@wipcomputer/wip-ldm-os 0.4.85-alpha.8 → 0.4.86

package/lib/deploy.mjs

@@ -19,6 +19,7 @@ import { join, basename, resolve, dirname } from 'node:path';
 import { tmpdir } from 'node:os';
 import { detectInterfaces, describeInterfaces, detectToolbox } from './detect.mjs';
 import { moveToTrash, appendToManifest } from './safe.mjs';
+import { configureSessionStartHook } from '../src/boot/installer.mjs';
 
 const HOME = process.env.HOME || '';
 const LDM_ROOT = join(HOME, '.ldm');
@@ -1117,6 +1118,40 @@ function installClaudeCodeHook(repoPath, doorOrDoors, toolName = basename(repoPa
 }
 
 function installClaudeCodeHookEvent(repoPath, door, toolName = basename(repoPath)) {
+  // Boot hook special case: single-owner delegation.
+  //
+  // The SessionStart boot hook's deployed command lives in ~/.ldm/shared/boot,
+  // NOT under ~/.ldm/extensions/<toolName>/. The extension-dir ownership match
+  // below keys on `/<toolName>/` in the command string, so it can never
+  // recognize an existing boot entry and appends a fresh duplicate on every
+  // manifest-driven install (10 copies accumulated 2026-07-04, ~450KB of boot
+  // context per session). configureSessionStartHook() in src/boot/installer.mjs
+  // is the single canonical registrar: it owns the whole boot-hook set,
+  // collapses duplicates, canonicalizes the command to BOOT_DIR, persists, and
+  // no-ops when already correct. Route boot-hook doors there so there is one
+  // writer, not two. Discriminating on the command (not the event alone) keeps
+  // other SessionStart hooks, e.g. wip-branch-guard's, on the normal path.
+  //
+  // Ticket: ai/product/bugs/installer/open-tickets/2026-07-05--cc-mini--deploy-hook-ownership-misses-boot-hook.md
+  const declaredCommand = door.command || '';
+  const isBootHookDoor =
+    (door.event || 'PreToolUse') === 'SessionStart' &&
+    (declaredCommand.includes('boot-hook') || /shared[/\\]boot/.test(declaredCommand));
+  if (isBootHookDoor) {
+    if (DRY_RUN) {
+      ok('Claude Code: would configure SessionStart boot hook (single-owner)');
+      return true;
+    }
+    try {
+      const result = configureSessionStartHook();
+      ok(`Claude Code: ${result}`);
+      return true;
+    } catch (e) {
+      fail(`Claude Code: boot hook registration failed. ${e.message}`);
+      return false;
+    }
+  }
+
   const settingsPath = join(HOME, '.claude', 'settings.json');
   let settings = readJSON(settingsPath);
 
@@ -1258,6 +1293,58 @@ function copySkillTree(skillDir, dest, copyFullFolder = false) {
   }
 }
 
+const SKILL_COMPANION_DIRS = ['references', 'agents', 'scripts', 'assets'];
+
+function listSkillCopyEntries(skillDir, copyFullFolder = false) {
+  if (copyFullFolder) {
+    try {
+      return readdirSync(skillDir)
+        .filter((entry) => entry !== '.DS_Store')
+        .sort();
+    } catch {
+      return ['SKILL.md'];
+    }
+  }
+
+  const entries = ['SKILL.md'];
+  for (const child of SKILL_COMPANION_DIRS) {
+    if (existsSync(join(skillDir, child))) entries.push(`${child}/`);
+  }
+  return entries;
+}
+
+function printSkillDryRunPlan({ sourceSkillDir, refsSrc, toolName, harnesses, workspace, entries }) {
+  const formatTargetEntries = (base) => entries.map((entry) => join(base, entry));
+  const harnessTargets = Object.entries(harnesses)
+    .filter(([, h]) => h.detected && h.skills)
+    .map(([name, h]) => ({ name, base: join(h.skills, toolName) }));
+
+  ok(`Skill: ${toolName}`);
+  log(`Source: ${sourceSkillDir}`);
+  log('Would copy:');
+  for (const entry of entries) log(`- ${entry}`);
+
+  const permanentBase = join(LDM_EXTENSIONS, toolName);
+  log('Permanent copy:');
+  for (const target of formatTargetEntries(permanentBase)) log(`- ${target}`);
+
+  if (harnessTargets.length > 0) {
+    log('Agent skill targets:');
+    for (const target of harnessTargets) {
+      log(`- ${target.name}: ${target.base}`);
+      for (const entryTarget of formatTargetEntries(target.base)) log(`  - ${entryTarget}`);
+    }
+  } else {
+    log('Agent skill targets: no detected skill harnesses');
+  }
+
+  if (existsSync(refsSrc) && workspace && existsSync(workspace)) {
+    const homeRefsDest = join(workspace, 'settings', 'docs', 'skills', toolName);
+    log('Workspace docs target:');
+    log(`- ${homeRefsDest} (references/ only)`);
+  }
+}
+
 function installSkillFolder(skillDir, toolName, opts = {}) {
   const { harnesses, workspace } = getHarnesses();
 
