@wipcomputer/wip-ldm-os 0.4.85-alpha.30 → 0.4.85-alpha.32

package/scripts/test-doctor-hook-dedupe.mjs

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+// Regression test: `ldm doctor` duplicate-hook + invalid-model checks.
+//
+// Covers the 2026-07-04 tickets:
+//   ai/product/bugs/installer/open-tickets/2026-07-04--cc-mini--installer-sessionstart-hook-duplicate-registration.md
+//   ai/product/bugs/guard/2026-07-04--cc-mini--no-blessed-recipe-for-live-settings-remediation.md
+//
+// Cases:
+//   1. Duplicate-laden settings: doctor reports, does NOT write without --fix.
+//   2. --fix collapses duplicates to 1, writes a timestamped backup first,
+//      preserves unrelated hooks and unknown keys.
+//   3. Invalid model value ("opus" + real ESC 0x1B + "[1m"): reported, removed under --fix.
+//   4. Malformed settings.json: warns and skips, file untouched, no crash.
+//
+// Follows the test-doctor-cron-target.mjs pattern: real bin/ldm.js doctor
+// against a temp HOME, crontab/npm shimmed on PATH so the operator's real
+// state is never read.
+
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+
+const repo = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const cli = join(repo, 'bin', 'ldm.js');
+const pkg = JSON.parse(readFileSync(join(repo, 'package.json'), 'utf8'));
+
+let failed = 0;
+function assert(cond, label, output = '') {
+  if (cond) {
+    console.log(`  [PASS] ${label}`);
+  } else {
+    console.log(`  [FAIL] ${label}`);
+    if (output) console.log(`         --- output (last lines) ---\n         ${output.trim().split('\n').slice(-25).join('\n         ')}`);
+    failed++;
+  }
+}
+
+function setupHome(settingsFactory) {
+  const home = mkdtempSync(join(tmpdir(), 'ldm-doctor-dedupe-'));
+  const ldmRoot = join(home, '.ldm');
+  const fakeBin = join(home, 'fakebin');
+  mkdirSync(join(ldmRoot, 'extensions'), { recursive: true });
+  mkdirSync(join(home, '.claude'), { recursive: true });
+  mkdirSync(fakeBin, { recursive: true });
+
+  writeFileSync(join(ldmRoot, 'version.json'), JSON.stringify({ version: pkg.version }, null, 2) + '\n');
+  writeFileSync(join(ldmRoot, 'extensions', 'registry.json'), JSON.stringify({ _format: 'v2', extensions: {} }, null, 2) + '\n');
+
+  // Hook scripts must exist on disk: doctor --fix runs the stale-path
+  // cleanup (#30) before the dedupe pass, and missing targets would be
+  // removed as stale instead of collapsed as duplicates.
+  const bootScript = join(ldmRoot, 'shared', 'boot', 'boot-hook.mjs');
+  const guardScript = join(ldmRoot, 'extensions', 'wip-branch-guard', 'guard.mjs');
+  const stopScript = join(ldmRoot, 'extensions', 'stop-hook.mjs');
+  for (const f of [bootScript, guardScript, stopScript]) {
+    mkdirSync(dirname(f), { recursive: true });
+    writeFileSync(f, 'process.exit(0);\n');
+  }
+
+  const paths = { bootScript, guardScript, stopScript };
+  const settingsContent = settingsFactory(paths);
+  const settingsPath = join(home, '.claude', 'settings.json');
+  writeFileSync(settingsPath, typeof settingsContent === 'string'
+    ? settingsContent
+    : JSON.stringify(settingsContent, null, 2) + '\n');
+
+  // Empty crontab + no-op npm on PATH (never touch operator state/network).
