@wipcomputer/wip-ldm-os 0.4.85-alpha.30 → 0.4.85-alpha.33

package/scripts/test-boot-payload-trim.mjs

@@ -0,0 +1,200 @@
+#!/usr/bin/env node
+// Regression test: boot-hook payload trimming (CC speedup master plan, Task 4b).
+//
+// Covers:
+//   1. A step with no maxLines in config gets the code default cap + a
+//      truncation marker that names the full path.
+//   2. A per-step maxLines in config overrides the default.
+//   3. A most-recent step whose newest file is older than stalenessDays is
+//      NOT injected: a path-only stale line is emitted instead.
+//   4. A fresh most-recent file IS injected in full.
+//   5. The payload ends with a one-line summary (bytes/lines/sections, capped,
+//      stale).
+//   6. maxTotalLines still stops the loop early.
+//
+// The hook resolves homedir() into a module-level constant at import time and
+// loads boot-config.json relative to its own file. So each case copies the
+// hook into a temp workdir next to a generated boot-config.json and runs it as
+// a subprocess with HOME pointed at a temp fixture. The hook's dynamic imports
+// of ../../lib/*.mjs fail harmlessly (they are wrapped in try/catch) from the
+// temp location, which is fine: this test only exercises payload assembly.
+
+import { mkdirSync, mkdtempSync, copyFileSync, writeFileSync, rmSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { tmpdir } from 'node:os';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const repo = dirname(dirname(fileURLToPath(import.meta.url)));
+const HOOK_SRC = join(repo, 'src', 'boot', 'boot-hook.mjs');
+
+let failed = 0;
+function assert(cond, label, detail = '') {
+  if (cond) {
+    console.log(`  [PASS] ${label}`);
+  } else {
+    console.log(`  [FAIL] ${label}`);
+    if (detail) console.log(`         ${detail}`);
+    failed++;
+  }
+}
+
+// Compute today/yesterday in the hook's timezone so daily-log and fresh-journal
+// filenames match what the hook looks for.
+function ymd(offsetDays = 0) {
+  const now = new Date();
+  now.setDate(now.getDate() + offsetDays);
+  return new Intl.DateTimeFormat('en-CA', {
+    timeZone: 'America/Los_Angeles',
+    year: 'numeric',
+    month: '2-digit',
+    day: '2-digit',
+  }).format(now);
+}
+
+function lines(n, marker) {
+  const out = [];
+  for (let i = 1; i <= n; i++) out.push(`${marker} line ${i}`);
+  return out.join('\n') + '\n';
+}
+
+// Run the hook with a given config object and a HOME-populating callback.
+// Returns the injected additionalContext string.
+function runHook(configObj, populateHome) {
+  const work = mkdtempSync(join(tmpdir(), 'ldm-bootpay-work-'));
+  const home = mkdtempSync(join(tmpdir(), 'ldm-bootpay-home-'));
+  try {
+    copyFileSync(HOOK_SRC, join(work, 'boot-hook.mjs'));
+    writeFileSync(join(work, 'boot-config.json'), JSON.stringify(configObj, null, 2));
+    populateHome(home);
+
+    const stdout = execFileSync('node', [join(work, 'boot-hook.mjs')], {
+      input: JSON.stringify({ session_id: 'test', hook_event_name: 'SessionStart', cwd: home }),
+      env: { ...process.env, HOME: home },
+      encoding: 'utf-8',
+      timeout: 30000,
+    });
+    const parsed = JSON.parse(stdout);
+    return parsed?.hookSpecificOutput?.additionalContext || '';
+  } finally {
+    rmSync(work, { recursive: true, force: true });
+    rmSync(home, { recursive: true, force: true });
+  }
+}
+
+function writeHomeFile(home, rel, content) {
+  const full = join(home, rel);
+  mkdirSync(dirname(full), { recursive: true });
+  writeFileSync(full, content);
+  return full;
+}
+
+// ── Case 1 + 2 + 5: default cap, config override, payload summary ──
+console.log('Case 1/2/5: default cap, config override, payload summary');
+{
+  const config = {
+    agentId: 'test-agent',
+    timezone: 'America/Los_Angeles',
+    maxTotalLines: 2000,
+    steps: {
+      // no maxLines -> code default for sharedContext is 80
+      sharedContext: { path: '~/shared.md', label: 'SHARED', stepNumber: 2, critical: true },
+      // no maxLines -> code default for soul is 80
