npm - @wipcomputer/wip-ldm-os - Versions diffs - 0.4.85-alpha.8 → 0.4.86 - Mend

@wipcomputer/wip-ldm-os 0.4.85-alpha.8 → 0.4.86

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (57) hide show

package/README.md +22 -2
package/SKILL.md +137 -15
package/bin/ldm.js +608 -75
package/lib/deploy.mjs +90 -12
package/lib/registry-migrations.mjs +296 -0
package/package.json +21 -3
package/scripts/test-boot-dir-truth.mjs +158 -0
package/scripts/test-boot-hook-registration.mjs +136 -0
package/scripts/test-boot-payload-trim.mjs +200 -0
package/scripts/test-crc-agentid-tenant-boundary.mjs +2 -2
package/scripts/test-crc-e2ee-key-persistence.mjs +150 -0
package/scripts/test-crc-e2ee-session-route.mjs +9 -2
package/scripts/test-crc-pair-login-flow.mjs +76 -1
package/scripts/test-crc-pair-relink-audit-and-rotation.mjs +164 -0
package/scripts/test-crc-websocket-abuse-limits.mjs +128 -0
package/scripts/test-deploy-hook-ownership.mjs +160 -0
package/scripts/test-doctor-hook-dedupe.mjs +188 -0
package/scripts/test-install-prompt-policy.mjs +84 -0
package/scripts/test-installer-skill-dry-run-destinations.mjs +100 -0
package/scripts/test-installer-target-self-update.mjs +131 -0
package/scripts/test-kaleidoscope-onboarding-copy.mjs +170 -0
package/scripts/test-kaleidoscope-public-stats-baseline.mjs +129 -0
package/scripts/test-kaleidoscope-qr-authenticator-confirmation.mjs +89 -0
package/scripts/test-ldm-status-concurrency.mjs +118 -0
package/scripts/test-ldm-status-timeout.mjs +96 -0
package/scripts/test-legacy-npm-sources-migration.mjs +460 -0
package/scripts/test-readme-install-prompt.mjs +66 -0
package/shared/boot/boot-config.json +18 -8
package/shared/docs/dev-guide-wipcomputerinc.md.tmpl +5 -4
package/shared/rules/security.md +4 -0
package/shared/templates/install-prompt.md +20 -2
package/src/boot/README.md +24 -1
package/src/boot/boot-config.json +18 -8
package/src/boot/boot-hook.mjs +118 -28
package/src/boot/installer.mjs +33 -10
package/src/hosted-mcp/.env.example +4 -0
package/src/hosted-mcp/README.md +37 -0
package/src/hosted-mcp/app/footer.js +2 -2
package/src/hosted-mcp/app/kaleidoscope-login.html +489 -42
package/src/hosted-mcp/app/pair.html +21 -3
package/src/hosted-mcp/app/wip-logo.png +0 -0
package/src/hosted-mcp/codex-relay-e2ee-registry.mjs +208 -0
package/src/hosted-mcp/codex-relay-ws-abuse-limits.mjs +140 -0
package/src/hosted-mcp/demo/footer.js +2 -2
package/src/hosted-mcp/demo/index.html +166 -44
package/src/hosted-mcp/demo/login.html +87 -23
package/src/hosted-mcp/demo/privacy.html +4 -214
package/src/hosted-mcp/demo/tos.html +4 -189
package/src/hosted-mcp/deploy.sh +2 -0
package/src/hosted-mcp/docs/self-host.md +268 -0
package/src/hosted-mcp/legal/internet-services/kaleidoscope/index.html +257 -0
package/src/hosted-mcp/legal/internet-services/terms/site.html +224 -168
package/src/hosted-mcp/legal/legal-footer.js +75 -0
package/src/hosted-mcp/legal/legal.css +166 -0
package/src/hosted-mcp/legal/privacy/en-ww/index.html +4 -221
package/src/hosted-mcp/legal/privacy/index.html +253 -0
package/src/hosted-mcp/server.mjs +920 -74

package/src/hosted-mcp/demo/privacy.html CHANGED Viewed

@@ -3,221 +3,11 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
-<title>Privacy Policy - Kaleidoscope Demo</title>