+  writeFileSync(join(fakeBin, 'crontab'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'crontab'), 0o755);
+  writeFileSync(join(fakeBin, 'npm'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'npm'), 0o755);
+
+  return { home, fakeBin, settingsPath, paths };
+}
+
+function runDoctor({ home, fakeBin }, fix = false) {
+  const args = ['doctor'];
+  if (fix) args.push('--fix');
+  try {
+    return execFileSync('node', [cli, ...args], {
+      env: { ...process.env, HOME: home, PATH: `${fakeBin}:${process.env.PATH}`, LDM_SELF_UPDATED: '1' },
+      encoding: 'utf-8',
+      timeout: 30000,
+    });
+  } catch (err) {
+    return (err.stdout || '') + (err.stderr || '');
+  }
+}
+
+const bootCmd = (paths) => `node ${paths.bootScript}`;
+const bootEntry = (paths) => ({ matcher: '*', hooks: [{ type: 'command', command: bootCmd(paths), timeout: 15 }] });
+const guardEntry = (paths) => ({ hooks: [{ type: 'command', command: `node ${paths.guardScript}`, timeout: 10 }] });
+
+function dupeLadenSettings(paths) {
+  return {
+    unknownTopLevelKey: { keep: 'me' },
+    permissions: { defaultMode: 'default' },
+    hooks: {
+      SessionStart: [
+        ...Array.from({ length: 5 }, () => bootEntry(paths)),
+        guardEntry(paths),
+        ...Array.from({ length: 5 }, () => bootEntry(paths)),
+      ],
+      Stop: [{ hooks: [{ type: 'command', command: `node ${paths.stopScript}` }] }],
+    },
+  };
+}
+
+console.log('Test 1: duplicates reported, no write without --fix');
+{
+  const w = setupHome(dupeLadenSettings);
+  const before = readFileSync(w.settingsPath, 'utf-8');
+  const out = runDoctor(w);
+  const after = readFileSync(w.settingsPath, 'utf-8');
+  assert(/SessionStart: 10 identical hook entries/.test(out), 'reports 10 identical SessionStart entries', out);
+  assert(/ldm doctor --fix to collapse 9 duplicate hook entries/.test(out), 'suggests --fix with count', out);
+  assert(before === after, 'settings.json untouched without --fix');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 2: --fix collapses, backs up first, preserves everything else');
+{
+  const w = setupHome(dupeLadenSettings);
+  const out = runDoctor(w, true);
+  const s = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  const bootCount = s.hooks.SessionStart.filter((e) => e.hooks?.[0]?.command === bootCmd(w.paths)).length;
+  const backups = readdirSync(join(w.home, '.claude')).filter((f) => f.startsWith('settings.json.bak-'));
+  assert(/Collapsed 9 duplicate hook entries/.test(out), 'reports 9 collapsed', out);
+  assert(bootCount === 1, `boot-hook entries collapsed to 1 (got ${bootCount})`);
+  assert(s.hooks.SessionStart.length === 2, 'boot hook + branch guard remain');
+  assert(s.hooks.Stop.length === 1, 'unrelated Stop hook preserved');
+  assert(s.unknownTopLevelKey?.keep === 'me', 'unknown top-level key preserved');
+  assert(backups.length === 1, `timestamped backup written (found ${backups.length})`);
+  if (backups.length === 1) {
+    const bak = JSON.parse(readFileSync(join(w.home, '.claude', backups[0]), 'utf-8'));
+    assert(bak.hooks.SessionStart.length === 11, 'backup holds the pre-fix state');
+  }
+  const again = runDoctor(w, true);
+  assert(!/Collapsed/.test(again), 'second --fix run finds nothing to collapse', again);
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 3: invalid model value reported and removed under --fix');
+{
+  // The corruption fixture carries a REAL ESC control char (0x1B): "opus"
+  // plus an ANSI bold fragment, which is what a terminal paste persists.
+  // Printable brackets alone are NOT corruption (see Test 4).