+      soul: { path: '~/soul.md', label: 'SOUL', stepNumber: 7 },
+      // explicit maxLines overrides
+      overridden: { path: '~/capped.md', label: 'CAPPED', stepNumber: 11, maxLines: 5 },
+    },
+  };
+  let soulPath, cappedPath;
+  const ctx = runHook(config, (home) => {
+    writeHomeFile(home, 'shared.md', lines(20, 'SHARED_BODY')); // under cap, not truncated
+    soulPath = writeHomeFile(home, 'soul.md', lines(200, 'SOUL_BODY')); // over default 80
+    cappedPath = writeHomeFile(home, 'capped.md', lines(100, 'CAP_BODY')); // over explicit 5
+  });
+
+  assert(/truncated at 80 of \d+ lines/.test(ctx), 'soul truncated at default cap 80', ctx.match(/truncated at[^\n]*soul[^\n]*/)?.[0] || ctx.slice(0, 300));
+  assert(ctx.includes(`Read the rest: ${soulPath}`), 'soul truncation marker names full path');
+  assert(/truncated at 5 of \d+ lines/.test(ctx), 'config maxLines=5 override respected');
+  assert(ctx.includes(`Read the rest: ${cappedPath}`), 'capped truncation marker names full path');
+  assert(/SHARED_BODY line 20\b/.test(ctx), 'under-cap file not truncated (body fully present)');
+  const summaryLine = ctx.match(/== Boot payload:[^\n]*/)?.[0] || '';
+  assert(/== Boot payload: \d+ bytes, \d+ lines, \d+ sections\./.test(summaryLine), 'payload summary line present', summaryLine);
+  const cappedPart = summaryLine.match(/Capped:([^.]*)\./)?.[1] || '';
+  assert(/Step 7\b/.test(cappedPart) && /Step 11\b/.test(cappedPart), 'summary lists capped steps 7 and 11', summaryLine);
+  assert(/Stale\/path-only: none\./.test(summaryLine), 'summary reports no stale steps', summaryLine);
+}
+
+// ── Case 3: stale most-recent journal emits path-only line ──
+console.log('Case 3: stale journal is path-only, body not injected');
+{
+  const config = {
+    agentId: 'test-agent',
+    timezone: 'America/Los_Angeles',
+    maxTotalLines: 2000,
+    stalenessDays: 14,
+    steps: {
+      ccJournals: { dir: '~/journals', label: 'JOURNAL', stepNumber: 8, maxLines: 80, strategy: 'most-recent' },
+    },
+  };
+  const staleDate = ymd(-100);
+  let journalPath;
+  const ctx = runHook(config, (home) => {
+    journalPath = writeHomeFile(home, `journals/${staleDate}-journal.md`, lines(50, 'STALE_JOURNAL_BODY'));
+  });
+
+  assert(!/STALE_JOURNAL_BODY/.test(ctx), 'stale journal body is NOT injected');
+  assert(new RegExp(`stale: newest file is ${staleDate}`).test(ctx), 'stale line names the file date');
+  assert(/cutoff 14d/.test(ctx), 'stale line names the cutoff');
+  assert(ctx.includes(`Read if needed: ${journalPath}`), 'stale line names the full path');
+  assert(/Stale\/path-only: Step 8\b/.test(ctx), 'summary lists stale step 8');
+}
+
+// ── Case 4: fresh most-recent journal is injected in full ──
+console.log('Case 4: fresh journal body IS injected');
+{
+  const config = {
+    agentId: 'test-agent',
+    timezone: 'America/Los_Angeles',
+    maxTotalLines: 2000,
+    stalenessDays: 14,
+    steps: {
+      ccJournals: { dir: '~/journals', label: 'JOURNAL', stepNumber: 8, maxLines: 80, strategy: 'most-recent' },
+    },
+  };
+  const freshDate = ymd(0);
+  const ctx = runHook(config, (home) => {
+    writeHomeFile(home, `journals/${freshDate}-journal.md`, lines(10, 'FRESH_JOURNAL_BODY'));
+  });
+
+  assert(/FRESH_JOURNAL_BODY line 1\b/.test(ctx), 'fresh journal body injected');
+  assert(!/stale:/.test(ctx), 'no stale marker for fresh journal');
+  assert(/Stale\/path-only: none\./.test(ctx), 'summary reports no stale steps');
+}
+
+// ── Case 6: maxTotalLines stops the loop early ──
+console.log('Case 6: maxTotalLines respected');
+{
+  const config = {
+    agentId: 'test-agent',
+    timezone: 'America/Los_Angeles',
+    maxTotalLines: 5, // tiny: first big step blows past it
+    steps: {
+      sharedContext: { path: '~/shared.md', label: 'SHARED', stepNumber: 2, critical: true },
+      context: { path: '~/context.md', label: 'CONTEXT', stepNumber: 6, critical: true },
+    },
+  };
+  const ctx = runHook(config, (home) => {
+    writeHomeFile(home, 'shared.md', lines(40, 'FIRST_BODY'));