@@ -1281,17 +1368,8 @@ function installSkillFolder(skillDir, toolName, opts = {}) {
   if (!existsSync(refsSrc) && existsSync(permanentRefs)) refsSrc = permanentRefs;
 
   if (DRY_RUN) {
-    const targets = Object.entries(harnesses)
-      .filter(([,h]) => h.detected && h.skills)
-      .map(([,h]) => join(h.skills, toolName));
-    ok(`Skill: ${toolName}`);
-    log(`Source: ${sourceSkillDir}`);
-    if (targets.length > 0) {
-      log(`Targets:`);
-      for (const target of targets) log(`- ${target}`);
-    } else {
-      log(`Targets: no detected skill harnesses`);
-    }
+    const entries = listSkillCopyEntries(sourceSkillDir, opts.copyFullFolder);
+    printSkillDryRunPlan({ sourceSkillDir, refsSrc, toolName, harnesses, workspace, entries });
     return true;
   }
 
@@ -1659,4 +1737,4 @@ export function disableExtension(name) {
 
 // ── Exports for ldm CLI ──
 
-export { loadRegistry, saveRegistry, updateRegistry, readJSON, writeJSON, runBuildIfNeeded, resolveLocalDeps, buildSourceInfo, CORE_EXTENSIONS };
+export { loadRegistry, saveRegistry, updateRegistry, readJSON, writeJSON, runBuildIfNeeded, resolveLocalDeps, buildSourceInfo, CORE_EXTENSIONS, installClaudeCodeHook };

