@wipcomputer/wip-ldm-os 0.4.85-alpha.30 → 0.4.85-alpha.33

package/bin/ldm.js

@@ -24,6 +24,7 @@ import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, cpSync
 import { join, basename, resolve, dirname } from 'node:path';
 import { execSync, spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { createHash } from 'node:crypto';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -409,9 +410,39 @@ function cleanStaleHooks() {
 
 // ── Boot hook sync (#49) ──
 
+// The registered SessionStart hook command is the single source of truth for
+// WHERE the boot hook actually executes from. Historically syncBootHook()
+// deployed to ~/.ldm/library/boot while the registered command pointed at
+// ~/.ldm/shared/boot (installer.mjs BOOT_DIR): new code landed in library/,
+// sessions ran the stale copy in shared/, and the install reported success.
+// Resolve the deploy target from the registered entry so the two can never
+// diverge again. Fallback is shared/boot, matching installer.mjs BOOT_DIR and
+// configureSessionStartHook() so a fresh machine stays consistent.
+// Ticket: ai/product/bugs/installer/open-tickets/2026-07-05--cc-mini--shared-library-split-brain-boot-deploy.md
+function getRegisteredBootHookTarget() {
+  const settings = readJSON(join(HOME, '.claude', 'settings.json'));
+  const entries = settings?.hooks?.SessionStart;
+  if (!Array.isArray(entries)) return null;
+  for (const entry of entries) {
+    for (const h of (entry?.hooks || [])) {
+      const cmd = h?.command || '';
+      const m = cmd.match(/(\S*boot-hook\.mjs)/);
+      if (m) return m[1].replace(/^["']|["']$/g, '');
+    }
+  }
+  return null;
+}
+
+function resolveBootExecDir() {
+  const target = getRegisteredBootHookTarget();
+  if (target) return dirname(target);
+  // Canonical default: same as src/boot/installer.mjs BOOT_DIR.
+  return join(LDM_ROOT, 'shared', 'boot');
+}
+
 function syncBootHook() {
   const srcBoot = join(__dirname, '..', 'src', 'boot', 'boot-hook.mjs');
-  const destBoot = join(LDM_ROOT, 'library', 'boot', 'boot-hook.mjs');
+  const destBoot = join(resolveBootExecDir(), 'boot-hook.mjs');
 
   if (!existsSync(srcBoot)) return false;
 