+  const w = setupHome((paths) => ({ model: 'opus\x1b[1m', hooks: { SessionStart: [bootEntry(paths)] } }));
+  const out = runDoctor(w);
+  assert(/model value is invalid/.test(out), 'reports invalid model', out);
+  const before = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  assert(typeof before.model === 'string', 'model untouched without --fix');
+  const fixOut = runDoctor(w, true);
+  const s = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  assert(/Removed invalid model value/.test(fixOut), 'reports removal under --fix', fixOut);
+  assert(!('model' in s), 'model key removed from disk');
+  assert(s.hooks.SessionStart.length === 1, 'hooks untouched by model fix');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 4: valid model values are left alone (including bracketed 1M-context IDs)');
+{
+  const w = setupHome(() => ({ model: 'claude-fable-5[1m]', hooks: {} }));
+  const out = runDoctor(w, true);
+  const s = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  assert(!/model value is invalid/.test(out), 'no invalid-model report for bracketed 1M id', out);
+  assert(s.model === 'claude-fable-5[1m]', 'legitimate 1M-context model preserved');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 5: malformed settings.json warns, skips, file untouched');
+{
+  const w = setupHome(() => '{ this is not json\n');
+  const before = readFileSync(w.settingsPath, 'utf-8');
+  const out = runDoctor(w, true);
+  const after = readFileSync(w.settingsPath, 'utf-8');
+  assert(/not valid JSON; skipping hook\/model checks/.test(out), 'warns about malformed JSON', out);
+  assert(before === after, 'malformed file untouched');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+if (failed > 0) {
+  console.log(`\n${failed} assertion(s) failed`);
+  process.exit(1);
+}
+console.log('\nAll doctor hook-dedupe tests passed');

package/scripts/test-kaleidoscope-onboarding-copy.mjs

@@ -0,0 +1,170 @@
+import { readFileSync } from "node:fs";
+import assert from "node:assert/strict";
+
+const demo = readFileSync("src/hosted-mcp/demo/index.html", "utf8");
+const server = readFileSync("src/hosted-mcp/server.mjs", "utf8");
+
+function functionBody(source, name) {
+  const start = source.indexOf("async function " + name + "(");
+  assert.notEqual(start, -1, "missing function " + name);
+  const open = source.indexOf("{", start);
+  let depth = 0;
+  for (let i = open; i < source.length; i++) {
+    if (source[i] === "{") depth += 1;
+    if (source[i] === "}") depth -= 1;
+    if (depth === 0) return source.slice(open + 1, i);
+  }
+  throw new Error("unterminated function " + name);
+}
+
+function functionSource(source, name) {
+  const start = source.indexOf("function " + name + "(");
+  assert.notEqual(start, -1, "missing function " + name);
+  const open = source.indexOf("{", start);
+  let depth = 0;
+  for (let i = open; i < source.length; i++) {
+    if (source[i] === "{") depth += 1;
+    if (source[i] === "}") depth -= 1;
+    if (depth === 0) return source.slice(start, i + 1);
+  }
+  throw new Error("unterminated function " + name);
+}
+
+const noThanks = functionBody(demo, "showNoThanksFlow");
+const returningNoThanks = functionBody(demo, "showReturningUserNoThanksFlow");
+const startDemo = functionBody(demo, "startDemo");
+const authFlow = functionBody(demo, "doFaceIDAuth");
+const imageFlow = functionBody(demo, "generateKaleidoscope");
+const oldOutro = functionBody(demo, "showOutro");
+const approvedOutro = functionBody(demo, "showApprovedOutro");
+const returningOutro = functionBody(demo, "showReturningUserOutro");
+
+assert.match(startDemo, /Hi, I'm L\\u0113sa\. Welcome to Kaleidoscope\./);
+assert.match(startDemo, /You just created an account with a passkey\. The passkey lives on your phone\./);
+assert.match(startDemo, /Going forward, you can use your phone to log into any Work in Progress Computer service\./);
