@wipcomputer/wip-ldm-os 0.4.75-alpha.1 → 0.4.77

package/SKILL.md

@@ -9,7 +9,7 @@ license: MIT
 compatibility: Requires git, npm, node. Node.js 18+.
 metadata:
   display-name: "LDM OS"
-  version: "0.4.74"
+  version: "0.4.77"
   homepage: "https://github.com/wipcomputer/wip-ldm-os"
   author: "Parker Todd Brooks"
   category: infrastructure

package/lib/deploy.mjs

@@ -14,6 +14,7 @@ import {
   lstatSync, readlinkSync, unlinkSync, chmodSync, readdirSync,
   renameSync, rmSync, statSync, symlinkSync,
 } from 'node:fs';
+import { createHash } from 'node:crypto';
 import { join, basename, resolve, dirname } from 'node:path';
 import { tmpdir } from 'node:os';
 import { detectInterfaces, describeInterfaces, detectToolbox } from './detect.mjs';
@@ -750,6 +751,45 @@ function installCLI(repoPath, door) {
   }
 }
 
+// Stable content hash over a directory tree. Used by deployExtension to
+// decide whether to skip a redeploy. Before this, deployExtension skipped
+// when source and deployed had equal versions ... but a prior partial
+// install could have bumped the package.json without finishing the copy,
+// leaving deployed package.json "current" while other files (guard.mjs,
+// core.mjs, etc.) were stale. The 2026-04-20 wip-release 1.9.74 -> 1.9.75
+// rollout hit that (source core.mjs had runNpmPublish, deployed didn't,
+// both package.jsons reported 1.9.75). Skip only when versions match AND
+// content hashes match; otherwise redeploy to heal the drift.
+function computeTreeHash(dir) {
+  if (!existsSync(dir)) return null;
+  const skipNames = new Set([
+    '.git', 'node_modules', 'ai', '_trash', '.worktrees', 'logs', 'test', 'tests', '__tests__',
+  ]);
+  const hash = createHash('sha256');
+  function walk(d, rel) {
+    let entries;
+    try { entries = readdirSync(d, { withFileTypes: true }); }
+    catch { return; }
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+    for (const e of entries) {
+      if (skipNames.has(e.name)) continue;
+      const p = join(d, e.name);
+      const r = rel ? `${rel}/${e.name}` : e.name;
+      if (e.isDirectory()) walk(p, r);
+      else if (e.isFile()) {
+        try {
+          hash.update(r);
+          hash.update('\0');
+          hash.update(readFileSync(p));
+          hash.update('\0');
+        } catch {}
+      }
+    }
+  }
+  walk(dir, '');
+  return hash.digest('hex');
+}
+
 function deployExtension(repoPath, name) {
   const sourcePkg = readJSON(join(repoPath, 'package.json'));
   const ldmDest = join(LDM_EXTENSIONS, name);
@@ -759,18 +799,28 @@ function deployExtension(repoPath, name) {
 
   const cmp = compareSemver(newVersion, currentVersion);
   if (newVersion && currentVersion && cmp <= 0) {
-    skip(`LDM: ${name} already at v${currentVersion}${cmp < 0 ? ` (source is older: v${newVersion})` : ''}`);
-    // Ensure OC copy exists too
-    const ocName = resolveOcPluginName(repoPath, name);
-    const ocDest = join(OC_EXTENSIONS, ocName);
-    if (!existsSync(ocDest) && !DRY_RUN) {
-      mkdirSync(ocDest, { recursive: true });
-      cpSync(ldmDest, ocDest, { recursive: true });
-      ok(`OpenClaw: synced to ${ocDest}`);
-    } else {
-      skip(`OpenClaw: ${ocName} already at v${currentVersion}`);
+    // Versions equal or deployed is newer. Verify content hash before
+    // short-circuiting ... a prior partial install could have bumped
+    // package.json but not copied the other files, leaving deployed
+    // apparently "current" while code is stale.
+    const srcHash = computeTreeHash(repoPath);
+    const dstHash = computeTreeHash(ldmDest);
+    if (srcHash && dstHash && srcHash === dstHash) {
+      skip(`LDM: ${name} already at v${currentVersion}${cmp < 0 ? ` (source is older: v${newVersion})` : ''}`);
+      // Ensure OC copy exists too
+      const ocName = resolveOcPluginName(repoPath, name);
+      const ocDest = join(OC_EXTENSIONS, ocName);
+      if (!existsSync(ocDest) && !DRY_RUN) {
+        mkdirSync(ocDest, { recursive: true });
+        cpSync(ldmDest, ocDest, { recursive: true });
+        ok(`OpenClaw: synced to ${ocDest}`);
+      } else {
+        skip(`OpenClaw: ${ocName} already at v${currentVersion}`);
+      }
+      return true;
     }
-    return true;
+    // Content differs despite matching version; fall through to redeploy.
+    ok(`LDM: ${name} v${currentVersion} reports same version but content differs; redeploying`);
   }
 