package/lib/registry-migrations.mjs

@@ -0,0 +1,296 @@
+// Registry migrations for ~/.ldm/extensions/registry.json.
+//
+// Phase 1 of the source-types refactor. Pure planner + npm-probe helper.
+// Called by bin/ldm.js during `ldm install`. Idempotent: entries that already
+// carry `updateSource` are skipped.
+//
+// `planLegacyNpmSourcesMigration` is pure (no filesystem I/O). The companion
+// `executeDirectoryMoves` IS side-effecting; the planner emits a list of
+// directory-move plans and the executor performs them. The split lets tests
+// drive the planner with in-memory fixtures and exercise the executor against
+// a real temp filesystem.
+//
+// See ai/product/bugs/installer/2026-05-13--cc-mini--installer-source-npm-honest-cleanup.md
+// and the parent design ai/product/bugs/installer/2026-05-13--cc-mini--installer-registry-source-types-architecture.md
+
+import { existsSync, mkdirSync, renameSync } from 'node:fs';
+import { join } from 'node:path';
+
+const DEFAULT_NPM_REGISTRY = 'https://registry.npmjs.org';
+
+// Phase 1 expedient. The known duplicate pairs surfaced on Parker's machine
+// during the 2026-05-13 dogfood. General-case duplicate detection is the
+// hygiene-audit ticket's Check 1
+// (ai/product/bugs/installer/2026-05-13--cc-mini--installer-registry-hygiene-audit.md);
+// do NOT extend this list as a long-term shape. Future entries belong in
+// that audit, not here.
+//
+// Dedupe drops the duplicate's `installed` block entirely. Today both rows
+// in each pair carry the same version, so no data is lost. If a duplicate
+// ever carried a newer version than its canonical, the dedup would silently
+// discard that information. Acceptable for the known pairs; not a general
+// safe pattern.
+const KNOWN_DUPLICATE_PAIRS = [
+  { keep: 'cc-session-export', remove: 'session-export' },
+  { keep: 'wip-branch-guard',  remove: 'package' },
+];
+
+export function emptyLegacyNpmSourcesSummary() {
+  return {
+    migrated: [],
+    phantomsRemoved: [],
+    duplicatesRemoved: [],
+    // Directory moves to perform AFTER the registry write. The planner
+    // emits these as a parallel list to duplicatesRemoved (1:1); the
+    // wrapper in bin/ldm.js executes them. See
+    // ai/product/bugs/installer/2026-05-13--cc-mini--installer-dedup-reverts-between-installs.md
+    // for the bug fix: without moving the on-disk directory out of
+    // ~/.ldm/extensions/, autoDetectExtensions re-registers the duplicate
+    // on the same install run and the dedup never persists.
+    directoryMoves: [],
+    directoryMovesPerformed: [],
+    directoryMovesSkipped: [],
+    probedCount: 0,
+    probeFailures: [],
+    timestamp: new Date().toISOString(),
+  };
+}
+
+export function summaryHasChanges(summary) {
+  return summary.migrated.length > 0
+    || summary.phantomsRemoved.length > 0
+    || summary.duplicatesRemoved.length > 0;
+}
+
+// Pure planner. Returns { newRegistry, summary } without touching the
+// filesystem. Tests pass an in-memory registry, a fake `probeNpm`, and a
+// fake `extensionExists`. Real callers inject the file-backed versions.
+//
+// probeNpm contract:
+//   returns true  if the package exists on npm
+//   returns false if the package returns 404 (definitely doesn't exist)
+//   returns null  if the probe failed (timeout / network) ... entry is left
+//                  alone and retried on the next install
+//
+// extensionExists contract:
+//   called as (name, entry) -> boolean
+//   The entry is provided so the resolver can honor `entry.paths.ldm` and
+//   the legacy `entry.ldmPath` field before falling back to the default
+//   ~/.ldm/extensions/<name> path. A naive resolver that only checks the
+//   default location would falsely classify custom-path entries as
+//   phantoms and remove them. Real callers must check both.
+export async function planLegacyNpmSourcesMigration({
+  registry,
+  probeNpm,
+  extensionExists,
+  now,
+}) {
+  const summary = emptyLegacyNpmSourcesSummary();
+  if (now) summary.timestamp = now().toISOString();
+  if (!registry?.extensions) return { newRegistry: registry, summary };
+
+  // Shallow-clone the top level and each entry so the input is not mutated.
+  const newRegistry = { ...registry, extensions: {} };
+  for (const [name, entry] of Object.entries(registry.extensions)) {
+    newRegistry.extensions[name] = { ...entry };
+  }
+
+  // Step 1: phantoms. Registry rows with no on-disk extension directory.
+  // The acceptance criterion says these are removed entirely; they're
+  // surfaced as an explicit summary delta, not silent.
+  //
+  // extensionExists is called with both name and entry so the resolver can
+  // honor entry.paths.ldm / entry.ldmPath. A custom-path entry must not be
+  // misclassified as phantom.
+  for (const [name, entry] of Object.entries(newRegistry.extensions)) {
+    if (entry.updateSource) continue;
+    if (extensionExists(name, entry)) continue;
+    summary.phantomsRemoved.push({
+      name,
+      reason: 'directory missing',
+      legacyNpmName: entry.source?.npm || null,
+    });
+    delete newRegistry.extensions[name];
+  }
+
+  // Step 2: dedupe known pairs. Pure structural fix; the canonical row stays