@@ -3099,6 +3130,161 @@ async function cmdDoctor() {
     }
   }
 
+  // Duplicate hook entries + invalid model value in ~/.claude/settings.json.
+  // Duplicates: the same hook (event + matcher + commands) registered more
+  // than once runs once per copy every session. 10 duplicate SessionStart
+  // boot-hook entries observed 2026-07-04 (~450KB of boot context per
+  // session start). Invalid model: a paste carrying ANSI escape codes can
+  // land in /model and get persisted (e.g. "opus" + ESC + "[1m"); every new
+  // session then fails its first API call. The corruption signal is a
+  // CONTROL character (ESC 0x1B etc.), never the visible charset: bracketed
+  // IDs like "claude-fable-5[1m]" are legitimate 1M-context variants and
+  // must be left untouched.
+  // Reported always; collapsed/removed under --fix with a timestamped
+  // backup written before the first mutation.
+  // See ai/product/bugs/installer/open-tickets/2026-07-04--cc-mini--installer-sessionstart-hook-duplicate-registration.md
+  // and ai/product/bugs/guard/2026-07-04--cc-mini--no-blessed-recipe-for-live-settings-remediation.md
+  {
+    const settingsPath = join(HOME, '.claude', 'settings.json');
+    const settings = readJSON(settingsPath);
+    if (!settings && existsSync(settingsPath)) {
+      console.log('  ! ~/.claude/settings.json exists but is not valid JSON; skipping hook/model checks');
+      issues++;
+    }
+    let settingsDirty = false;
+    let backupDone = false;
+    const backupSettingsOnce = () => {
+      if (backupDone) return;
+      const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+      const bak = `${settingsPath}.bak-${stamp}`;
+      copyFileSync(settingsPath, bak);
+      console.log(`  + Backup written: ${bak}`);
+      backupDone = true;
+    };
+
+    // Duplicate hook entries (same event + matcher + hook command list).
+    // Deliberately ignores type/timeout: entries differing only in timeout
+    // are treated as duplicates and collapse to the first.
+    if (settings?.hooks) {
+      const dupes = [];
+      for (const [event, groups] of Object.entries(settings.hooks)) {
+        if (!Array.isArray(groups)) continue;
+        const seen = new Map();
+        groups.forEach((g, i) => {
+          const key = JSON.stringify({
+            matcher: g?.matcher,
+            hooks: (g?.hooks || []).map((h) => h?.command),
+          });
+          if (!seen.has(key)) seen.set(key, []);
+          seen.get(key).push(i);
+        });
+        for (const idxs of seen.values()) {
+          if (idxs.length > 1) dupes.push({ event, idxs });
+        }
+      }
+      const extra = dupes.reduce((n, d) => n + d.idxs.length - 1, 0);
+      if (extra > 0) {
+        for (const d of dupes) {
+          const cmd = settings.hooks[d.event][d.idxs[0]]?.hooks?.[0]?.command || '(no command)';
+          console.log(`  ! ${d.event}: ${d.idxs.length} identical hook entries for: ${cmd}`);
+        }
+        if (FIX_FLAG) {
+          backupSettingsOnce();
+          for (const d of dupes) {
+            // Keep the first, drop the rest. Right-to-left so indices stay valid.
+            for (let j = d.idxs.length - 1; j >= 1; j--) {
+              settings.hooks[d.event].splice(d.idxs[j], 1);
+            }
+          }
+          settingsDirty = true;
+          console.log(`  + Collapsed ${extra} duplicate hook entr${extra === 1 ? 'y' : 'ies'}`);
+        } else {
+          console.log(`    Run: ldm doctor --fix to collapse ${extra} duplicate hook entr${extra === 1 ? 'y' : 'ies'}`);
+          issues += extra;
+        }
+      }
+    }
+
+    // Invalid model value. Corruption means CONTROL characters (ESC 0x1B
+    // from ANSI fragments, NUL, DEL...) or an impossible length, never a
+    // visible-charset judgment: "claude-fable-5[1m]" is a legitimate
+    // 1M-context model ID and must pass.
+    if (settings && typeof settings.model === 'string') {
+      const valid =
+        settings.model.length > 0 &&
+        settings.model.length <= 256 &&
+        !/[\x00-\x1f\x7f]/.test(settings.model);
+      if (!valid) {
+        console.log(`  ! settings.json model value is invalid: ${JSON.stringify(settings.model)}`);
+        if (FIX_FLAG) {
+          backupSettingsOnce();
+          delete settings.model;
+          settingsDirty = true;
+          console.log('  + Removed invalid model value (re-pick with /model in Claude Code)');
+        } else {
+          console.log('    Run: ldm doctor --fix to remove it, then re-pick with /model in Claude Code');
+          issues++;
+        }
+      }
+    }
+
+    if (settingsDirty) {
+      writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
+    }
+  }
+
+  // Boot hook stale at execution path.
+  //
+  // Split-brain deploys are silent: version tracking can say the boot hook
+  // updated while the SessionStart hook still executes an older copy on disk
+  // (2026-07-05: install reported alpha.32's boot trim active, but the live
+  // payload was the untrimmed 49KB because syncBootHook wrote library/boot
+  // while the hook ran shared/boot). Hash-compare the file the registered
+  // hook actually runs against this CLI's src/boot/boot-hook.mjs (the code the
+  // installer would deploy). Divergence means the hook is running stale code.
+  // Ticket: ai/product/bugs/installer/open-tickets/2026-07-05--cc-mini--shared-library-split-brain-boot-deploy.md
+  {
+    const execTarget = getRegisteredBootHookTarget();
+    const srcBoot = join(__dirname, '..', 'src', 'boot', 'boot-hook.mjs');
+    const hashFile = (p) => {
+      try { return createHash('sha256').update(readFileSync(p)).digest('hex'); } catch { return null; }
+    };
+    if (execTarget && existsSync(srcBoot)) {
+      const srcHash = hashFile(srcBoot);
+      const execExists = existsSync(execTarget);
+      const execHash = execExists ? hashFile(execTarget) : null;
+      // Informational: which of the known deploy locations already matches src.
+      const freshCandidates = [
+        join(LDM_ROOT, 'shared', 'boot', 'boot-hook.mjs'),
+        join(LDM_ROOT, 'library', 'boot', 'boot-hook.mjs'),
+      ].filter((p) => existsSync(p) && hashFile(p) === srcHash);
+      if (!execExists || execHash !== srcHash) {
+        const short = (h) => (h ? h.slice(0, 12) : 'missing');
+        console.log(`  ! boot hook stale at execution path: ${execTarget.replace(HOME, '~')}`);
+        console.log(`    the registered SessionStart hook runs ${short(execHash)}, current is ${short(srcHash)}`);
+        if (freshCandidates.length > 0) {
+          console.log(`    a current copy exists at: ${freshCandidates[0].replace(HOME, '~')}`);
+        }
+        if (FIX_FLAG) {
+          try {
+            if (execExists) {
+              const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+              copyFileSync(execTarget, `${execTarget}.bak-${stamp}`);
+            }
+            mkdirSync(dirname(execTarget), { recursive: true });
+            copyFileSync(srcBoot, execTarget);
+            console.log('  + Redeployed the current boot hook to the execution path');
+          } catch (e) {
+            console.log(`  x Could not redeploy boot hook to execution path: ${e.message}`);
+          }
+        } else {
+          console.log('    Run: ldm doctor --fix to redeploy the current boot hook to the execution path');
+          issues++;
+        }
+      }
+    }
+  }
+
   // --fix: clean registry entries with /tmp/ sources or ldm-install- names (#54)
   if (FIX_FLAG) {
     const registry = readJSON(REGISTRY_PATH);