+assert.match(startDemo, /Anytime I need your permission to do something, I'll ask, and you authorize with your fingerprint or face\. No passwords\. Ever\./);
+assert.match(startDemo, /Hi, " \+ currentAccountLabel\(\) \+ "\. Welcome back to Kaleidoscope\./);
+assert.match(startDemo, /Do you want to try giving me permission with your device to create something that costs money\?/);
+assert.doesNotMatch(startDemo, /getWalletSummary\(\)/);
+assert.doesNotMatch(startDemo, /Your balance is " \+ wallet\.balance/);
+assert.doesNotMatch(startDemo, /Your account is a key on your device, not an email\./);
+assert.doesNotMatch(startDemo, /You just logged in with your passkey/);
+assert.doesNotMatch(startDemo, /And I can use it too/);
+
+assert.match(demo, /I have a wallet with " \+ wallet\.balance \+ "\. Do I have your permission to spend " \+ wallet\.cost/);
+assert.match(demo, /addMessage\('Authorizing', 'user'\)/);
+assert.doesNotMatch(demo, /addMessage\('Authorized', 'user'\)/);
+assert.doesNotMatch(demo, /This is the end of the demo\. Tap the icon to start over\./);
+assert.doesNotMatch(demo, /open wip\.computer\/demo/);
+
+assert.match(noThanks, /No problem\. Let me show you something beautiful\./);
+assert.match(noThanks, /IS_RETURNING_USER_FLOW/);
+assert.match(noThanks, /showReturningUserNoThanksFlow\(\)/);
+assert.match(noThanks, /generateKaleidoscope\(false, \{ showWalletReceipt: false, showOutro: false \}\)/);
+assert.match(noThanks, /showApprovedOutro\(\)/);
+assert.doesNotMatch(noThanks, /\/demo\/api\/imagine/);
+assert.doesNotMatch(noThanks, /fallback\.jpg/);
+assert.doesNotMatch(noThanks, /Cost:/);
+assert.doesNotMatch(noThanks, /Balance:/);
+
+assert.match(returningNoThanks, /No problem\. You can come back anytime\./);
+assert.match(returningNoThanks, /At Work in Progress Computer, we are building the future of AI and human interaction\./);
+assert.match(returningNoThanks, /https:\/\/x\.com\/wipcomputer/);
+assert.match(returningNoThanks, /Made in California by WIP Computer, Inc\. Learning Dreaming Machines\./);
+assert.doesNotMatch(returningNoThanks, /generateKaleidoscope/);
+assert.doesNotMatch(returningNoThanks, /\/demo\/api\/imagine/);
+assert.doesNotMatch(returningNoThanks, /Cost:/);
+assert.doesNotMatch(returningNoThanks, /Balance:/);
+assert.doesNotMatch(returningNoThanks, /passkey/i);
+
+assert.match(imageFlow, /var showWalletReceipt = options\.showWalletReceipt !== false;/);
+assert.match(imageFlow, /if \(showWalletReceipt\) \{/);
+assert.match(imageFlow, /body: JSON\.stringify\(\{ prompt: prompt \}\)/);
+assert.doesNotMatch(imageFlow, /mode:/);
+assert.doesNotMatch(server, /no_thanks/i);
+assert.doesNotMatch(server, /Free onboarding generation/);
+
+assert.match(oldOutro, /IS_RETURNING_USER_FLOW/);
+assert.match(oldOutro, /showReturningUserOutro\(\)/);
+assert.match(oldOutro, /showApprovedOutro\(\)/);
+assert.match(approvedOutro, /At Work in Progress Computer, we are building the future of AI and human interaction\./);
+assert.match(approvedOutro, /https:\/\/wip\.computer\/demo/);
+assert.match(approvedOutro, /https:\/\/x\.com\/wipcomputer/);
+assert.match(approvedOutro, /Your passkey will keep working after you leave\./);
+assert.doesNotMatch(approvedOutro, /Your account stays active/);
+assert.doesNotMatch(approvedOutro, /When you come back/);
+
+assert.match(returningOutro, /At Work in Progress Computer, we are building the future of AI and human interaction\./);
+assert.match(returningOutro, /We believe permission is a conversation\. Your AI asks\. You decide\. One glance, one tap\./);
+assert.match(returningOutro, /https:\/\/x\.com\/wipcomputer/);
+assert.match(returningOutro, /Made in California by WIP Computer, Inc\. Learning Dreaming Machines\./);
+assert.doesNotMatch(returningOutro, /https:\/\/wip\.computer\/demo/);
+assert.doesNotMatch(returningOutro, /log out/);
