     legacy
+check "1.0.0"     legacy
+check "1.9.0"     legacy
+check "2.0.0"     legacy
+check "2.0.0.0"   legacy
+check "2.0.0.1"   legacy
+
+# Modern versions — including multi-digit components that broke the
+# previous patterns.
+check "2.0.1.0"   skip
+check "2.0.1.5"   skip
+check "2.0.10.0"  skip
+check "2.0.99.0"  skip
+check "2.1.0.0"   skip
+check "2.4.0.0"   skip
+check "2.10.0.0"  skip
+check "2.99.0.0"  skip
+check "3.0.0.0"   skip
+check "9.0.0.0"   skip
+check "10.0.0.0"  skip
+check "19.0.0.0"  skip
+check "100.0.0.0" skip
+
+echo ""
+echo "  $PASS/$TOTAL passed"
+[ "$FAIL" = "0" ] || exit 1