package/lib/deploy.mjs

@@ -19,6 +19,7 @@ import { join, basename, resolve, dirname } from 'node:path';
 import { tmpdir } from 'node:os';
 import { detectInterfaces, describeInterfaces, detectToolbox } from './detect.mjs';
 import { moveToTrash, appendToManifest } from './safe.mjs';
+import { configureSessionStartHook } from '../src/boot/installer.mjs';
 
 const HOME = process.env.HOME || '';
 const LDM_ROOT = join(HOME, '.ldm');
@@ -1117,6 +1118,40 @@ function installClaudeCodeHook(repoPath, doorOrDoors, toolName = basename(repoPa
 }
 
 function installClaudeCodeHookEvent(repoPath, door, toolName = basename(repoPath)) {
+  // Boot hook special case: single-owner delegation.
+  //
+  // The SessionStart boot hook's deployed command lives in ~/.ldm/shared/boot,
+  // NOT under ~/.ldm/extensions/<toolName>/. The extension-dir ownership match
+  // below keys on `/<toolName>/` in the command string, so it can never
+  // recognize an existing boot entry and appends a fresh duplicate on every
+  // manifest-driven install (10 copies accumulated 2026-07-04, ~450KB of boot
+  // context per session). configureSessionStartHook() in src/boot/installer.mjs
+  // is the single canonical registrar: it owns the whole boot-hook set,
+  // collapses duplicates, canonicalizes the command to BOOT_DIR, persists, and
+  // no-ops when already correct. Route boot-hook doors there so there is one
+  // writer, not two. Discriminating on the command (not the event alone) keeps
+  // other SessionStart hooks, e.g. wip-branch-guard's, on the normal path.
+  //
+  // Ticket: ai/product/bugs/installer/open-tickets/2026-07-05--cc-mini--deploy-hook-ownership-misses-boot-hook.md
+  const declaredCommand = door.command || '';
+  const isBootHookDoor =
+    (door.event || 'PreToolUse') === 'SessionStart' &&
+    (declaredCommand.includes('boot-hook') || /shared[/\\]boot/.test(declaredCommand));
+  if (isBootHookDoor) {
+    if (DRY_RUN) {
+      ok('Claude Code: would configure SessionStart boot hook (single-owner)');
+      return true;
+    }
+    try {
+      const result = configureSessionStartHook();
+      ok(`Claude Code: ${result}`);
+      return true;
+    } catch (e) {
+      fail(`Claude Code: boot hook registration failed. ${e.message}`);
+      return false;
+    }
+  }
+
   const settingsPath = join(HOME, '.claude', 'settings.json');
   let settings = readJSON(settingsPath);
 