+assert.doesNotMatch(returningOutro, /Your passkey will keep working after you leave\./);
+assert.doesNotMatch(returningOutro, /Your account stays active/);
+assert.doesNotMatch(returningOutro, /When you come back/);
+
+assert.match(authFlow, /That passkey belongs to a different account/);
+assert.match(authFlow, /isSameAccountAuthorization\(result, activeToken, activeTenant\)/);
+assert.doesNotMatch(authFlow, /result\.tenantId !== activeTenant/);
+
+const { canonicalAccountId, isSameAccountAuthorization } = Function(
+  functionSource(demo, "canonicalAccountId") + "\n"
+  + functionSource(demo, "isSameAccountAuthorization") + "\n"
+  + "return { canonicalAccountId, isSameAccountAuthorization };"
+)();
+
+assert.equal(canonicalAccountId("acct:parker-smoke-test"), "parker-smoke-test");
+assert.equal(canonicalAccountId("parker-smoke-test"), "parker-smoke-test");
+assert.equal(canonicalAccountId(" key:abc "), "key:abc");
+assert.equal(canonicalAccountId(""), null);
+assert.equal(canonicalAccountId(null), null);
+
+assert.equal(
+  isSameAccountAuthorization({ tenantId: "parker-smoke-test", apiKey: "different-token" }, "active-token", "acct:parker-smoke-test"),
+  true,
+);
+assert.equal(
+  isSameAccountAuthorization({ tenantId: "acct:parker-smoke-test", apiKey: "different-token" }, "active-token", "parker-smoke-test"),
+  true,
+);
+assert.equal(
+  isSameAccountAuthorization({ tenantId: "acct:other-account", apiKey: "active-token" }, "active-token", "acct:parker-smoke-test"),
+  false,
+);
+assert.equal(
+  isSameAccountAuthorization({ apiKey: "active-token" }, "active-token", null),
+  true,
+);
+assert.equal(
+  isSameAccountAuthorization({ apiKey: "other-token" }, "active-token", null),
+  false,
+);
+
+assert.match(demo, /id="kscopeIcon" type="button" onclick="logoutAndSignBackIn\(\)"/);
+assert.match(demo, /sessionStorage\.removeItem\('lesa-token'\)/);
+assert.match(demo, /window\.location\.href = '\/login\?next=\/demo'/);
+
+assert.match(server, /const IMAGE_COST_CENTS = 1;/);
+assert.match(server, /const INITIAL_BALANCE_CENTS = 1000;/);
+assert.match(server, /const DEMO_WALLET_RESET_MARKER_FILE = join/);
+assert.match(server, /\.demo-wallet-reset-v0-4-87\.json/);
+assert.match(server, /function walletUserIdForAgent\(agentId\)/);
+assert.match(server, /agentId\.startsWith\("acct:"\) \? agentId\.slice\("acct:"\.length\) : agentId/);
+assert.match(server, /function resetAndNormalizeWalletFileEntries\(wallets\)/);
+assert.match(server, /normalizedWallets\[walletUserIdForAgent\(agentId\)\] = INITIAL_BALANCE_CENTS/);
+assert.match(server, /async function resetExistingDemoWalletsToStarterBalanceOnce\(\)/);
+assert.match(server, /await prisma\.wallet\.updateMany\(\{ data: \{ balance: INITIAL_BALANCE_CENTS \} \}\)/);
+assert.match(server, /saveWalletsToFile\(normalizedWalletFile\.wallets\)/);
+assert.match(server, /prismaCount: prismaResetCount/);
+assert.match(server, /jsonCount: jsonResetCount/);
+assert.match(server, /const walletUserId = walletUserIdForAgent\(agentId\);/);
+assert.match(server, /where: \{ userId: walletUserId \}/);
+assert.match(server, /data: \{ userId: walletUserId, balance: INITIAL_BALANCE_CENTS \}/);
+assert.match(server, /return w\[walletUserId\] !== undefined \? w\[walletUserId\] : INITIAL_BALANCE_CENTS/);
+assert.match(server, /if \(w\[walletUserId\] === undefined\) w\[walletUserId\] = INITIAL_BALANCE_CENTS/);
+assert.match(server, /w\[walletUserId\] = Math\.max\(0, w\[walletUserId\] - cents\)/);
+assert.match(server, /return w\[walletUserId\]/);
+assert.match(server, /await resetExistingDemoWalletsToStarterBalanceOnce\(\);/);
+
+console.log("Kaleidoscope onboarding copy checks passed");

package/scripts/test-kaleidoscope-public-stats-baseline.mjs

@@ -0,0 +1,129 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import vm from "node:vm";
+