+    writeHomeFile(home, 'context.md', lines(40, 'SECOND_BODY'));
+  });
+
+  assert(/FIRST_BODY line 1\b/.test(ctx), 'first step loaded');
+  assert(!/SECOND_BODY/.test(ctx), 'second step skipped after maxTotalLines cap');
+}
+
+console.log('');
+if (failed > 0) {
+  console.log(`${failed} test(s) failed.`);
+  process.exit(1);
+}
+console.log('All boot payload trim tests passed.');

package/scripts/test-crc-pair-login-flow.mjs

@@ -12,6 +12,12 @@ function assertContains(source, needle, label) {
   }
 }
 
+function assertNotContains(source, needle, label) {
+  if (source.includes(needle)) {
+    throw new Error(`${label} must not contain: ${needle}`);
+  }
+}
+
 function assertBefore(source, first, second, label) {
   const firstIndex = source.indexOf(first);
   const secondIndex = source.indexOf(second);
@@ -20,15 +26,74 @@ function assertBefore(source, first, second, label) {
   }
 }
 
+function extractServerNextSanitizer(source) {
+  const consts = [
+    source.match(/const PAIR_NEXT_REGEX = .+;/)?.[0],
+    source.match(/const REMOTE_CONTROL_NEXT_REGEX = .+;/)?.[0],
+    source.match(/const DEMO_NEXT_REGEX = .+;/)?.[0],
+  ];
+  if (consts.some((line) => !line)) {
+    throw new Error("server sanitizer test could not extract next regex constants");
+  }
+  const start = source.indexOf("function sanitizeCrcPairNext(raw)");
+  const end = source.indexOf("// POST /api/qr-login", start);
+  if (start === -1 || end === -1) {
+    throw new Error("server sanitizer test could not extract sanitizeCrcPairNext");
+  }
+  return Function(`${consts.join("\n")}\n${source.slice(start, end)}\nreturn sanitizeCrcPairNext;`)();
+}
+
+function assertSanitizedNext(sanitize, value, expected) {
+  const actual = sanitize(value);
+  if (actual !== expected) {
+    throw new Error(`sanitizeCrcPairNext(${JSON.stringify(value)}) expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
+  }
+}
+
 assertContains(server, "const PAIR_NEXT_REGEX = /^\\/pair\\/[ABCDEFGHJKLMNPQRSTUVWXYZ23456789]{6}$/;", "server pair regex");
 assertContains(server, "const REMOTE_CONTROL_NEXT_REGEX = /^\\/codex-remote-control\\/", "server remote-control regex");
+assertContains(server, "const DEMO_NEXT_REGEX = /^\\/demo$/;", "server demo regex");
 assertContains(server, "purpose,           // \"pair\" | null", "server stores pair purpose");
-assertContains(server, "next: next || null, // sanitized `/pair/<CODE>` or null", "server stores sanitized next");
+assertContains(server, "next: next || null, // sanitized `/pair/<CODE>`, `/codex-remote-control/<UUID>`, `/demo`, or null", "server stores sanitized next");
+assertContains(server, "DEMO_NEXT_REGEX.test(decoded)", "server allows demo next");
 assertContains(server, "json(res, 200, { status: \"approved\", agentId: entry.agentId });", "server strips desktop pair status");
 assertContains(server, "json(res, 200, { ok: true, next: entry.next });", "server returns next to phone approve");
+assertContains(server, "tenantId: entry.tenantId || null,", "server returns QR login tenant");
+assertContains(server, "const verifiedIdentity = identityForApiKey(apiKey);", "server canonicalizes QR approval identity");
+
+const sanitizeCrcPairNext = extractServerNextSanitizer(server);
+assertSanitizedNext(sanitizeCrcPairNext, "/demo", "/demo");
+assertSanitizedNext(sanitizeCrcPairNext, "/demo/", null);
+assertSanitizedNext(sanitizeCrcPairNext, "/demo/../admin", null);
+assertSanitizedNext(sanitizeCrcPairNext, "//evil.com", null);
+assertSanitizedNext(sanitizeCrcPairNext, "https://evil", null);
+assertSanitizedNext(sanitizeCrcPairNext, "/demoX", null);
 
 for (const file of loginFiles) {
   const html = readFileSync(file, "utf8");
+  assertContains(html, "var DEMO_NEXT_REGEX = /^\\/demo$/;", `${file} demo regex`);
+  assertContains(html, "function defaultLocalPasskeysOn()", `${file} has local passkey default helper`);
+  assertContains(html, "return isMobileDevice();", `${file} defaults local passkeys on for mobile`);