@@ -1702,4 +1737,4 @@ export function disableExtension(name) {
 
 // ── Exports for ldm CLI ──
 
-export { loadRegistry, saveRegistry, updateRegistry, readJSON, writeJSON, runBuildIfNeeded, resolveLocalDeps, buildSourceInfo, CORE_EXTENSIONS };
+export { loadRegistry, saveRegistry, updateRegistry, readJSON, writeJSON, runBuildIfNeeded, resolveLocalDeps, buildSourceInfo, CORE_EXTENSIONS, installClaudeCodeHook };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-ldm-os",
-  "version": "0.4.85-alpha.30",
+  "version": "0.4.85-alpha.33",
   "type": "module",
   "description": "LDM OS: identity, memory, and sovereignty infrastructure for AI agents",
   "engines": {
@@ -33,6 +33,7 @@
     "test:installer-skill-dry-run-destinations": "node scripts/test-installer-skill-dry-run-destinations.mjs",
     "test:ldm-install-bin-shim": "node scripts/test-ldm-install-preserves-foreign-bin.mjs",
     "test:doctor-cron-target": "node scripts/test-doctor-cron-target.mjs",
+    "test:boot-payload-trim": "node scripts/test-boot-payload-trim.mjs",
     "test:bin-manifest": "node scripts/test-bin-manifest.mjs",
     "test:crc-agentid-tenant-boundary": "node scripts/test-crc-agentid-tenant-boundary.mjs",
     "test:crc-pair-login-flow": "node scripts/test-crc-pair-login-flow.mjs",
@@ -41,8 +42,15 @@
     "test:crc-e2ee-key-persistence": "node scripts/test-crc-e2ee-key-persistence.mjs",
     "test:crc-e2ee-session-route": "node scripts/test-crc-e2ee-session-route.mjs",
     "test:crc-websocket-abuse-limits": "node scripts/test-crc-websocket-abuse-limits.mjs",
+    "test:kaleidoscope-qr-authenticator-confirmation": "node scripts/test-kaleidoscope-qr-authenticator-confirmation.mjs",
+    "test:kaleidoscope-onboarding-copy": "node scripts/test-kaleidoscope-onboarding-copy.mjs",
+    "test:kaleidoscope-public-stats-baseline": "node scripts/test-kaleidoscope-public-stats-baseline.mjs",
     "fmt": "npx prettier --write 'src/**/*.{ts,mjs}' 'lib/**/*.mjs' 'bin/**/*.js'",
-    "fmt:check": "npx prettier --check 'src/**/*.{ts,mjs}' 'lib/**/*.mjs' 'bin/**/*.js'"
+    "fmt:check": "npx prettier --check 'src/**/*.{ts,mjs}' 'lib/**/*.mjs' 'bin/**/*.js'",
+    "test:boot-hook-registration": "node scripts/test-boot-hook-registration.mjs",
+    "test:doctor-hook-dedupe": "node scripts/test-doctor-hook-dedupe.mjs",
+    "test:boot-dir-truth": "node scripts/test-boot-dir-truth.mjs",
+    "test:deploy-hook-ownership": "node scripts/test-deploy-hook-ownership.mjs"
   },
   "claudeCode": {
     "hook": {