+const serverSource = readFileSync("src/hosted-mcp/server.mjs", "utf8");
+assert.match(serverSource, /startsAt: "2026-05-21T07:00:00\.000Z"/);
+assert.match(serverSource, /keysCreated: 3/);
+assert.match(serverSource, /genericKaleidoscopes: 11/);
+assert.match(serverSource, /imageKaleidoscopes: 3/);
+
+const start = serverSource.indexOf("function parseTimestampMs");
+const end = serverSource.indexOf("function loadLiveWallState()");
+assert.notEqual(start, -1, "baseline helper block start not found");
+assert.notEqual(end, -1, "baseline helper block end not found");
+assert.ok(end > start, "baseline helper block is malformed");
+
+const helperSource = `
+const KALEIDOSCOPE_PUBLIC_STATS_BASELINE = Object.freeze({
+  timezone: "America/Los_Angeles",
+  date: "2026-05-21",
+  startsAt: "2026-05-21T07:00:00.000Z",
+  counts: Object.freeze({
+    keysCreated: 3,
+    genericKaleidoscopes: 11,
+    imageKaleidoscopes: 3,
+  }),
+});
+${serverSource.slice(start, end)}
+globalThis.__statsHelpers = {
+  KALEIDOSCOPE_PUBLIC_STATS_BASELINE,
+  deriveKaleidoscopePublicStats,
+  isWipTestHandle,
+  createdAtSinceBaseline,
+};
+`;
+
+const context = {
+  console,
+  Date,
+  Object,
+  Number,
+  String,
+  Array,
+  isPublicWallImageUrl(value) {
+    return typeof value === "string" && value.startsWith("https://wip.computer/media/kaleidoscope/generated/");
+  },
+};
+
+vm.createContext(context);
+vm.runInContext(helperSource, context);
+
+const {
+  KALEIDOSCOPE_PUBLIC_STATS_BASELINE,
+  deriveKaleidoscopePublicStats,
+  isWipTestHandle,
+  createdAtSinceBaseline,
+} = context.__statsHelpers;
+
+assert.deepEqual(JSON.parse(JSON.stringify(KALEIDOSCOPE_PUBLIC_STATS_BASELINE.counts)), {
+  keysCreated: 3,
+  genericKaleidoscopes: 11,
+  imageKaleidoscopes: 3,
+});
+assert.equal(KALEIDOSCOPE_PUBLIC_STATS_BASELINE.startsAt, "2026-05-21T07:00:00.000Z");
+assert.equal(isWipTestHandle("wiptest-parker"), true);
+assert.equal(isWipTestHandle("WIPTEST-PARKER"), true);
+assert.equal(isWipTestHandle("passkey-123"), false);
+assert.equal(createdAtSinceBaseline({ createdAt: "2026-05-21T06:59:59.999Z" }), false);
+assert.equal(createdAtSinceBaseline({ createdAt: "2026-05-21T07:00:00.000Z" }), true);
+
+const images = [
+  {
+    url: "https://wip.computer/media/kaleidoscope/generated/prebaseline-generic.jpg",
+    kind: "generic",
+    createdAt: "2026-05-20T00:00:00.000Z",
+  },
+  {
+    url: "https://wip.computer/media/kaleidoscope/generated/postbaseline-generic.jpg",
+    kind: "generic",
+    createdAt: "2026-05-21T07:00:00.000Z",
+  },
+  {
+    url: "https://wip.computer/media/kaleidoscope/generated/postbaseline-image.jpg",
+    kind: "image",
+    createdAt: "2026-05-21T08:00:00.000Z",
+  },
+  {
+    url: "https://wip.computer/media/kaleidoscope/generated/older-image.jpg",
+    kind: "image",
+    createdAt: "2026-05-20T01:00:00.000Z",
+  },
+];
+const passkeyEntries = [
+  { handle: "passkey-before", createdAt: "2026-05-20T00:00:00.000Z" },
+  { handle: "wiptest-after", createdAt: "2026-05-21T08:00:00.000Z" },
+  { handle: "user-after", createdAt: "2026-05-21T09:00:00.000Z" },
+  { handle: "wiptest-newest", createdAt: "2026-05-21T09:15:00.000Z" },
+];
+
+const stats = deriveKaleidoscopePublicStats({
+  images,
+  passkeyEntries,
+  now: new Date("2026-05-21T09:30:00.000Z"),
+});
+
+assert.equal(images.length, 4, "stats helper must not remove live-wall images");
+assert.equal(stats.genericKaleidoscopes, 12);
+assert.equal(stats.imageKaleidoscopes, 4);
+assert.equal(stats.keysCreated, 4);
+assert.equal(stats.publicWallImages, 4);
+assert.deepEqual(JSON.parse(JSON.stringify(stats.newSinceBaseline)), {
+  genericKaleidoscopes: 1,
+  imageKaleidoscopes: 1,
+  keysCreated: 1,
+  total: 3,
+});
+assert.equal(stats.last24Hours.wallImages, 2);
+assert.equal(stats.last24Hours.keysCreated, 1);
+assert.equal(stats.lastCreated, "2026-05-21T09:00:00.000Z");