-<style>
-*, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
-body {
-  font-family: -apple-system, BlinkMacSystemFont, "SF Pro Text", system-ui, sans-serif;
-  background: #FFFDF5;
-  color: #1a1a1a;
-  -webkit-font-smoothing: antialiased;
-  -webkit-text-size-adjust: 100%;
-  line-height: 1.6;
-}
-.container {
-  max-width: 980px;
-  margin: 0 auto;
-  padding: 16px 24px 80px;
-}
-.header {
-  position: sticky;
-  top: 0;
-  z-index: 100;
-  padding: calc(12px + env(safe-area-inset-top, 0px)) 20px 12px;
-  background: rgba(255, 253, 245, 0.8);
-  -webkit-backdrop-filter: saturate(180%) blur(20px);
-  backdrop-filter: saturate(180%) blur(20px);
-  border-bottom: 1px solid rgba(0, 0, 0, 0.06);
-  display: flex;
-  align-items: center;
-}
-.header a {
-  display: flex;
-  align-items: center;
-  text-decoration: none;
-}
-h1 {
-  font-size: 28px;
-  font-weight: 700;
-  letter-spacing: -0.02em;
-  margin-bottom: 4px;
-}
-.subtitle {
-  font-size: 17px;
-  color: #8a8580;
-  margin-bottom: 8px;
-}
-.updated {
-  font-size: 13px;
-  color: #b0aaa4;
-  margin-bottom: 40px;
-}
-section {
-  padding: 28px 0;
-  border-top: 1px solid #e8e5de;
-}
-section:last-of-type {
-  border-bottom: 1px solid #e8e5de;
-}
-h2 {
-  font-size: 16px;
-  font-weight: 600;
-  letter-spacing: -0.01em;
-  margin-bottom: 12px;
-}
-p {
-  font-size: 15px;
-  line-height: 1.65;
-  color: #3a3a3a;
-  margin-bottom: 12px;
-}
-p:last-child {
-  margin-bottom: 0;
-}
-ul {
-  list-style: none;
-  padding: 0;
-  margin-bottom: 12px;
-}
-ul li {
-  font-size: 15px;
-  line-height: 1.65;
-  color: #3a3a3a;
-  padding-left: 16px;
-  position: relative;
-  margin-bottom: 4px;
-}
-ul li::before {
-  content: "\2022";
-  position: absolute;
-  left: 0;
-  color: #b0aaa4;
-}
-a {
-  color: #1a1a1a;
-}
-footer {
-  margin-top: 48px;
-  padding-bottom: 160px;
-}
-</style>
+<meta http-equiv="refresh" content="0; url=/legal/privacy/">
+<link rel="canonical" href="/legal/privacy/">
+<title>Privacy Policy - WIP Computer</title>
 </head>
 <body>
-<div class="header">
-  <a id="navIcon" href="/demo/"></a>
-</div>
-<div class="container">
-  <h1>Privacy Policy</h1>
-  <p class="subtitle">Kaleidoscope Demo</p>
-  <p class="updated">Last updated: April 2, 2026</p>
-  <section>
-    <p>WIP Computer, Inc. ("we", "us") operates the Kaleidoscope demo at wip.computer/demo.</p>
-  </section>
-  <section>
-    <h2>What We Collect</h2>
-    <ul>
-      <li>Passkey credential ID and public key (for authentication)</li>
-      <li>Username (optional, if you provide one)</li>
-      <li>Wallet balance (simulated, for demo purposes)</li>
-    </ul>
-  </section>
-  <section>
-    <h2>What We Do NOT Collect</h2>
-    <ul>
-      <li>Email addresses (unless voluntarily provided later)</li>
-      <li>Passwords (passkeys only, no passwords exist)</li>
-      <li>Biometric data (Face ID / fingerprint verification happens on your device, we never receive biometric data)</li>
-      <li>Photos (camera captures are processed in your browser, never uploaded)</li>
-      <li>Browsing history or tracking data</li>
-      <li>Cookies (we use sessionStorage only, cleared when you close the browser)</li>
-    </ul>
-  </section>
-  <section>