package/scripts/test-boot-dir-truth.mjs

@@ -0,0 +1,158 @@
+#!/usr/bin/env node
+// Regression test: `ldm doctor` boot-hook stale-at-execution-path check.
+//
+// Covers:
+//   ai/product/bugs/installer/open-tickets/2026-07-05--cc-mini--shared-library-split-brain-boot-deploy.md
+//
+// The split-brain bug: syncBootHook() deployed boot-hook.mjs to
+// ~/.ldm/library/boot while the registered SessionStart hook executed
+// ~/.ldm/shared/boot. New code landed in library/, sessions ran the stale
+// copy in shared/, and the install reported success. This test drives the
+// doctor check that makes the drift visible (and the --fix that repairs the
+// execution path), plus the no-false-positive cases.
+//
+// Follows the test-doctor-hook-dedupe.mjs pattern: real bin/ldm.js doctor
+// against a temp HOME, crontab/npm shimmed on PATH so operator state and the
+// network are never touched. LDM_SELF_UPDATED=1 skips CLI self-update.
+
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+
+const repo = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const cli = join(repo, 'bin', 'ldm.js');
+const pkg = JSON.parse(readFileSync(join(repo, 'package.json'), 'utf8'));
+// The current boot hook this CLI would deploy: doctor compares against it.
+const srcBootContent = readFileSync(join(repo, 'src', 'boot', 'boot-hook.mjs'), 'utf8');
+
+let failed = 0;
+function assert(cond, label, output = '') {
+  if (cond) {
+    console.log(`  [PASS] ${label}`);
+  } else {
+    console.log(`  [FAIL] ${label}`);
+    if (output) console.log(`         --- output (last lines) ---\n         ${output.trim().split('\n').slice(-25).join('\n         ')}`);
+    failed++;
+  }
+}
+
+// Build a fixture HOME. The registered SessionStart hook points at
+// ~/.ldm/shared/boot/boot-hook.mjs (the execution path). `execContent`
+// seeds that file; `libraryContent` seeds the parallel ~/.ldm/library/boot
+// copy (null to skip).
+function setupHome({ execContent, libraryContent }) {
+  const home = mkdtempSync(join(tmpdir(), 'ldm-bootdir-'));
+  const ldmRoot = join(home, '.ldm');
+  const fakeBin = join(home, 'fakebin');
+  mkdirSync(join(ldmRoot, 'extensions'), { recursive: true });
+  mkdirSync(join(home, '.claude'), { recursive: true });
+  mkdirSync(fakeBin, { recursive: true });
+
+  writeFileSync(join(ldmRoot, 'version.json'), JSON.stringify({ version: pkg.version }, null, 2) + '\n');
+  writeFileSync(join(ldmRoot, 'extensions', 'registry.json'), JSON.stringify({ _format: 'v2', extensions: {} }, null, 2) + '\n');
+
+  const execTarget = join(ldmRoot, 'shared', 'boot', 'boot-hook.mjs');
+  mkdirSync(dirname(execTarget), { recursive: true });
+  writeFileSync(execTarget, execContent);
+  if (libraryContent !== null && libraryContent !== undefined) {
+    const lib = join(ldmRoot, 'library', 'boot', 'boot-hook.mjs');
+    mkdirSync(dirname(lib), { recursive: true });
+    writeFileSync(lib, libraryContent);
+  }
+
+  // Registered SessionStart hook runs the shared/boot (execution) copy.
+  const settings = {
+    hooks: {
+      SessionStart: [
+        { matcher: '*', hooks: [{ type: 'command', command: `node ${execTarget}`, timeout: 15 }] },
+      ],
+    },
+  };
+  const settingsPath = join(home, '.claude', 'settings.json');
+  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
+
+  writeFileSync(join(fakeBin, 'crontab'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'crontab'), 0o755);
+  writeFileSync(join(fakeBin, 'npm'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'npm'), 0o755);
+
+  return { home, fakeBin, execTarget };
+}
+