+
+const wiptestOnly = deriveKaleidoscopePublicStats({
+  images: [],
+  passkeyEntries: [{ handle: "wiptest-only", createdAt: "2026-05-21T10:00:00.000Z" }],
+  now: new Date("2026-05-21T10:00:00.000Z"),
+});
+assert.equal(wiptestOnly.keysCreated, 3);
+assert.equal(wiptestOnly.newSinceBaseline.keysCreated, 0);
+
+console.log("kaleidoscope public stats baseline tests passed");

package/scripts/test-kaleidoscope-qr-authenticator-confirmation.mjs

@@ -0,0 +1,89 @@
+import { readFileSync } from "node:fs";
+
+const loginFiles = [
+  "src/hosted-mcp/app/kaleidoscope-login.html",
+  "src/hosted-mcp/demo/login.html",
+];
+
+function assertContains(source, needle, label) {
+  if (!source.includes(needle)) {
+    throw new Error(`${label} missing expected text: ${needle}`);
+  }
+}
+
+function assertBefore(source, first, second, label) {
+  const firstIndex = source.indexOf(first);
+  const secondIndex = source.indexOf(second);
+  if (firstIndex === -1 || secondIndex === -1 || firstIndex >= secondIndex) {
+    throw new Error(`${label} expected "${first}" before "${second}"`);
+  }
+}
+
+function extractFunction(source, name) {
+  const start = source.indexOf(`function ${name}(`);
+  if (start === -1) throw new Error(`could not find function ${name}`);
+  const bodyStart = source.indexOf("{", start);
+  let depth = 0;
+  for (let i = bodyStart; i < source.length; i += 1) {
+    if (source[i] === "{") depth += 1;
+    if (source[i] === "}") depth -= 1;
+    if (depth === 0) return source.slice(start, i + 1);
+  }
+  throw new Error(`could not extract function ${name}`);
+}
+
+function assertNotContains(source, needle, label) {
+  if (source.includes(needle)) {
+    throw new Error(`${label} must not contain: ${needle}`);
+  }
+}
+
+for (const file of loginFiles) {
+  const html = readFileSync(file, "utf8");
+  const followFunction = extractFunction(html, "followPairNextIfPresent");
+  const backFunction = extractFunction(html, "backToLoginAfterQrScan");
+
+  assertContains(html, 'id="qr-auth-confirm-view"', `${file} confirmation view`);
+  assertContains(html, "Your authenticated Kaleidoscope session is available on your other device.", `${file} confirmation headline`);
+  assertContains(html, "Back to login", `${file} back button copy`);
+  assertNotContains(html, "Open session here", `${file} authenticator completion must not offer local demo open`);
+  assertNotContains(html, ">Close</button>", `${file} authenticator completion must not show close action`);
+  assertNotContains(html, "Kaleidoscope is ready there.", `${file} removed ready helper copy`);
+  assertNotContains(html, "Open Kaleidoscope here", `${file} removed duplicated open copy`);
+  assertNotContains(html, "Keep using Kaleidoscope on the other device.", `${file} removed cancel helper copy`);
+  assertNotContains(html, "Scan QR Code", `${file} login-page scanner action must be absent`);
+  assertNotContains(html, "BarcodeDetector", `${file} login-page scanner detector must be absent`);
+  assertNotContains(html, "getUserMedia", `${file} login-page scanner camera code must be absent`);
+  assertContains(html, "You can close this page.", `${file} close fallback copy`);
+
+  assertContains(html, "function showQrAuthenticatorConfirmation(identity, isNewAccount)", `${file} confirmation function`);
+  assertContains(html, "function backToLoginAfterQrScan()", `${file} back-to-login function`);
+
+  assertContains(
+    html,
+    "if (DEMO_NEXT_REGEX.test(approveResponse.next)) {\n      return showQrAuthenticatorConfirmation(identity, isNewAccount === true);\n    }",
+    `${file} QR authenticator demo next shows confirmation`,
+  );
+  assertBefore(
+    html,
+    "return showQrAuthenticatorConfirmation(identity, isNewAccount === true);",
+    "next = approveResponse.next;",
+    `${file} confirmation intercepts approve next before redirect`,
