@wipcomputer/wip-ldm-os 0.4.82-alpha.1 → 0.4.83

package/README.md

@@ -96,6 +96,8 @@ The OS connects your AIs. Add-ons are what they actually use. Each one is a full
 
 **OpenClaw**
 - Open-source agent runtime. Run AI agents 24/7 with identity, memory, and tool access. The existence proof for LDM OS.
+- WIP contributions accepted upstream: `before_message_write` plugin hook (#18197), Codex app-server final chat events (#70815 -> maintainer PR #71293), memory-core seed cache streaming/yield (#73067 -> maintainer PR #73118), and fallback vector top-K streaming (#73069 -> maintainer PR #73100).
+- Submitted / superseded: symlink plugin discovery fix (#45744; bug confirmed, superseded by #69971, not landed as submitted).
 - [Read more about OpenClaw](https://github.com/openclaw/openclaw)
 
 [See all skills](docs/skills/README.md)

package/SKILL.md

@@ -9,7 +9,7 @@ license: MIT
 compatibility: Requires git, npm, node. Node.js 18+.
 metadata:
   display-name: "LDM OS"
-  version: "0.4.81"
+  version: "0.4.83"
   homepage: "https://github.com/wipcomputer/wip-ldm-os"
   author: "Parker Todd Brooks"
   category: infrastructure

package/bin/ldm.js

@@ -1935,6 +1935,36 @@ async function cmdInstallCatalog() {
     console.log(`  + Migrated ${migrated} registry entries to v2 format (source info added)`);
   }
 
+  // Aggregate the bin ownership manifest BEFORE seedLocalCatalog,
+  // deployBridge, deployScripts, and the heal walk run. If two
+  // declarers claim the same file in ~/.ldm/bin/ we cannot safely
+  // decide ownership, so install must abort before catalog.json,
+  // bridge files, or any ~/.ldm/bin/ shim is written. See
+  // ai/product/plans-prds/current/2026-04-28--cc-mini--ldm-bin-ownership-manifest-design.md
+  const { aggregateBinManifest, healBinManifest } = await import('../lib/bin-manifest.mjs');
+  const ldmCliRoot = join(__dirname, '..');
+  const binManifestRegistry = readJSON(REGISTRY_PATH) || { extensions: {} };
+  const manifest = aggregateBinManifest({
+    ldmCliRoot,
+    extensionsRoot: LDM_EXTENSIONS,
+    binDir: join(LDM_ROOT, 'bin'),
+    registry: binManifestRegistry,
+  });
+  if (manifest.conflicts.length > 0) {
+    console.log('');
+    console.log('  x bin manifest conflict ... aborting before seedLocalCatalog/deployBridge/deployScripts run:');
+    for (const c of manifest.conflicts) {
+      console.log(`    "${c.name}" claimed by ${c.declarers.length} declarers:`);
+      for (const d of c.declarers) {
+        console.log(`        ${d.declarer}: ${d.sourcePath.replace(HOME, '~')}`);
+      }
+    }
+    console.log('');
+    console.log('  Resolve ownership in the package manifests, then re-run.');
+    installLog(`ldm install aborted: ${manifest.conflicts.length} bin manifest conflict(s)`);
+    process.exit(1);
+  }
+
   // Seed local catalog if missing (#262)
   if (seedLocalCatalog()) {
     console.log(`  + catalog.json seeded to ~/.ldm/catalog.json`);
@@ -1950,6 +1980,24 @@ async function cmdInstallCatalog() {
   deployDocs();
   deployRules();
 
+  // Manifest-driven self-heal. deployScripts() above wrote LDM CLI's own
+  // *.sh files; this pass covers the rest of the manifest (LDM CLI files
+  // deployed elsewhere, e.g. process-monitor.sh, plus extension-owned
+  // shims like crystal-capture.sh). Read-only entries that already match
+  // the manifest are no-ops.
+  if (manifest.entries.length > 0) {
+    const heal = healBinManifest(manifest.entries, { heal: !DRY_RUN });
+    for (const e of heal.healed) {
+      console.log(`  + Restored ${e.name} from ${e.sourcePath.replace(HOME, '~')} (declarer: ${e.declarer})`);
+    }
+    for (const f of heal.failed) {
+      console.log(`  ! ${f.entry.name}: ${f.reason} (declarer: ${f.entry.declarer})`);
+    }
+    if (heal.ok.length > 0 && heal.healed.length === 0 && heal.failed.length === 0) {
+      console.log(`  + bin manifest: ${heal.ok.length} entr${heal.ok.length === 1 ? 'y' : 'ies'} verified`);
+    }
+  }
+
   // Check backup configuration
   checkBackupHealth();
 