+  // untouched. Future drift is the hygiene-audit ticket's job, not this one.
+  //
+  // Each removed duplicate also emits a directoryMoves entry: the wrapper
+  // moves ~/.ldm/extensions/<remove> to ~/.ldm/_trash/<remove>-deduplicated-<ts>
+  // after the registry write so autoDetectExtensions cannot re-register
+  // the duplicate on the same install run.
+  const trashStamp = summary.timestamp.replace(/[:.]/g, '-');
+  for (const { keep, remove } of KNOWN_DUPLICATE_PAIRS) {
+    if (newRegistry.extensions[keep] && newRegistry.extensions[remove]) {
+      summary.duplicatesRemoved.push({ keep, removed: remove });
+      summary.directoryMoves.push({
+        name: remove,
+        reason: 'deduplicated',
+        trashName: `${remove}-deduplicated-${trashStamp}`,
+      });
+      delete newRegistry.extensions[remove];
+    }
+  }
+
+  // Step 3: probe entries that still carry a legacy `source.npm` value.
+  // 404 -> migrate to untracked + provenance. 200 -> leave alone. Unknown ->
+  // leave alone; the next install will retry.
+  const probeTargets = [];
+  for (const [name, entry] of Object.entries(newRegistry.extensions)) {
+    if (entry.updateSource) continue;
+    const npmName = entry.source?.npm;
+    if (!npmName) continue;
+    probeTargets.push({ name, npmName });
+  }
+
+  const probeResults = await Promise.all(
+    probeTargets.map(async ({ name, npmName }) => {
+      const exists = await probeNpm(npmName);
+      summary.probedCount++;
+      return { name, npmName, exists };
+    })
+  );
+
+  for (const { name, npmName, exists } of probeResults) {
+    if (exists === true) continue;
+    if (exists === null) {
+      summary.probeFailures.push({ name, npmName });
+      continue;
+    }
+    const entry = newRegistry.extensions[name];
+    const legacyRepo = entry.source?.repo || null;
+    summary.migrated.push({ name, legacyNpmName: npmName, legacyRepo });
+    entry.updateSource = { type: 'untracked' };
+    entry.provenance = { ...(entry.provenance || {}) };
+    entry.provenance['legacy-npm-name'] = npmName;
+    if (legacyRepo) entry.provenance.repo = legacyRepo;
+    entry.provenance.untrackedSince = summary.timestamp;
+    delete entry.source;
+  }
+
+  // Step 4: entries with no source info at all (the mystery `run`-style row).
+  // Per the ticket, migrate to untracked so they stay visible in `ldm status`.
+  for (const [name, entry] of Object.entries(newRegistry.extensions)) {
+    if (entry.updateSource) continue;
+    if (entry.source?.npm || entry.source?.repo) continue;
+    summary.migrated.push({
+      name,
+      legacyNpmName: null,
+      legacyRepo: null,
+      reason: 'no-source-info',
+    });
+    entry.updateSource = { type: 'untracked' };
+    entry.provenance = { ...(entry.provenance || {}) };
+    entry.provenance.untrackedSince = summary.timestamp;
+    if ('source' in entry) delete entry.source;
+  }
+
+  return { newRegistry, summary };
+}
+
+// Execute the directory-move plans emitted by planLegacyNpmSourcesMigration.
+// Side-effecting: moves directories from `extensionsRoot/<name>` to
+// `trashRoot/<trashName>`. Creates `trashRoot` if needed. Skips moves whose
+// source is missing or whose rename fails. Idempotent: a second call with the
+// same plan returns all-skipped (source-missing) once the moves are done.
+//
+// Returns `{ performed: [...], skipped: [...] }` for the caller to append to
+// the migration summary. Each performed entry gains a `destPath`; each skipped
+// entry gains a `reason`.
+//
+// The contract is split from the planner so:
+//   - the planner stays pure and trivially testable with in-memory fixtures,
+//   - the executor can be exercised against a real temp filesystem in a test
+//     fixture without spawning a full `ldm install` run,
+//   - tests can inject `fs` primitives via the optional `fs` option for
+//     paranoid scenarios.
+export function executeDirectoryMoves({
+  directoryMoves,
+  extensionsRoot,
+  trashRoot,
+  fs,
+}) {
+  const _existsSync = fs?.existsSync || existsSync;
+  const _mkdirSync = fs?.mkdirSync || mkdirSync;
+  const _renameSync = fs?.renameSync || renameSync;
+
+  const performed = [];
+  const skipped = [];
+  if (!directoryMoves || directoryMoves.length === 0) {
+    return { performed, skipped };
+  }
+
+  _mkdirSync(trashRoot, { recursive: true });
+
+  for (const move of directoryMoves) {
+    const src = join(extensionsRoot, move.name);
+    const dest = join(trashRoot, move.trashName);
+    if (!_existsSync(src)) {
+      skipped.push({ ...move, reason: 'source-missing' });
+      continue;
+    }
+    try {
+      _renameSync(src, dest);
+      performed.push({ ...move, destPath: dest });
+    } catch (err) {
+      skipped.push({ ...move, reason: `rename-failed: ${err.message}` });
+    }
+  }
+
+  return { performed, skipped };
+}
+
+// Real npm-registry probe. Returns true/false/null per the planner contract.
+// Mirrors the fetch pattern used by npmViewVersionForStatus in bin/ldm.js.
+export async function npmPackageExists(pkgName, opts = {}) {
+  const registryUrl = (opts.registryUrl || DEFAULT_NPM_REGISTRY).replace(/\/+$/, '');
+  const timeoutMs = Number.isFinite(opts.timeoutMs) ? opts.timeoutMs : 2000;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const url = `${registryUrl}/${encodeURIComponent(pkgName)}`;