-    <h2>How We Use Your Data</h2>
-    <ul>
-      <li>Authentication: verifying your passkey when you sign in</li>
-      <li>Demo functionality: tracking simulated wallet balance</li>
-      <li>Product improvement: aggregate usage patterns (no personal data)</li>
-    </ul>
-  </section>
-  <section>
-    <h2>Third-Party Services</h2>
-    <ul>
-      <li>xAI (Grok Imagine API): receives text prompts for image generation. Does not receive your photos or personal data.</li>
-      <li>No analytics services</li>
-      <li>No advertising networks</li>
-      <li>No data brokers</li>
-    </ul>
-  </section>
-  <section>
-    <h2>Data Storage</h2>
-    <p>Your passkey data is stored on our server at wip.computer. It is not encrypted at rest in this demo version. Production versions will implement end-to-end encryption where we architecturally cannot read your data.</p>
-  </section>
-  <section>
-    <h2>Data Deletion</h2>
-    <p>Contact <a href="mailto:hello@wip.computer">hello@wip.computer</a> to request deletion of your passkey data.</p>
-  </section>
-  <section>
-    <h2>Your Rights</h2>
-    <p>You can delete your passkey from your device at any time through your device settings (Settings > Passwords on iOS, chrome://settings/passwords on Chrome).</p>
-  </section>
-  <section>
-    <h2>Changes</h2>
-    <p>We may update this policy. Changes will be reflected in the "Last updated" date.</p>
-  </section>
-  <section>
-    <h2>Contact</h2>
-    <p><a href="mailto:hello@wip.computer">hello@wip.computer</a></p>
-  </section>
-  <footer>
-    <div id="kscope-footer"></div>
-  </footer>
-  <script src="/demo/footer.js"></script>
-</div>
-<script>
-var SPRITE_COLS = 8, SPRITE_ROWS = 3, SPRITE_TOTAL = 24;
-var navIdx = Math.floor(Math.random() * SPRITE_TOTAL);
-function updateNavIcon() {
-  var el = document.getElementById('navIcon');
-  if (!el) return;
-  var col = navIdx % SPRITE_COLS;
-  var row = Math.floor(navIdx / SPRITE_COLS);
-  var bgPosX = (col / (SPRITE_COLS - 1)) * 100;
-  var bgPosY = (row / (SPRITE_ROWS - 1)) * 100;
-  el.innerHTML = '<div style="width:28px;height:28px;overflow:hidden;"><div style="width:100%;height:100%;background:url(/demo/sprites.png);background-size:' + (SPRITE_COLS * 100) + '% ' + (SPRITE_ROWS * 100) + '%;background-position:' + bgPosX + '% ' + bgPosY + '%;"></div></div>';
-  navIdx = (navIdx + 1) % SPRITE_TOTAL;
-}
-updateNavIcon();
-setInterval(updateNavIcon, 6000);
-</script>
+<p>The WIP Computer Privacy Policy has moved to <a href="/legal/privacy/">/legal/privacy/</a>.</p>
 </body>
 </html>

package/src/hosted-mcp/demo/tos.html CHANGED Viewed

@@ -3,196 +3,11 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
-<title>Terms of Service - Kaleidoscope Demo</title>
-<style>
-*, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
-body {
-  font-family: -apple-system, BlinkMacSystemFont, "SF Pro Text", system-ui, sans-serif;
-  background: #FFFDF5;
-  color: #1a1a1a;
-  -webkit-font-smoothing: antialiased;
-  -webkit-text-size-adjust: 100%;
-  line-height: 1.6;
-}
-.container {
-  max-width: 980px;
-  margin: 0 auto;
-  padding: 16px 24px 80px;
-}
-.header {
-  position: sticky;
-  top: 0;
-  z-index: 100;
-  padding: calc(12px + env(safe-area-inset-top, 0px)) 20px 12px;