+  assertContains(html, "function getLocalPasskeysPreference()", `${file} has local passkey preference helper`);
+  assertContains(html, "if (stored === 'on' || stored === 'off') return stored;", `${file} respects stored local passkey preference`);
+  assertContains(html, "function needsCustomQR() {\n  return !isLocalPasskeysOn();\n}", `${file} uses QR whenever local passkeys are off`);
+  assertNotContains(html, "return !isMobileDevice() && !isSafariDesktop() && !isLocalPasskeysOn();", `${file} must not gate QR by browser or mobile status`);
+  assertContains(html, "DEMO_NEXT_REGEX.test(raw)", `${file} allowlists demo next`);
+  assertContains(html, "function storeDemoHandoffIfNeeded(next, identity, isNewAccount)", `${file} demo handoff helper`);
+  assertContains(html, "sessionStorage.setItem('lesa-token', identity.apiKey);", `${file} stores demo token`);
+  assertContains(html, "sessionStorage.setItem('lesa-agent', identity.agentId);", `${file} stores demo agent`);
+  assertContains(html, "if (identity.tenantId) sessionStorage.setItem('lesa-tenant', identity.tenantId);", `${file} stores demo tenant`);
+  assertContains(html, "if (isNewAccount) sessionStorage.setItem('lesa-new-account', 'true');", `${file} stores demo new-account flag conditionally`);
+  assertContains(html, "tenantId: result.tenantId,", `${file} sends tenant to QR approval`);
+  assertContains(html, "storeDemoHandoffIfNeeded(data.next, data, qrLoginMode === 'register');", `${file} QR status stores demo handoff`);
+  assertContains(html, "storeDemoHandoffIfNeeded('/demo', data, qrLoginMode === 'register');", `${file} plain QR success keeps demo handoff`);
+  assertContains(html, "storeDemoHandoffIfNeeded('/demo', result, true);", `${file} plain create success keeps demo handoff`);
+  assertContains(html, "storeDemoHandoffIfNeeded('/demo', result, false);", `${file} plain sign-in success keeps demo handoff`);
+  if (html.includes('onclick="sessionStorage.clear();"')) {
+    throw new Error(`${file} Try the Demo button must not clear sessionStorage`);
+  }
+  assertContains(html, "followPairNextIfPresent(approveResponse, result, true)", `${file} create account marks new account`);
+  assertContains(html, "followPairNextIfPresent(approveResponse, result, false)", `${file} sign-in does not mark new account`);
   assertContains(html, "function isPairNextOnDesktop()", `${file} desktop pair helper`);
   assertContains(html, "} else if (isPairNextOnDesktop()) {", `${file} auto-start desktop pair QR`);
   assertContains(html, "startQrLogin('', 'signin');", `${file} pair QR uses sign-in mode`);
@@ -37,4 +102,14 @@ for (const file of loginFiles) {
   assertBefore(html, "if (isPairNextOnDesktop() && !qrSessionMode)", "if (needsCustomQR() && !qrSessionMode)", `${file} create button forces pair QR before normal QR fallback`);
 }
 
+const appLogin = readFileSync("src/hosted-mcp/app/kaleidoscope-login.html", "utf8");
+assertContains(appLogin, "Local passkeys are on by default on mobile devices.", "app login mobile tooltip copy");
+assertContains(appLogin, "This device's passkeys are used for login and device sync.", "app login mobile tooltip current-device copy");
+assertContains(appLogin, "Turn this off to use or save passkeys on a different device.", "app login mobile tooltip off copy");
+assertContains(appLogin, "Local passkeys are off by default on desktop.", "app login desktop tooltip copy");
+assertContains(appLogin, "Your mobile device's passkeys are used for login and device sync.", "app login desktop tooltip mobile-device copy");
+assertContains(appLogin, "Turn this on to use or save passkeys on this computer.", "app login desktop tooltip on copy");
+assertNotContains(appLogin, "phone's passkeys", "app login tooltip must not say phone passkeys");
+assertNotContains(appLogin, "mobile devices' passkeys", "app login tooltip must not use plural possessive");
+
 console.log("crc pair login flow checks passed");

package/scripts/test-deploy-hook-ownership.mjs

@@ -0,0 +1,160 @@
+#!/usr/bin/env node
+// Regression test: manifest-driven boot-hook registration is single-owner.