@@ -2947,6 +2995,98 @@ async function cmdDoctor() {
     }
   }
 
+  // 3c. Cron target health (parallel to crystal doctor's checkCaptureShim)
+  //
+  // When an extension wires a shim into ~/.ldm/bin/ via cron, the cron
+  // line is sticky: it keeps firing even if the shim file goes missing
+  // for any reason. crystal doctor catches this for crystal-capture.sh,
+  // but any cron line referencing ~/.ldm/bin/<file> is at the same risk
+  // class. Walk the crontab and surface broken bin-targeted entries
+  // explicitly. Read-only by default; --fix restores known shims from
+  // their extension dist when the canonical source is present on disk.
+  {
+    const ldmBinPrefix = join(LDM_ROOT, 'bin') + '/';
+    let crontab = '';
+    try {
+      crontab = execSync('crontab -l 2>/dev/null', { encoding: 'utf-8' });
+    } catch {}
+    function expandTilde(p) {
+      return p.startsWith('~') ? join(HOME, p.slice(1)) : p;
+    }
+    function extractCronTarget(line) {
+      const trimmed = line.trim();
+      if (!trimmed.startsWith('*')) return null;
+      const tokens = trimmed.split(/\s+/);
+      if (tokens.length < 6) return null;
+      const expanded = expandTilde(tokens[5]);
+      return expanded.startsWith(ldmBinPrefix) ? expanded : null;
+    }
+    const cronTargets = new Map();    // path → ['missing'|'not executable']
+    const seenTargets = new Set();    // every bin-targeted path we found
+    for (const line of crontab.split('\n')) {
+      const expanded = extractCronTarget(line);
+      if (!expanded) continue;
+      seenTargets.add(expanded);
+      if (cronTargets.has(expanded)) continue;
+      const problems = [];
+      if (!existsSync(expanded)) {
+        problems.push('missing');
+      } else if ((statSync(expanded).mode & 0o111) === 0) {
+        problems.push('not executable');
+      }
+      if (problems.length > 0) cronTargets.set(expanded, problems);
+    }
+    if (cronTargets.size > 0) {
+      // Manifest-driven lookup. Aggregates LDM CLI's wipLdmOs.binFiles
+      // and every registered extension's openclaw.plugin.json#binFiles.
+      // If aggregation reports a conflict, the lookup stays empty and
+      // each broken target becomes "owner unknown" until the conflict
+      // is resolved at the package-manifest layer.
+      const { aggregateBinManifest } = await import('../lib/bin-manifest.mjs');
+      const drManifest = aggregateBinManifest({
+        ldmCliRoot: join(__dirname, '..'),
+        extensionsRoot: LDM_EXTENSIONS,
+        binDir: join(LDM_ROOT, 'bin'),
+        registry: readJSON(REGISTRY_PATH) || { extensions: {} },
+      });
+      const knownSources = {};
+      const declarers = {};
+      if (drManifest.conflicts.length === 0) {
+        for (const e of drManifest.entries) {
+          knownSources[e.name] = e.sourcePath;
+          declarers[e.name] = e.declarer;
+        }
+      } else {
+        console.log(`  ! bin manifest conflict: ${drManifest.conflicts.length}; restore disabled until resolved`);
+      }
+      let healed = 0;
+      for (const [path, problems] of cronTargets) {
+        const detail = problems.join(', ');
+        console.log(`  ! cron target ${detail}: ${path}`);
+        const base = basename(path);
+        const src = knownSources[base];
+        if (FIX_FLAG && src && existsSync(src)) {
+          try {
+            mkdirSync(dirname(path), { recursive: true });
+            cpSync(src, path);
+            chmodSync(path, 0o755);
+            console.log(`  + Restored ${base} from ${src.replace(HOME, '~')}`);
+            healed++;
+          } catch (e) {
+            console.log(`    Restore failed: ${e.message}`);
+          }
+        } else if (src) {
+          console.log(`    Run: ldm doctor --fix to restore from ${src.replace(HOME, '~')}`);
+        } else {
+          console.log(`    Owner unknown; consult the extension that registered this cron entry`);
+        }
+      }
+      issues += cronTargets.size - healed;
+    } else if (seenTargets.size > 0) {
+      console.log(`  + Cron targets under ~/.ldm/bin/: ${seenTargets.size} entr${seenTargets.size === 1 ? 'y' : 'ies'}, all exist and executable`);
+    }
+  }
+
   // 4. Check sacred locations
   const sacred = [
     { path: join(LDM_ROOT, 'memory'), label: 'memory/' },

package/docs/skills/README.md

@@ -31,6 +31,8 @@ Your AIs are only as powerful as what you give them. Here's everything available
 