-  background: rgba(255, 253, 245, 0.8);
-  -webkit-backdrop-filter: saturate(180%) blur(20px);
-  backdrop-filter: saturate(180%) blur(20px);
-  border-bottom: 1px solid rgba(0, 0, 0, 0.06);
-  display: flex;
-  align-items: center;
-}
-.header a {
-  display: flex;
-  align-items: center;
-  text-decoration: none;
-}
-h1 {
-  font-size: 28px;
-  font-weight: 700;
-  letter-spacing: -0.02em;
-  margin-bottom: 4px;
-}
-.subtitle {
-  font-size: 17px;
-  color: #8a8580;
-  margin-bottom: 8px;
-}
-.updated {
-  font-size: 13px;
-  color: #b0aaa4;
-  margin-bottom: 40px;
-}
-section {
-  padding: 28px 0;
-  border-top: 1px solid #e8e5de;
-}
-section:last-of-type {
-  border-bottom: 1px solid #e8e5de;
-}
-h2 {
-  font-size: 16px;
-  font-weight: 600;
-  letter-spacing: -0.01em;
-  margin-bottom: 12px;
-}
-p {
-  font-size: 15px;
-  line-height: 1.65;
-  color: #3a3a3a;
-  margin-bottom: 12px;
-}
-p:last-child {
-  margin-bottom: 0;
-}
-ul {
-  list-style: none;
-  padding: 0;
-  margin-bottom: 12px;
-}
-ul li {
-  font-size: 15px;
-  line-height: 1.65;
-  color: #3a3a3a;
-  padding-left: 16px;
-  position: relative;
-  margin-bottom: 4px;
-}
-ul li::before {
-  content: "\2022";
-  position: absolute;
-  left: 0;
-  color: #b0aaa4;
-}
-a {
-  color: #1a1a1a;
-}
-footer {
-  margin-top: 48px;
-  padding-bottom: 160px;
-}
-</style>
+<meta http-equiv="refresh" content="0; url=/legal/internet-services/kaleidoscope/">
+<link rel="canonical" href="/legal/internet-services/kaleidoscope/">
+<title>Kaleidoscope Terms of Service - WIP Computer</title>
 </head>
 <body>
-<div class="header">
-  <a id="navIcon" href="/demo/"></a>
-</div>
-<div class="container">
-  <h1>Terms of Service</h1>
-  <p class="subtitle">Kaleidoscope Demo</p>
-  <p class="updated">Last updated: April 2, 2026</p>
-  <section>
-    <p>This is a technology demonstration by WIP Computer, Inc.</p>
-  </section>
-  <section>
-    <h2>The Demo</h2>
-    <p>This demo showcases passkey authentication, biometric permission, and AI image generation. It is not a production service.</p>
-  </section>
-  <section>
-    <h2>Your Account</h2>
-    <p>Your account is created with a passkey. No email or password is stored. Your passkey lives on your device.</p>
-  </section>
-  <section>
-    <h2>Your Wallet</h2>
-    <p>The demo wallet starts with $5.00 in simulated credits. No real money is charged. The wallet balance is for demonstration purposes only.</p>
-  </section>
-  <section>
-    <h2>Generated Content</h2>
-    <p>Images generated through this demo are created using third-party AI APIs (xAI Grok Imagine). Generated content is dual-licensed:</p>
-    <ul>
-      <li>MIT License for personal, non-commercial use</li>
-      <li>Apache 2.0 License for commercial use</li>
-    </ul>
-    <p>Both you and WIP Computer, Inc. retain rights to generated content. We may use generated images for product development, marketing, and research.</p>
-  </section>
-  <section>
-    <h2>Uploaded Media</h2>
-    <p>Photos taken through the camera feature are processed locally in your browser. They are not uploaded to or stored on our servers. Camera access is optional and can be denied.</p>
-  </section>
-  <section>
-    <h2>No Warranty</h2>