+//
+// Covers:
+//   ai/product/bugs/installer/open-tickets/2026-07-05--cc-mini--deploy-hook-ownership-misses-boot-hook.md
+//
+// Before this fix, lib/deploy.mjs installClaudeCodeHookEvent() matched owned
+// hook entries by an extension-dir tag (`/<toolName>/`). The boot hook's
+// deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains
+// no `/wip-ldm-os/` segment, so the ownership match found nothing and appended
+// a fresh SessionStart entry on every manifest-driven `ldm install` (the real
+// mechanism behind the 10-entry accumulation on 2026-07-04).
+//
+// The fix routes boot-hook doors to configureSessionStartHook() (the single
+// canonical registrar), so the deploy path no longer appends.
+//
+// Cases:
+//   1. Fresh manifest install: exactly one boot entry, canonical command.
+//   2. Repeat manifest install: byte-identical settings.json (true no-op).
+//   3. Pre-accumulated + unrelated SessionStart hook: collapses boot entries
+//      to one, preserves the non-boot SessionStart entry (discriminates on the
+//      command, not the event).
+//   4. Dry run: reports intent, writes nothing.
+//
+// HOME must be set before importing deploy.mjs: both deploy.mjs (process.env.HOME)
+// and the transitively-imported src/boot/installer.mjs (os.homedir()) resolve
+// their HOME-based constants at module-load time.
+
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+// The temp prefix must not contain "boot-hook" or "shared/boot": those are the
+// ownership matchers, and the temp HOME ends up inside every fixture command.
+const tempHome = mkdtempSync(join(tmpdir(), 'ldm-deployown-'));
+process.env.HOME = tempHome;
+
+const { installClaudeCodeHook, setFlags } = await import('../lib/deploy.mjs');
+
+// Mirror detect.mjs: the wip-ldm-os package.json declares a single SessionStart
+// boot-hook door. deploy.mjs receives it as a one-element array.
+const bootDoor = {
+  event: 'SessionStart',
+  matcher: '*',
+  command: `node ${join(tempHome, '.ldm', 'shared', 'boot', 'boot-hook.mjs')}`,
+  timeout: 15,
+};
+const expectedCommand = `node ${join(tempHome, '.ldm', 'shared', 'boot', 'boot-hook.mjs')}`;
+
+let failed = 0;
+function assert(cond, label, detail = '') {
+  if (cond) {
+    console.log(`  [PASS] ${label}`);
+  } else {
+    console.log(`  [FAIL] ${label}`);
+    if (detail) console.log(`         ${detail}`);
+    failed++;
+  }
+}
+
+const settingsPath = join(tempHome, '.claude', 'settings.json');
+function seedSettings(obj) {
+  mkdirSync(join(tempHome, '.claude'), { recursive: true });
+  writeFileSync(settingsPath, JSON.stringify(obj, null, 2) + '\n');
+}
+function readSettings() {
+  return JSON.parse(readFileSync(settingsPath, 'utf-8'));
+}
+function bootEntries(settings) {
+  return (settings.hooks?.SessionStart || []).filter((entry) =>
+    (entry?.hooks || []).some((h) => h?.command?.includes('boot-hook'))
+  );
+}
+// Install through the manifest wrapper exactly as detect.mjs feeds it: an array.