+function runDoctor({ home, fakeBin }, fix = false) {
+  const args = ['doctor'];
+  if (fix) args.push('--fix');
+  try {
+    return execFileSync('node', [cli, ...args], {
+      env: { ...process.env, HOME: home, PATH: `${fakeBin}:${process.env.PATH}`, LDM_SELF_UPDATED: '1' },
+      encoding: 'utf-8',
+      timeout: 30000,
+    });
+  } catch (err) {
+    return (err.stdout || '') + (err.stderr || '');
+  }
+}
+
+const STALE = '// stale boot hook code (pre-trim)\nprocess.exit(0);\n';
+
+console.log('Test 1: stale execution path is reported, not written without --fix');
+{
+  const w = setupHome({ execContent: STALE, libraryContent: srcBootContent });
+  const before = readFileSync(w.execTarget, 'utf-8');
+  const out = runDoctor(w);
+  const after = readFileSync(w.execTarget, 'utf-8');
+  assert(/boot hook stale at execution path/.test(out), 'reports stale at execution path', out);
+  assert(/a current copy exists at:.*library\/boot/.test(out), 'points at the fresh library/boot copy', out);
+  assert(before === after, 'execution-path file untouched without --fix');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 2: --fix redeploys the current boot hook to the execution path');
+{
+  const w = setupHome({ execContent: STALE, libraryContent: srcBootContent });
+  const out = runDoctor(w, true);
+  const after = readFileSync(w.execTarget, 'utf-8');
+  const backups = readdirSync(dirname(w.execTarget)).filter((f) => f.startsWith('boot-hook.mjs.bak-'));
+  assert(/Redeployed the current boot hook to the execution path/.test(out), 'reports redeploy under --fix', out);
+  assert(after === srcBootContent, 'execution-path file now matches current src/boot/boot-hook.mjs');
+  assert(backups.length === 1, `stale copy backed up before overwrite (found ${backups.length})`);
+  const again = runDoctor(w, true);
+  assert(!/boot hook stale at execution path/.test(again), 'second --fix run finds nothing stale', again);
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 3: in-sync execution path is not flagged');
+{
+  const w = setupHome({ execContent: srcBootContent, libraryContent: null });
+  const out = runDoctor(w);
+  assert(!/boot hook stale at execution path/.test(out), 'no stale report when exec path matches src', out);
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 4: no registered boot hook is a no-op (no crash, no false positive)');
+{
+  const home = mkdtempSync(join(tmpdir(), 'ldm-bootdir-none-'));
+  const ldmRoot = join(home, '.ldm');
+  const fakeBin = join(home, 'fakebin');
+  mkdirSync(join(ldmRoot, 'extensions'), { recursive: true });
+  mkdirSync(join(home, '.claude'), { recursive: true });
+  mkdirSync(fakeBin, { recursive: true });
+  writeFileSync(join(ldmRoot, 'version.json'), JSON.stringify({ version: pkg.version }, null, 2) + '\n');
+  writeFileSync(join(ldmRoot, 'extensions', 'registry.json'), JSON.stringify({ _format: 'v2', extensions: {} }, null, 2) + '\n');
+  writeFileSync(join(home, '.claude', 'settings.json'), JSON.stringify({ hooks: {} }, null, 2) + '\n');
+  writeFileSync(join(fakeBin, 'crontab'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'crontab'), 0o755);
+  writeFileSync(join(fakeBin, 'npm'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'npm'), 0o755);
+  const out = runDoctor({ home, fakeBin });
+  assert(!/boot hook stale at execution path/.test(out), 'no stale report when no boot hook is registered', out);
+  rmSync(home, { recursive: true, force: true });
+}
+
+if (failed > 0) {
+  console.log(`\n${failed} assertion(s) failed`);
+  process.exit(1);
+}
+console.log('\nAll boot-dir-truth tests passed');