+    const response = await fetch(url, {
+      signal: controller.signal,
+      headers: { accept: 'application/vnd.npm.install-v1+json, application/json' },
+    });
+    if (response.status === 404) return false;
+    if (response.ok) return true;
+    return null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// Doctor check: returns a list of registry entries that still carry a
+// `source.npm` value pointing at a package that returns 404. These are
+// candidates for migration on the next `ldm install`, but if the doctor
+// runs first (Parker checks status / doctor before running install) we
+// warn so it's not invisible.
+//
+// Returns: [{ name, npmName }] in lexical order.
+export async function findLegacyNpm404Entries({
+  registry,
+  probeNpm,
+}) {
+  if (!registry?.extensions) return [];
+  const targets = [];
+  for (const [name, entry] of Object.entries(registry.extensions)) {
+    if (entry.updateSource) continue;
+    const npmName = entry.source?.npm;
+    if (!npmName) continue;
+    targets.push({ name, npmName });
+  }
+  const results = await Promise.all(
+    targets.map(async ({ name, npmName }) => {
+      const exists = await probeNpm(npmName);
+      return { name, npmName, exists };
+    })
+  );
+  return results
+    .filter(r => r.exists === false)
+    .map(({ name, npmName }) => ({ name, npmName }))
+    .sort((a, b) => a.name.localeCompare(b.name));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-ldm-os",
-  "version": "0.4.85-alpha.8",
+  "version": "0.4.86",
   "type": "module",
   "description": "LDM OS: identity, memory, and sovereignty infrastructure for AI agents",
   "engines": {
@@ -18,21 +18,39 @@
   "scripts": {
     "build:bridge": "cd src/bridge && npm install && npx tsup core.ts mcp-server.ts cli.ts openclaw.ts --format esm --dts --clean --outDir ../../dist/bridge",
     "build": "npm run build:bridge",
-    "prepublishOnly": "npm run build:bridge && npm run validate:bin-manifest",
+    "prepublishOnly": "npm run build:bridge && npm run validate:bin-manifest && npm run test:install-prompt-policy && npm run test:readme-install-prompt && npm run test:ldm-status-timeout && npm run test:ldm-status-concurrency && npm run test:legacy-npm-sources-migration",
     "validate:bin-manifest": "node scripts/validate-bin-manifest.mjs",
     "test:skill-frontmatter": "node scripts/test-skill-frontmatter.mjs",
+    "test:install-prompt-policy": "node scripts/test-install-prompt-policy.mjs",
+    "test:readme-install-prompt": "node scripts/test-readme-install-prompt.mjs",
+    "test:ldm-status-timeout": "node scripts/test-ldm-status-timeout.mjs",
+    "test:ldm-status-concurrency": "node scripts/test-ldm-status-concurrency.mjs",
+    "test:legacy-npm-sources-migration": "node scripts/test-legacy-npm-sources-migration.mjs",
     "test:installer-update-tracks": "node scripts/test-installer-update-tracks.mjs",
     "test:installer-hook-toolname": "node scripts/test-installer-hook-toolname.mjs",
+    "test:installer-target-self-update": "node scripts/test-installer-target-self-update.mjs",
     "test:installer-skill-directory": "node scripts/test-installer-skill-directory.mjs",
+    "test:installer-skill-dry-run-destinations": "node scripts/test-installer-skill-dry-run-destinations.mjs",
     "test:ldm-install-bin-shim": "node scripts/test-ldm-install-preserves-foreign-bin.mjs",
     "test:doctor-cron-target": "node scripts/test-doctor-cron-target.mjs",
+    "test:boot-payload-trim": "node scripts/test-boot-payload-trim.mjs",
     "test:bin-manifest": "node scripts/test-bin-manifest.mjs",
     "test:crc-agentid-tenant-boundary": "node scripts/test-crc-agentid-tenant-boundary.mjs",
     "test:crc-pair-login-flow": "node scripts/test-crc-pair-login-flow.mjs",
     "test:crc-pair-status-poll-token": "node scripts/test-crc-pair-status-poll-token.mjs",
+    "test:crc-pair-relink-audit-and-rotation": "node scripts/test-crc-pair-relink-audit-and-rotation.mjs",
+    "test:crc-e2ee-key-persistence": "node scripts/test-crc-e2ee-key-persistence.mjs",
     "test:crc-e2ee-session-route": "node scripts/test-crc-e2ee-session-route.mjs",
+    "test:crc-websocket-abuse-limits": "node scripts/test-crc-websocket-abuse-limits.mjs",
+    "test:kaleidoscope-qr-authenticator-confirmation": "node scripts/test-kaleidoscope-qr-authenticator-confirmation.mjs",
+    "test:kaleidoscope-onboarding-copy": "node scripts/test-kaleidoscope-onboarding-copy.mjs",
+    "test:kaleidoscope-public-stats-baseline": "node scripts/test-kaleidoscope-public-stats-baseline.mjs",
     "fmt": "npx prettier --write 'src/**/*.{ts,mjs}' 'lib/**/*.mjs' 'bin/**/*.js'",
-    "fmt:check": "npx prettier --check 'src/**/*.{ts,mjs}' 'lib/**/*.mjs' 'bin/**/*.js'"
+    "fmt:check": "npx prettier --check 'src/**/*.{ts,mjs}' 'lib/**/*.mjs' 'bin/**/*.js'",
+    "test:boot-hook-registration": "node scripts/test-boot-hook-registration.mjs",
+    "test:doctor-hook-dedupe": "node scripts/test-doctor-hook-dedupe.mjs",
+    "test:boot-dir-truth": "node scripts/test-boot-dir-truth.mjs",
+    "test:deploy-hook-ownership": "node scripts/test-deploy-hook-ownership.mjs"
   },
   "claudeCode": {
     "hook": {