+function manifestInstall() {
+  return installClaudeCodeHook(join(tempHome, 'repo'), [bootDoor], 'wip-ldm-os');
+}
+
+try {
+  console.log('Test 1: fresh manifest install adds exactly one boot entry');
+  {
+    seedSettings({ hooks: {} });
+    manifestInstall();
+    const s = readSettings();
+    assert(bootEntries(s).length === 1, 'exactly one boot-hook SessionStart entry');
+    assert(
+      s.hooks.SessionStart[0].hooks[0].command === expectedCommand,
+      'command canonicalized to BOOT_DIR boot-hook.mjs',
+      `on disk: ${s.hooks.SessionStart[0].hooks[0].command}`
+    );
+  }
+
+  console.log('Test 2: repeat manifest install is a byte-identical no-op');
+  {
+    const before = readFileSync(settingsPath, 'utf-8');
+    manifestInstall();
+    const after = readFileSync(settingsPath, 'utf-8');
+    assert(before === after, 'settings.json byte-identical after second manifest install');
+    assert(bootEntries(readSettings()).length === 1, 'still exactly one boot-hook entry (no append)');
+  }
+
+  console.log('Test 3: pre-accumulated boot entries collapse; unrelated SessionStart hook preserved');
+  {
+    // Three legacy boot appends (the pre-fix accumulation) using the old
+    // hardcoded absolute path, plus an unrelated SessionStart guard entry.
+    const legacyBoot = {
+      matcher: '*',
+      hooks: [{ type: 'command', command: 'node /Users/someone/.ldm/shared/boot/boot-hook.mjs', timeout: 15 }],
+    };
+    const guardSessionStart = {
+      matcher: 'Read|Glob',
+      hooks: [{ type: 'command', command: `node ${join(tempHome, '.ldm', 'extensions', 'wip-branch-guard', 'guard.mjs')}`, timeout: 10 }],
+    };
+    seedSettings({
+      hooks: {
+        SessionStart: [
+          structuredClone(legacyBoot),
+          structuredClone(legacyBoot),
+          guardSessionStart,
+          structuredClone(legacyBoot),
+        ],
+      },
+    });
+    manifestInstall();
+    const s = readSettings();
+    assert(bootEntries(s).length === 1, 'boot entries collapsed to one');
+    assert(
+      s.hooks.SessionStart[0].hooks[0].command === expectedCommand,
+      'surviving boot entry canonicalized to BOOT_DIR'
+    );
+    assert(
+      s.hooks.SessionStart.some((e) => e.hooks?.[0]?.command?.includes('wip-branch-guard')),
+      'unrelated SessionStart guard entry preserved (discriminates on command, not event)'
+    );
+    assert(s.hooks.SessionStart.length === 2, 'exactly boot + guard remain');
+  }
+
+  console.log('Test 4: dry run reports intent and writes nothing');
+  {
+    seedSettings({ hooks: {} });
+    const before = readFileSync(settingsPath, 'utf-8');
+    setFlags({ dryRun: true });
+    try {
+      manifestInstall();
+    } finally {
+      setFlags({ dryRun: false });
+    }
+    const after = readFileSync(settingsPath, 'utf-8');
+    assert(before === after, 'settings.json untouched under dry run');
+    assert(bootEntries(readSettings()).length === 0, 'no boot entry written under dry run');
+  }
+} finally {
+  rmSync(tempHome, { recursive: true, force: true });
+}
+
+if (failed > 0) {
+  console.log(`\n${failed} assertion(s) failed`);
+  process.exit(1);
+}
+console.log('\nAll deploy-hook ownership tests passed');

package/scripts/test-doctor-hook-dedupe.mjs

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+// Regression test: `ldm doctor` duplicate-hook + invalid-model checks.
+//
+// Covers the 2026-07-04 tickets:
+//   ai/product/bugs/installer/open-tickets/2026-07-04--cc-mini--installer-sessionstart-hook-duplicate-registration.md
+//   ai/product/bugs/guard/2026-07-04--cc-mini--no-blessed-recipe-for-live-settings-remediation.md
+//
+// Cases:
+//   1. Duplicate-laden settings: doctor reports, does NOT write without --fix.