package/scripts/test-boot-hook-registration.mjs

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+// Regression test: configureSessionStartHook() registration semantics.
+//
+// Covers the 2026-07-04 tickets:
+//   ai/product/bugs/installer/open-tickets/2026-07-04--cc-mini--boot-hook-update-in-place-never-persists.md
+//   ai/product/bugs/installer/open-tickets/2026-07-04--cc-mini--installer-sessionstart-hook-duplicate-registration.md
+//
+// Cases:
+//   1. Fresh install: entry added and persisted.
+//   2. Repeat run: no duplicate, file byte-identical (no write).
+//   3. Changed entry (old command path, old timeout): updated ON DISK.
+//      This is the update-in-place-never-persists bug.
+//   4. Duplicate-laden settings (10 boot-hook copies + 1 unrelated hook):
+//      collapses to 1 boot entry, unrelated hook preserved, persisted.
+
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+// Note: the temp prefix must not contain "boot-hook" or "shared/boot".
+// Those substrings are the installer's ownership matchers, and the temp
+// HOME path ends up inside every fixture hook command.
+const tempHome = mkdtempSync(join(tmpdir(), 'ldm-bootreg-'));
+
+let failed = 0;
+function assert(cond, label, detail = '') {
+  if (cond) {
+    console.log(`  [PASS] ${label}`);
+  } else {
+    console.log(`  [FAIL] ${label}`);
+    if (detail) console.log(`         ${detail}`);
+    failed++;
+  }
+}
+
+const settingsPath = join(tempHome, '.claude', 'settings.json');
+function seedSettings(obj) {
+  mkdirSync(join(tempHome, '.claude'), { recursive: true });
+  writeFileSync(settingsPath, JSON.stringify(obj, null, 2) + '\n');
+}
+function readSettings() {
+  return JSON.parse(readFileSync(settingsPath, 'utf-8'));
+}
+function bootEntries(settings) {
+  return (settings.hooks?.SessionStart || []).filter((entry) =>
+    (entry?.hooks || []).some((h) => h?.command?.includes('boot-hook'))
+  );
+}
+
+try {
+  // HOME must be set before the module import: installer.mjs resolves
+  // homedir() into module-level constants at import time.
+  process.env.HOME = tempHome;
+  const { configureSessionStartHook } = await import('../src/boot/installer.mjs');
+  const expectedCommand = `node ${join(tempHome, '.ldm', 'shared', 'boot', 'boot-hook.mjs')}`;
+
+  console.log('Test 1: fresh install adds and persists the entry');
+  {
+    seedSettings({ hooks: {} });
+    const msg = configureSessionStartHook();
+    const s = readSettings();
+    assert(/added/.test(msg), `reports added (got: ${msg})`);
+    assert(bootEntries(s).length === 1, 'exactly one boot-hook entry on disk');
+    assert(s.hooks.SessionStart[0].hooks[0].command === expectedCommand, 'command path is BOOT_DIR boot-hook.mjs');
+  }
+
+  console.log('Test 2: repeat run is a no-op, byte-identical file');
+  {
+    const before = readFileSync(settingsPath, 'utf-8');
+    const msg = configureSessionStartHook();
+    const after = readFileSync(settingsPath, 'utf-8');
+    assert(/already configured/.test(msg), `reports already configured (got: ${msg})`);
+    assert(before === after, 'settings.json byte-identical after second run');
+  }
+
+  console.log('Test 3: changed entry is updated ON DISK (the persist bug)');
+  {
+    seedSettings({
+      hooks: {
+        SessionStart: [
+          {
+            matcher: '*',
+            hooks: [{ type: 'command', command: 'node /old/path/shared/boot/boot-hook.mjs', timeout: 10 }],
+          },
+        ],
+      },
+    });
+    const msg = configureSessionStartHook();
+    const s = readSettings();
+    assert(/updated/.test(msg), `reports updated (got: ${msg})`);
+    assert(bootEntries(s).length === 1, 'still exactly one boot-hook entry');
+    assert(
+      s.hooks.SessionStart[0].hooks[0].command === expectedCommand,
+      'new command path persisted to disk',
+      `on disk: ${s.hooks.SessionStart[0].hooks[0].command}`
+    );
+    assert(s.hooks.SessionStart[0].hooks[0].timeout === 15, 'new timeout persisted to disk');
+  }
+
+  console.log('Test 4: duplicate-laden settings collapse to one, unrelated hooks preserved');
+  {
+    const bootEntry = {
+      matcher: '*',
+      hooks: [{ type: 'command', command: expectedCommand, timeout: 15 }],
+    };
+    const guardEntry = {
+      hooks: [{ type: 'command', command: `node ${join(tempHome, '.ldm', 'extensions', 'wip-branch-guard', 'guard.mjs')}`, timeout: 10 }],
+    };
+    seedSettings({
+      hooks: {
+        SessionStart: [
+          ...Array.from({ length: 5 }, () => structuredClone(bootEntry)),
+          guardEntry,
+          ...Array.from({ length: 5 }, () => structuredClone(bootEntry)),
+        ],
+      },
+    });
+    const msg = configureSessionStartHook();
+    const s = readSettings();
+    assert(/removed 9 duplicate entries/.test(msg), `reports 9 duplicates removed (got: ${msg})`);
+    assert(bootEntries(s).length === 1, 'exactly one boot-hook entry after collapse');
+    assert(s.hooks.SessionStart.length === 2, 'boot hook + branch guard remain');
+    assert(
+      s.hooks.SessionStart.some((e) => e.hooks?.[0]?.command?.includes('wip-branch-guard')),
+      'unrelated branch-guard entry preserved'
+    );
+  }
+} finally {
+  rmSync(tempHome, { recursive: true, force: true });
+}
+
+if (failed > 0) {
+  console.log(`\n${failed} assertion(s) failed`);
+  process.exit(1);
+}
+console.log('\nAll boot-hook registration tests passed');