 **OpenClaw**
 - Open-source agent runtime. Run AI agents 24/7 with identity, memory, and tool access. The existence proof for LDM OS.
+- WIP contributions accepted upstream: `before_message_write` plugin hook (#18197), Codex app-server final chat events (#70815 -> maintainer PR #71293), memory-core seed cache streaming/yield (#73067 -> maintainer PR #73118), and fallback vector top-K streaming (#73069 -> maintainer PR #73100).
+- Submitted / superseded: symlink plugin discovery fix (#45744; bug confirmed, superseded by #69971, not landed as submitted).
 - [Read more about OpenClaw](https://github.com/openclaw/openclaw)
 
 ## Identity

package/lib/bin-manifest.mjs

@@ -0,0 +1,257 @@
+// lib/bin-manifest.mjs — bin ownership manifest aggregator + heal helpers
+//
+// Implements the design at
+// ai/product/plans-prds/current/2026-04-28--cc-mini--ldm-bin-ownership-manifest-design.md
+//
+// Two declarers contribute entries:
+//   - LDM CLI: package.json `wipLdmOs.binFiles`
+//   - Extensions: ~/.ldm/extensions/<name>/openclaw.plugin.json `binFiles`
+//
+// Aggregation produces { entries, conflicts }. Conflicts are hard
+// failures: callers MUST check `conflicts.length === 0` before any
+// write. heal() never runs if conflicts exist.
+
+import { existsSync, readFileSync, statSync, mkdirSync, copyFileSync, chmodSync } from 'node:fs';
+import { join, dirname, basename } from 'node:path';
+
+/**
+ * @typedef {Object} BinDeclaration
+ * @property {string} name        - basename written to <binDir>/<name>
+ * @property {string} source      - relative to declarer's installed root
+ * @property {boolean} [executable] - default true; chmod 0755 after copy
+ * @property {string} [purpose]   - free-form, surfaces in verbose doctor
+ */
+
+/**
+ * @typedef {Object} BinEntry
+ * @property {string} name
+ * @property {string} destPath    - resolved absolute path under binDir
+ * @property {string} sourcePath  - resolved absolute path
+ * @property {boolean} executable
+ * @property {string} declarer    - 'wip-ldm-os' or extension name
+ * @property {string} [purpose]
+ */
+
+/**
+ * @typedef {Object} Conflict
+ * @property {string} name
+ * @property {{declarer: string, sourcePath: string}[]} declarers
+ */
+
+/**
+ * Validate a single declaration shape. Returns array of error strings (empty = ok).
+ * @param {BinDeclaration} decl
+ * @returns {string[]}
+ */
+export function validateDeclaration(decl) {
+  const errors = [];
+  if (!decl || typeof decl !== 'object') {
+    errors.push('declaration must be an object');
+    return errors;
+  }
+  if (typeof decl.name !== 'string' || !decl.name) {
+    errors.push('"name" must be a non-empty string');
+  } else if (decl.name !== basename(decl.name) || decl.name.includes('/') || decl.name.includes('\\')) {
+    errors.push(`"name" must be a basename, got "${decl.name}"`);
+  } else if (decl.name.includes('..')) {
+    errors.push(`"name" must not contain "..", got "${decl.name}"`);
+  }
+  if (typeof decl.source !== 'string' || !decl.source) {
+    errors.push('"source" must be a non-empty string');
+  } else if (decl.source.includes('..')) {
+    errors.push(`"source" must not contain "..", got "${decl.source}"`);
+  }
+  if (decl.executable !== undefined && typeof decl.executable !== 'boolean') {
+    errors.push('"executable" must be a boolean if provided');
+  }
+  return errors;
+}
+
+/**
+ * Validate all declarations from one declarer (e.g. the LDM CLI's own
+ * `wipLdmOs.binFiles`, or one extension's `binFiles`). Used by both
+ * runtime aggregation and prepublish CI gate.
+ *
+ * Checks: shape per entry, no internal duplicate `name`, `source` exists
+ * on disk under `packageRoot`.
+ *
+ * @param {string} declarer
+ * @param {string} packageRoot - the absolute path to resolve `source` against
+ * @param {BinDeclaration[]} decls
+ * @returns {{valid: boolean, errors: string[]}}
+ */
+export function validateDeclarations(declarer, packageRoot, decls) {
+  const errors = [];