+//   2. --fix collapses duplicates to 1, writes a timestamped backup first,
+//      preserves unrelated hooks and unknown keys.
+//   3. Invalid model value ("opus" + real ESC 0x1B + "[1m"): reported, removed under --fix.
+//   4. Malformed settings.json: warns and skips, file untouched, no crash.
+//
+// Follows the test-doctor-cron-target.mjs pattern: real bin/ldm.js doctor
+// against a temp HOME, crontab/npm shimmed on PATH so the operator's real
+// state is never read.
+
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+
+const repo = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const cli = join(repo, 'bin', 'ldm.js');
+const pkg = JSON.parse(readFileSync(join(repo, 'package.json'), 'utf8'));
+
+let failed = 0;
+function assert(cond, label, output = '') {
+  if (cond) {
+    console.log(`  [PASS] ${label}`);
+  } else {
+    console.log(`  [FAIL] ${label}`);
+    if (output) console.log(`         --- output (last lines) ---\n         ${output.trim().split('\n').slice(-25).join('\n         ')}`);
+    failed++;
+  }
+}
+
+function setupHome(settingsFactory) {
+  const home = mkdtempSync(join(tmpdir(), 'ldm-doctor-dedupe-'));
+  const ldmRoot = join(home, '.ldm');
+  const fakeBin = join(home, 'fakebin');
+  mkdirSync(join(ldmRoot, 'extensions'), { recursive: true });
+  mkdirSync(join(home, '.claude'), { recursive: true });
+  mkdirSync(fakeBin, { recursive: true });
+
+  writeFileSync(join(ldmRoot, 'version.json'), JSON.stringify({ version: pkg.version }, null, 2) + '\n');
+  writeFileSync(join(ldmRoot, 'extensions', 'registry.json'), JSON.stringify({ _format: 'v2', extensions: {} }, null, 2) + '\n');
+
+  // Hook scripts must exist on disk: doctor --fix runs the stale-path
+  // cleanup (#30) before the dedupe pass, and missing targets would be
+  // removed as stale instead of collapsed as duplicates.
+  const bootScript = join(ldmRoot, 'shared', 'boot', 'boot-hook.mjs');
+  const guardScript = join(ldmRoot, 'extensions', 'wip-branch-guard', 'guard.mjs');
+  const stopScript = join(ldmRoot, 'extensions', 'stop-hook.mjs');
+  for (const f of [bootScript, guardScript, stopScript]) {
+    mkdirSync(dirname(f), { recursive: true });
+    writeFileSync(f, 'process.exit(0);\n');
+  }
+
+  const paths = { bootScript, guardScript, stopScript };
+  const settingsContent = settingsFactory(paths);
+  const settingsPath = join(home, '.claude', 'settings.json');
+  writeFileSync(settingsPath, typeof settingsContent === 'string'
+    ? settingsContent
+    : JSON.stringify(settingsContent, null, 2) + '\n');
+
+  // Empty crontab + no-op npm on PATH (never touch operator state/network).
+  writeFileSync(join(fakeBin, 'crontab'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'crontab'), 0o755);
+  writeFileSync(join(fakeBin, 'npm'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'npm'), 0o755);
+
+  return { home, fakeBin, settingsPath, paths };
+}
+
+function runDoctor({ home, fakeBin }, fix = false) {
+  const args = ['doctor'];
+  if (fix) args.push('--fix');
+  try {
+    return execFileSync('node', [cli, ...args], {
+      env: { ...process.env, HOME: home, PATH: `${fakeBin}:${process.env.PATH}`, LDM_SELF_UPDATED: '1' },
+      encoding: 'utf-8',
+      timeout: 30000,
+    });
+  } catch (err) {
+    return (err.stdout || '') + (err.stderr || '');
+  }
+}
+
+const bootCmd = (paths) => `node ${paths.bootScript}`;
+const bootEntry = (paths) => ({ matcher: '*', hooks: [{ type: 'command', command: bootCmd(paths), timeout: 15 }] });
+const guardEntry = (paths) => ({ hooks: [{ type: 'command', command: `node ${paths.guardScript}`, timeout: 10 }] });
+
+function dupeLadenSettings(paths) {
+  return {
+    unknownTopLevelKey: { keep: 'me' },
+    permissions: { defaultMode: 'default' },
+    hooks: {
+      SessionStart: [
+        ...Array.from({ length: 5 }, () => bootEntry(paths)),
+        guardEntry(paths),
+        ...Array.from({ length: 5 }, () => bootEntry(paths)),
+      ],
+      Stop: [{ hooks: [{ type: 'command', command: `node ${paths.stopScript}` }] }],
+    },
+  };