+  );
+  assertNotContains(followFunction, "location.replace('/demo');", `${file} QR approve path must not directly enter demo`);
+  assertNotContains(followFunction, 'location.href = "/demo";', `${file} QR approve path must not assign demo href`);
+  assertNotContains(followFunction, "storeDemoHandoffIfNeeded('/demo'", `${file} QR approve path must not store demo handoff`);
+
+  assertContains(backFunction, "location.replace('/login?next=/demo');", `${file} back returns to login`);
+  assertNotContains(backFunction, "storeDemoHandoffIfNeeded", `${file} back must not store demo handoff`);
+  assertNotContains(backFunction, "location.replace('/demo')", `${file} back must not open demo`);
+
+  assertContains(html, "if (await followPairNextIfPresent(approveResponse, result, true)) return;", `${file} create caller stops after confirmation`);
+  assertContains(html, "if (await followPairNextIfPresent(approveResponse, result, false)) return;", `${file} sign-in caller stops after confirmation`);
+  assertContains(html, "storeDemoHandoffIfNeeded(data.next, data, qrLoginMode === 'register');", `${file} requester QR status still stores handoff`);
+  assertContains(html, "location.replace(data.next);", `${file} requester QR status still redirects`);
+  assertContains(html, "storeDemoHandoffIfNeeded('/demo', result, true);", `${file} same-device create still stores demo handoff`);
+  assertContains(html, "storeDemoHandoffIfNeeded('/demo', result, false);", `${file} same-device sign-in still stores demo handoff`);
+}
+
+console.log("kaleidoscope QR authenticator confirmation checks passed");

package/shared/boot/boot-config.json

@@ -2,19 +2,23 @@
   "agentId": "cc-mini",
   "timezone": "America/Los_Angeles",
   "maxTotalLines": 2000,
+  "stalenessDays": 14,
+  "dailyLogStalenessDays": 2,
   "steps": {
     "sharedContext": {
       "path": "~/.openclaw/workspace/SHARED-CONTEXT.md",
       "label": "SHARED-CONTEXT.md",
       "stepNumber": 2,
-      "critical": true
+      "critical": true,
+      "maxLines": 80
     },
     "journals": {
       "dir": "~/wipcomputerinc/team/cc-mini/documents/journals",
       "label": "Most Recent Journal (Parker)",
       "stepNumber": 3,
       "maxLines": 80,
-      "strategy": "most-recent"
+      "strategy": "most-recent",
+      "stalenessDays": 14
     },
     "workspaceDailyLogs": {
       "dir": "~/.openclaw/workspace/memory",
@@ -22,7 +26,8 @@
       "stepNumber": 4,
       "maxLines": 40,
       "strategy": "daily-logs",
-      "days": ["today", "yesterday"]
+      "days": ["today", "yesterday"],
+      "dailyLogStalenessDays": 2
     },
     "fullHistory": {
       "label": "Full History",
@@ -33,19 +38,22 @@
       "path": "~/.ldm/agents/cc-mini/CONTEXT.md",
       "label": "CC CONTEXT.md",
       "stepNumber": 6,
-      "critical": true
+      "critical": true,
+      "maxLines": 60
     },
     "soul": {
       "path": "~/.ldm/agents/cc-mini/SOUL.md",
       "label": "CC SOUL.md",
-      "stepNumber": 7
+      "stepNumber": 7,
+      "maxLines": 80
     },
     "ccJournals": {
       "dir": "~/.ldm/agents/cc-mini/memory/journals",
       "label": "Most Recent CC Journal",
       "stepNumber": 8,
       "maxLines": 80,
-      "strategy": "most-recent"
+      "strategy": "most-recent",
+      "stalenessDays": 14
     },
     "ccDailyLog": {
       "dir": "~/.ldm/agents/cc-mini/memory/daily",
@@ -53,13 +61,15 @@
       "stepNumber": 9,
       "maxLines": 60,
       "strategy": "daily-logs",
-      "days": ["today", "yesterday"]
+      "days": ["today", "yesterday"],
+      "dailyLogStalenessDays": 2
     },
     "repoLocations": {
       "path": "~/.claude/projects/-Users-lesa--openclaw/memory/repo-locations.md",
       "label": "repo-locations.md",
       "stepNumber": 10,
-      "critical": true
+      "critical": true,
+      "maxLines": 80
     }
   }
 }