+  if (!Array.isArray(decls)) {
+    return { valid: false, errors: [`${declarer}: binFiles must be an array`] };
+  }
+  const seen = new Set();
+  for (let i = 0; i < decls.length; i++) {
+    const d = decls[i];
+    const ctx = `${declarer}[${i}]${d?.name ? ` ${d.name}` : ''}`;
+    for (const e of validateDeclaration(d)) errors.push(`${ctx}: ${e}`);
+    if (d && typeof d.name === 'string') {
+      if (seen.has(d.name)) errors.push(`${declarer}: duplicate name within declarer: ${d.name}`);
+      seen.add(d.name);
+    }
+    if (d && typeof d.source === 'string') {
+      const src = join(packageRoot, d.source);
+      if (!existsSync(src)) errors.push(`${ctx}: source not found at ${src}`);
+    }
+  }
+  return { valid: errors.length === 0, errors };
+}
+
+/**
+ * Read LDM CLI's own bin declarations from its package.json.
+ * @param {string} ldmCliRoot
+ * @returns {BinDeclaration[]}
+ */
+function readLdmCliDeclarations(ldmCliRoot) {
+  const pkgPath = join(ldmCliRoot, 'package.json');
+  if (!existsSync(pkgPath)) return [];
+  try {
+    const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+    return Array.isArray(pkg?.wipLdmOs?.binFiles) ? pkg.wipLdmOs.binFiles : [];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Read one extension's bin declarations from its openclaw.plugin.json.
+ * @param {string} extDir - ~/.ldm/extensions/<name>
+ * @returns {BinDeclaration[]}
+ */
+function readExtensionDeclarations(extDir) {
+  const manifestPath = join(extDir, 'openclaw.plugin.json');
+  if (!existsSync(manifestPath)) return [];
+  try {
+    const m = JSON.parse(readFileSync(manifestPath, 'utf-8'));
+    return Array.isArray(m?.binFiles) ? m.binFiles : [];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Aggregate all bin entries across LDM CLI + registered extensions.
+ * Returns conflicts for any name claimed by 2+ declarers.
+ *
+ * IMPORTANT: callers MUST check `conflicts.length === 0` before doing any
+ * writes. Conflict means we cannot safely decide who owns the file.
+ *
+ * @param {Object} opts
+ * @param {string} opts.ldmCliRoot       - absolute path to LDM CLI package root
+ * @param {string} opts.extensionsRoot   - absolute path, typically ~/.ldm/extensions
+ * @param {string} opts.binDir           - absolute path, typically ~/.ldm/bin
+ * @param {Object} [opts.registry]       - optional ~/.ldm/extensions/registry.json contents
+ * @returns {{entries: BinEntry[], conflicts: Conflict[]}}
+ */
+export function aggregateBinManifest({ ldmCliRoot, extensionsRoot, binDir, registry } = {}) {
+  /** @type {BinEntry[]} */
+  const entries = [];
+  /** @type {Map<string, {declarer: string, sourcePath: string}[]>} */
+  const claims = new Map();
+
+  function record(declarer, declarerRoot, decls) {
+    for (const d of decls) {
+      if (!d || typeof d.name !== 'string' || typeof d.source !== 'string') continue;
+      const sourcePath = join(declarerRoot, d.source);
+      const list = claims.get(d.name) || [];
+      list.push({ declarer, sourcePath });
+      claims.set(d.name, list);
+      entries.push({
+        name: d.name,
+        destPath: join(binDir, d.name),
+        sourcePath,
+        executable: d.executable !== false,
+        declarer,
+        purpose: d.purpose,
+      });
+    }
+  }
+
+  // 1. LDM CLI
+  record('wip-ldm-os', ldmCliRoot, readLdmCliDeclarations(ldmCliRoot));
+
+  // 2. Registered extensions
+  const extNames = registry?.extensions ? Object.keys(registry.extensions) : [];
+  for (const name of extNames) {
+    const extDir = join(extensionsRoot, name);
+    record(name, extDir, readExtensionDeclarations(extDir));
+  }
+
+  /** @type {Conflict[]} */
+  const conflicts = [];
+  for (const [name, declarers] of claims.entries()) {
+    if (declarers.length > 1) conflicts.push({ name, declarers });
+  }
+
+  return { entries, conflicts };
+}
+
+/**
+ * Verify and (optionally) heal each entry. heal=false is read-only and
+ * just classifies. heal=true restores missing/unexecutable files from