+}
+
+console.log('Test 1: duplicates reported, no write without --fix');
+{
+  const w = setupHome(dupeLadenSettings);
+  const before = readFileSync(w.settingsPath, 'utf-8');
+  const out = runDoctor(w);
+  const after = readFileSync(w.settingsPath, 'utf-8');
+  assert(/SessionStart: 10 identical hook entries/.test(out), 'reports 10 identical SessionStart entries', out);
+  assert(/ldm doctor --fix to collapse 9 duplicate hook entries/.test(out), 'suggests --fix with count', out);
+  assert(before === after, 'settings.json untouched without --fix');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 2: --fix collapses, backs up first, preserves everything else');
+{
+  const w = setupHome(dupeLadenSettings);
+  const out = runDoctor(w, true);
+  const s = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  const bootCount = s.hooks.SessionStart.filter((e) => e.hooks?.[0]?.command === bootCmd(w.paths)).length;
+  const backups = readdirSync(join(w.home, '.claude')).filter((f) => f.startsWith('settings.json.bak-'));
+  assert(/Collapsed 9 duplicate hook entries/.test(out), 'reports 9 collapsed', out);
+  assert(bootCount === 1, `boot-hook entries collapsed to 1 (got ${bootCount})`);
+  assert(s.hooks.SessionStart.length === 2, 'boot hook + branch guard remain');
+  assert(s.hooks.Stop.length === 1, 'unrelated Stop hook preserved');
+  assert(s.unknownTopLevelKey?.keep === 'me', 'unknown top-level key preserved');
+  assert(backups.length === 1, `timestamped backup written (found ${backups.length})`);
+  if (backups.length === 1) {
+    const bak = JSON.parse(readFileSync(join(w.home, '.claude', backups[0]), 'utf-8'));
+    assert(bak.hooks.SessionStart.length === 11, 'backup holds the pre-fix state');
+  }
+  const again = runDoctor(w, true);
+  assert(!/Collapsed/.test(again), 'second --fix run finds nothing to collapse', again);
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 3: invalid model value reported and removed under --fix');
+{
+  // The corruption fixture carries a REAL ESC control char (0x1B): "opus"
+  // plus an ANSI bold fragment, which is what a terminal paste persists.
+  // Printable brackets alone are NOT corruption (see Test 4).
+  const w = setupHome((paths) => ({ model: 'opus\x1b[1m', hooks: { SessionStart: [bootEntry(paths)] } }));
+  const out = runDoctor(w);
+  assert(/model value is invalid/.test(out), 'reports invalid model', out);
+  const before = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  assert(typeof before.model === 'string', 'model untouched without --fix');
+  const fixOut = runDoctor(w, true);
+  const s = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  assert(/Removed invalid model value/.test(fixOut), 'reports removal under --fix', fixOut);
+  assert(!('model' in s), 'model key removed from disk');
+  assert(s.hooks.SessionStart.length === 1, 'hooks untouched by model fix');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 4: valid model values are left alone (including bracketed 1M-context IDs)');
+{
+  const w = setupHome(() => ({ model: 'claude-fable-5[1m]', hooks: {} }));
+  const out = runDoctor(w, true);
+  const s = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  assert(!/model value is invalid/.test(out), 'no invalid-model report for bracketed 1M id', out);
+  assert(s.model === 'claude-fable-5[1m]', 'legitimate 1M-context model preserved');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 5: malformed settings.json warns, skips, file untouched');
+{
+  const w = setupHome(() => '{ this is not json\n');
+  const before = readFileSync(w.settingsPath, 'utf-8');
+  const out = runDoctor(w, true);
+  const after = readFileSync(w.settingsPath, 'utf-8');
+  assert(/not valid JSON; skipping hook\/model checks/.test(out), 'warns about malformed JSON', out);
+  assert(before === after, 'malformed file untouched');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+if (failed > 0) {
+  console.log(`\n${failed} assertion(s) failed`);
+  process.exit(1);
+}
+console.log('\nAll doctor hook-dedupe tests passed');