-    <p>This demo is provided "as is" without warranty of any kind. WIP Computer, Inc. is not liable for any damages arising from use of this demo.</p>
-  </section>
-  <section>
-    <h2>Contact</h2>
-    <p><a href="mailto:hello@wip.computer">hello@wip.computer</a></p>
-  </section>
-  <footer>
-    <div id="kscope-footer"></div>
-  </footer>
-  <script src="/demo/footer.js"></script>
-</div>
-<script>
-var SPRITE_COLS = 8, SPRITE_ROWS = 3, SPRITE_TOTAL = 24;
-var navIdx = Math.floor(Math.random() * SPRITE_TOTAL);
-function updateNavIcon() {
-  var el = document.getElementById('navIcon');
-  if (!el) return;
-  var col = navIdx % SPRITE_COLS;
-  var row = Math.floor(navIdx / SPRITE_COLS);
-  var bgPosX = (col / (SPRITE_COLS - 1)) * 100;
-  var bgPosY = (row / (SPRITE_ROWS - 1)) * 100;
-  el.innerHTML = '<div style="width:28px;height:28px;overflow:hidden;"><div style="width:100%;height:100%;background:url(/demo/sprites.png);background-size:' + (SPRITE_COLS * 100) + '% ' + (SPRITE_ROWS * 100) + '%;background-position:' + bgPosX + '% ' + bgPosY + '%;"></div></div>';
-  navIdx = (navIdx + 1) % SPRITE_TOTAL;
-}
-updateNavIcon();
-setInterval(updateNavIcon, 6000);
-</script>
+<p>The Kaleidoscope Terms of Service have moved to <a href="/legal/internet-services/kaleidoscope/">/legal/internet-services/kaleidoscope/</a>.</p>
 </body>
 </html>

package/src/hosted-mcp/deploy.sh CHANGED Viewed

@@ -116,6 +116,8 @@ if [ "$SKIP_APP" -ne 1 ]; then
   add_file "server.mjs"   "${APP_REMOTE_DIR}/server.mjs"
   add_file "inbox.mjs"    "${APP_REMOTE_DIR}/inbox.mjs"
   add_file "tools.mjs"    "${APP_REMOTE_DIR}/tools.mjs"
+  add_file "codex-relay-e2ee-registry.mjs" "${APP_REMOTE_DIR}/codex-relay-e2ee-registry.mjs"
+  add_file "codex-relay-ws-abuse-limits.mjs" "${APP_REMOTE_DIR}/codex-relay-ws-abuse-limits.mjs"
   add_file "package.json" "${APP_REMOTE_DIR}/package.json"
   # Phone app static files (codex-remote-control, login).
   if [ -d "${SCRIPT_DIR}/app" ]; then

package/src/hosted-mcp/docs/self-host.md ADDED Viewed

@@ -0,0 +1,268 @@
+# Hosted Relay Self-Host Guide
+This guide explains how to inspect and run the hosted relay source that backs WIP-hosted services such as Codex Remote Control.
+The public source lives here:
+```text
+src/hosted-mcp
+```
+WIP's production relay runs at `wip.computer`. Self-hosting means running the same relay source on your own domain, with your own database, TLS certificate, process manager, and secrets.
+## What The Hosted Relay Does
+The hosted relay is a Node server with several surfaces:
+- hosted MCP over HTTP at `/mcp`;
+- OAuth and passkey login routes;
+- demo routes under `/demo`;
+- Codex Remote Control pairing and relay routes under `/api/codex-relay/*`;
+- health reporting at `/health`.
+For Codex Remote Control, the relay lets a local `codex-daemon` dial out to a public server. Browser and phone clients connect to that same public server. After E2EE setup, prompt text, assistant output, command output, and errors are carried as encrypted frames. The relay routes and authorizes frames, but it is not the place where Codex runs.
+## Current Self-Host Status
+The relay source is inspectable and runnable, but the non-WIP self-host story is not yet a one-command installer.