   if (DRY_RUN) {
@@ -940,7 +990,16 @@ function installClaudeCodeHookEvent(repoPath, door) {
   // Deploy guard.mjs to ~/.ldm/extensions/{toolName}/ (#85: always update, not just when missing)
   // Idempotent across multi-door invocations: two doors on the same repo
   // will both trigger this copy, which is a filesystem no-op after the first.
+  //
+  // Also recursively copy sibling source subdirectories (e.g. lib/, dist/).
+  // Historical behavior only copied guard.mjs + package.json at the root,
+  // so a guard.mjs whose imports referenced ./lib/*.mjs loaded fine from
+  // source but broke post-install with ERR_MODULE_NOT_FOUND. This caused
+  // the wip-branch-guard 1.9.77 incident on 2026-04-20.
   const srcGuard = join(repoPath, 'guard.mjs');
+  const SKIP_DIRS_FOR_HOOK = new Set([
+    '.git', 'node_modules', 'ai', '_trash', '.worktrees', 'logs', 'test', 'tests', '__tests__',
+  ]);
   if (existsSync(srcGuard)) {
     try {
       if (!existsSync(extDir)) mkdirSync(extDir, { recursive: true });
@@ -948,6 +1007,14 @@ function installClaudeCodeHookEvent(repoPath, door) {
       // Also copy package.json for metadata
       const srcPkg = join(repoPath, 'package.json');
       if (existsSync(srcPkg)) copyFileSync(srcPkg, join(extDir, 'package.json'));
+      // Recurse sibling subdirs so nested imports (e.g. ./lib/foo.mjs) load.
+      for (const entry of readdirSync(repoPath, { withFileTypes: true })) {
+        if (!entry.isDirectory()) continue;
+        if (SKIP_DIRS_FOR_HOOK.has(entry.name)) continue;
+        const srcDir = join(repoPath, entry.name);
+        const destDir = join(extDir, entry.name);
+        try { cpSync(srcDir, destDir, { recursive: true }); } catch {}
+      }
     } catch (e) {
       // Non-fatal: fall back to source path
     }
@@ -967,32 +1034,49 @@ function installClaudeCodeHookEvent(repoPath, door) {
   if (!settings.hooks) settings.hooks = {};
   if (!settings.hooks[event]) settings.hooks[event] = [];
 
-  // Match existing entries by the guard command path + the matcher, so that
-  // a single extension registering on multiple events (each with its own
-  // matcher) creates one entry per event rather than all entries colliding
-  // on the same hook slot. Before this change the existing-entry check was
-  // per-extension, not per-extension-per-event.
+  // Match existing entries by command path alone (same extension + same
+  // event). The previous finder required matcher equality too, so when
+  // an extension bumped its matcher (e.g. wip-branch-guard 1.9.78 -> 1.9.79
+  // added Read|Glob to enable onboarding), the finder missed the old entry
+  // and appended a new one, leaving an orphaned old matcher in settings
+  // and doubling hook invocations on overlapping matchers.
+  //
+  // Now: find by extension dir in the command. Update matcher + command +
+  // timeout in place. First pass removes any DUPLICATE entries for the same
+  // extension in this event slot (orphan cleanup; catches post-1.9.78
+  // duplicates on users who already installed the broken version).
   const doorMatcher = door.matcher || undefined;
-  const existingIdx = settings.hooks[event].findIndex(entry => {
-    const sameMatcher = (entry.matcher || undefined) === doorMatcher;
-    if (!sameMatcher) return false;
-    return entry.hooks?.some(h => {
-      const cmd = h.command || '';
-      return cmd.includes(`/${toolName}/`) || cmd === hookCommand;
-    });
+  const toolTag = `/${toolName}/`;
+  const ownedIdxs = [];
+  settings.hooks[event].forEach((entry, i) => {
+    const hooks = entry.hooks || [];
+    if (hooks.some(h => (h.command || '').includes(toolTag))) ownedIdxs.push(i);
   });
+  let removed = 0;
+  if (ownedIdxs.length > 1) {
+    // Keep the first, remove the rest. Walk right-to-left so earlier indices stay valid.
+    for (let j = ownedIdxs.length - 1; j >= 1; j--) {
+      settings.hooks[event].splice(ownedIdxs[j], 1);
+      removed++;
+    }
+  }
+  const existingIdx = ownedIdxs.length > 0 ? ownedIdxs[0] : -1;
 
   if (existingIdx !== -1) {
-    const existingCmd = settings.hooks[event][existingIdx].hooks?.[0]?.command || '';
-    if (existingCmd === hookCommand) {
+    const existingEntry = settings.hooks[event][existingIdx];
+    const existingCmd = existingEntry.hooks?.[0]?.command || '';
+    const existingMatcher = existingEntry.matcher || undefined;
+    if (existingCmd === hookCommand && existingMatcher === doorMatcher && removed === 0) {
       skip(`Claude Code: ${event} hook already configured`);
       return true;
     }
-    settings.hooks[event][existingIdx].hooks[0].command = hookCommand;
-    settings.hooks[event][existingIdx].hooks[0].timeout = door.timeout || 10;
+    existingEntry.matcher = doorMatcher;
+    existingEntry.hooks[0].command = hookCommand;
+    existingEntry.hooks[0].timeout = door.timeout || 10;
     try {
       writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
-      ok(`Claude Code: ${event} hook updated`);
+      const note = removed > 0 ? ` (removed ${removed} orphan entr${removed === 1 ? 'y' : 'ies'})` : '';
+      ok(`Claude Code: ${event} hook updated${note}`);
       return true;
     } catch (e) {
       fail(`Claude Code: failed to update settings.json. ${e.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-ldm-os",
-  "version": "0.4.75-alpha.1",
+  "version": "0.4.77",
   "type": "module",
   "description": "LDM OS: identity, memory, and sovereignty infrastructure for AI agents",
   "engines": {