+ * `sourcePath`. Returns a per-entry result so callers can build their
+ * own output.
+ *
+ * NEVER call this if aggregateBinManifest reported conflicts. The caller
+ * must abort instead.
+ *
+ * @param {BinEntry[]} entries
+ * @param {Object} [opts]
+ * @param {boolean} [opts.heal] - default false
+ * @returns {{
+ *   ok: BinEntry[],
+ *   missing: BinEntry[],
+ *   notExecutable: BinEntry[],
+ *   sourceMissing: BinEntry[],
+ *   healed: BinEntry[],
+ *   failed: {entry: BinEntry, reason: string}[]
+ * }}
+ */
+export function healBinManifest(entries, opts = {}) {
+  const heal = opts.heal === true;
+  const ok = [];
+  const missing = [];
+  const notExecutable = [];
+  const sourceMissing = [];
+  const healed = [];
+  const failed = [];
+
+  for (const e of entries) {
+    const destExists = existsSync(e.destPath);
+    const destExecutable = destExists && (statSync(e.destPath).mode & 0o111) !== 0;
+    const expectedExec = e.executable !== false;
+    const destOk = destExists && (!expectedExec || destExecutable);
+
+    if (destOk) {
+      ok.push(e);
+      continue;
+    }
+
+    if (!destExists) missing.push(e);
+    else if (expectedExec && !destExecutable) notExecutable.push(e);
+
+    if (!heal) continue;
+
+    if (!existsSync(e.sourcePath)) {
+      sourceMissing.push(e);
+      failed.push({ entry: e, reason: `source missing at ${e.sourcePath}` });
+      continue;
+    }
+
+    try {
+      mkdirSync(dirname(e.destPath), { recursive: true });
+      copyFileSync(e.sourcePath, e.destPath);
+      if (expectedExec) chmodSync(e.destPath, 0o755);
+      healed.push(e);
+    } catch (err) {
+      failed.push({ entry: e, reason: err.message });
+    }
+  }
+
+  return { ok, missing, notExecutable, sourceMissing, healed, failed };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-ldm-os",
-  "version": "0.4.82-alpha.1",
+  "version": "0.4.83",
   "type": "module",
   "description": "LDM OS: identity, memory, and sovereignty infrastructure for AI agents",
   "engines": {
@@ -18,9 +18,13 @@
   "scripts": {
     "build:bridge": "cd src/bridge && npm install && npx tsup core.ts mcp-server.ts cli.ts openclaw.ts --format esm --dts --clean --outDir ../../dist/bridge",
     "build": "npm run build:bridge",
-    "prepublishOnly": "npm run build:bridge",
+    "prepublishOnly": "npm run build:bridge && npm run validate:bin-manifest",
+    "validate:bin-manifest": "node scripts/validate-bin-manifest.mjs",
     "test:skill-frontmatter": "node scripts/test-skill-frontmatter.mjs",
     "test:installer-update-tracks": "node scripts/test-installer-update-tracks.mjs",
+    "test:ldm-install-bin-shim": "node scripts/test-ldm-install-preserves-foreign-bin.mjs",
+    "test:doctor-cron-target": "node scripts/test-doctor-cron-target.mjs",
+    "test:bin-manifest": "node scripts/test-bin-manifest.mjs",
     "fmt": "npx prettier --write 'src/**/*.{ts,mjs}' 'lib/**/*.mjs' 'bin/**/*.js'",
     "fmt:check": "npx prettier --check 'src/**/*.{ts,mjs}' 'lib/**/*.mjs' 'bin/**/*.js'"
   },
@@ -32,6 +36,35 @@
       "timeout": 15
     }
   },
+  "wipLdmOs": {
+    "binFiles": [
+      {
+        "name": "process-monitor.sh",
+        "source": "bin/process-monitor.sh",
+        "purpose": "kills zombie processes; cron every 3 min"
+      },
+      {
+        "name": "ldm-backup.sh",
+        "source": "scripts/ldm-backup.sh",
+        "purpose": "daily backup; LaunchAgent at 03:00"
+      },
+      {
+        "name": "ldm-restore.sh",
+        "source": "scripts/ldm-restore.sh",
+        "purpose": "restore from backup; operator-invoked"
+      },
+      {
+        "name": "ldm-summary.sh",
+        "source": "scripts/ldm-summary.sh",
+        "purpose": "generate session/daily summaries"
+      },
+      {
+        "name": "backfill-summaries.sh",
+        "source": "scripts/backfill-summaries.sh",
+        "purpose": "backfill summary cadences"
+      }
+    ]
+  },
   "files": [
     "src/",
     "lib/",