+Important current constraints:
+- `server.mjs` currently defaults `ISSUER_URL`, `MCP_RESOURCE_URL`, `RP_ID`, and `RP_ORIGIN` to `wip.computer`;
+- the nginx examples are written for the WIP production domain and filesystem layout;
+- the Codex Remote Control browser surface at `/codex-remote-control/<threadId>` is served by the WIP web app, not by the hosted-mcp Node process itself;
+- `codex-daemon` can point at a custom relay with environment variables, but a complete non-WIP phone/web UI deployment must also point at that same relay.
+That means a production self-host should treat this guide as the infrastructure map. Before broad use, parameterize or patch the WIP domain constants for your domain.
+## Prerequisites
+You need:
+- Node.js 20 or newer;
+- npm;
+- Postgres;
+- nginx or another reverse proxy that supports WebSocket upgrades;
+- TLS for your domain;
+- PM2 or another process manager;
+- a public domain such as `relay.example.com`.
+Optional demo surfaces may also need:
+- `OPENAI_API_KEY`;
+- `XAI_API_KEY`.
+Codex Remote Control relay operation does not require those demo keys.
+## Environment
+Start from:
+```bash
+cd src/hosted-mcp
+cp .env.example .env
+```
+Required:
+```bash
+DATABASE_URL=postgresql://kaleidoscope:YOUR_PASSWORD@localhost:5432/kaleidoscope
+```
+Common optional variables:
+```bash
+MCP_PORT=18800
+LDM_HOSTED_MCP_WS_ORIGIN_ALLOWLIST=https://relay.example.com
+LDM_HOSTED_MCP_RL_MINT=30
+LDM_HOSTED_MCP_RL_VALIDATE=60
+LDM_HOSTED_MCP_RL_STATUS=120
+```
+Development-only variables:
+```bash
+LDM_HOSTED_MCP_DEV_MODE=1
+LDM_HOSTED_MCP_ALLOW_WS_URL_TOKEN=1
+```
+Do not enable those development flags in production. Production should use Postgres and bearer or ticket authentication, not JSON fallback files or URL token fallback.
+## Database Setup
+Create a Postgres database and user for the relay. Then run Prisma from `src/hosted-mcp`:
+```bash
+npm install
+npx prisma generate
+npx prisma migrate deploy
+```
+The Prisma schema stores:
+- users;
+- WebAuthn credentials;
+- device tokens;
+- wallets;
+- API keys.
+Production should use Postgres. If Prisma cannot connect and `LDM_HOSTED_MCP_DEV_MODE` is not set, the server fails closed.
+## Local Smoke Test
+From `src/hosted-mcp`:
+```bash
+npm install
+node server.mjs
+```
+In another shell:
+```bash
+curl -fsS http://127.0.0.1:18800/health
+```
+Expected result: JSON health output from the Node process.
+## Process Management
+WIP production uses PM2 with:
+```text
+src/hosted-mcp/ecosystem.config.cjs
+```
+For a self-host:
+```bash
+cd src/hosted-mcp
+pm2 start ecosystem.config.cjs --update-env
+pm2 save
+pm2 status mcp-server
+```
+If you use another process manager, preserve the same contract:
+- run `server.mjs` from `src/hosted-mcp`;
+- provide `DATABASE_URL`;
+- keep the process alive across restarts;
+- preserve environment variables on reload;
+- verify `/health` after restart.
+## Deploy Helper
+WIP's production deploy helper is:
+```text
+src/hosted-mcp/deploy.sh
+```
+It copies `server.mjs`, supporting modules, static app/demo files, nginx snippets, and package metadata to WIP's VPS, then reloads nginx, reloads PM2, and writes a deploy manifest.
+For self-hosting, read it as an example of the file inventory and verification sequence. Do not run it unmodified unless your SSH host, remote directories, nginx layout, PM2 process name, and deploy-manifest path intentionally match the WIP production layout.
+## nginx, TLS, And Domain
+The production nginx examples live in:
+```text
+src/hosted-mcp/nginx
+```
+Key files:
+- `codex-relay.conf` contains the `/api/codex-relay/*`, `/pair`, and WebSocket proxy routes;
+- `mcp-oauth.conf` and `mcp-server.conf` contain hosted MCP and OAuth routes;
+- `wip.computer.conf` shows how WIP includes those snippets inside the public site config;
+- `conf.d/redact-logs.conf` defines the redacted access-log format.
+For self-hosting:
+1. Put TLS in front of your relay domain.
+2. Proxy HTTP routes to `http://127.0.0.1:18800`.
+3. Preserve WebSocket upgrade headers for `/api/codex-relay/web/` and `/api/codex-relay/daemon`.
+4. Use redacted logs so bearer tokens, relay tickets, and API keys do not land in access logs.
+5. Replace WIP paths and domains with your own.
+Minimum verification:
+```bash
+sudo nginx -t
+sudo systemctl reload nginx
+curl -fsS https://relay.example.com/health
+```
+## Pointing Codex Remote Control At A Custom Relay
+`codex-daemon` defaults to WIP's hosted relay. For a custom relay, set the relay endpoints before pairing and starting the daemon:
+```bash
+export CODEX_DAEMON_RELAY_HTTP=https://relay.example.com
+export CODEX_DAEMON_RELAY_WS=wss://relay.example.com/api/codex-relay/daemon
+codex-daemon link
+codex-daemon start
+```
+The MCP tool that creates browser links also defaults to WIP's hosted origin. Set this for sessions that should generate links for your relay domain:
+```bash
+export CODEX_REMOTE_CONTROL_ORIGIN=https://relay.example.com
+```
+A full non-WIP deployment also needs a browser or phone UI that serves `/codex-remote-control/<threadId>` and talks to the same relay routes. In WIP production, that UI is part of the Kaleidoscope web app.
+## Verify The Relay
+Use these checks after any deploy:
+```bash
+curl -fsS https://relay.example.com/health
+curl -fsS https://relay.example.com/api/codex-relay/state
+```
+For WIP production deploys, `scripts/verify-deploy.sh` verifies a deploy manifest against live remote file hashes:
+```bash
+bash src/hosted-mcp/scripts/verify-deploy.sh latest
+```
+That script assumes the WIP deploy-manifest layout unless you pass a different manifest and remote.
+## What Not To Copy From WIP Production
+Do not copy:
+- WIP `.env` files;
+- WIP Postgres credentials;
+- WIP API keys or `ck-` tokens;
+- WIP passkey, device, wallet, or user rows;
+- WIP PM2 process state;
+- WIP nginx certificate paths;
+- WIP domain constants without changing them for your domain;
+- WIP deploy manifests as proof of your deploy.
+Use the source shape, not WIP's production secrets or account data.
+## Production Checklist
+- Domain and TLS are live.
+- `DATABASE_URL` points at your Postgres database.
+- Prisma migrations have run.
+- `server.mjs` starts without `LDM_HOSTED_MCP_DEV_MODE`.
+- nginx proxies `/health`, `/mcp`, `/oauth/*`, `/api/codex-relay/*`, `/pair`, and WebSocket upgrades.
+- WebSocket origins are restricted with `LDM_HOSTED_MCP_WS_ORIGIN_ALLOWLIST`.
+- URL token fallback is disabled.
+- Access logs redact bearer tokens, relay tickets, and `ck-` values.
+- `codex-daemon link` completes against your domain.
+- `codex-daemon start` reports relay paired.
+- Browser links are generated for your domain, not `wip.computer`.
+## Open Work
+The remaining product work is to turn this infrastructure map into a first-class self-host installer:
+- parameterize issuer and WebAuthn relying party settings;
+- package the phone/web Remote Control UI for non-WIP domains;
+- add a guided `ldm` self-host profile;
+- add an end-to-end self-host smoke test that pairs a daemon and browser through a non-WIP domain.