package/scripts/test-boot-dir-truth.mjs

@@ -0,0 +1,158 @@
+#!/usr/bin/env node
+// Regression test: `ldm doctor` boot-hook stale-at-execution-path check.
+//
+// Covers:
+//   ai/product/bugs/installer/open-tickets/2026-07-05--cc-mini--shared-library-split-brain-boot-deploy.md
+//
+// The split-brain bug: syncBootHook() deployed boot-hook.mjs to
+// ~/.ldm/library/boot while the registered SessionStart hook executed
+// ~/.ldm/shared/boot. New code landed in library/, sessions ran the stale
+// copy in shared/, and the install reported success. This test drives the
+// doctor check that makes the drift visible (and the --fix that repairs the
+// execution path), plus the no-false-positive cases.
+//
+// Follows the test-doctor-hook-dedupe.mjs pattern: real bin/ldm.js doctor
+// against a temp HOME, crontab/npm shimmed on PATH so operator state and the
+// network are never touched. LDM_SELF_UPDATED=1 skips CLI self-update.
+
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+
+const repo = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const cli = join(repo, 'bin', 'ldm.js');
+const pkg = JSON.parse(readFileSync(join(repo, 'package.json'), 'utf8'));
+// The current boot hook this CLI would deploy: doctor compares against it.
+const srcBootContent = readFileSync(join(repo, 'src', 'boot', 'boot-hook.mjs'), 'utf8');
+
+let failed = 0;
+function assert(cond, label, output = '') {
+  if (cond) {
+    console.log(`  [PASS] ${label}`);
+  } else {
+    console.log(`  [FAIL] ${label}`);
+    if (output) console.log(`         --- output (last lines) ---\n         ${output.trim().split('\n').slice(-25).join('\n         ')}`);
+    failed++;
+  }
+}
+
+// Build a fixture HOME. The registered SessionStart hook points at
+// ~/.ldm/shared/boot/boot-hook.mjs (the execution path). `execContent`
+// seeds that file; `libraryContent` seeds the parallel ~/.ldm/library/boot
+// copy (null to skip).
+function setupHome({ execContent, libraryContent }) {
+  const home = mkdtempSync(join(tmpdir(), 'ldm-bootdir-'));
+  const ldmRoot = join(home, '.ldm');
+  const fakeBin = join(home, 'fakebin');
+  mkdirSync(join(ldmRoot, 'extensions'), { recursive: true });
+  mkdirSync(join(home, '.claude'), { recursive: true });
+  mkdirSync(fakeBin, { recursive: true });
+
+  writeFileSync(join(ldmRoot, 'version.json'), JSON.stringify({ version: pkg.version }, null, 2) + '\n');
+  writeFileSync(join(ldmRoot, 'extensions', 'registry.json'), JSON.stringify({ _format: 'v2', extensions: {} }, null, 2) + '\n');
+
+  const execTarget = join(ldmRoot, 'shared', 'boot', 'boot-hook.mjs');
+  mkdirSync(dirname(execTarget), { recursive: true });
+  writeFileSync(execTarget, execContent);
+  if (libraryContent !== null && libraryContent !== undefined) {
+    const lib = join(ldmRoot, 'library', 'boot', 'boot-hook.mjs');
+    mkdirSync(dirname(lib), { recursive: true });
+    writeFileSync(lib, libraryContent);
+  }
+
+  // Registered SessionStart hook runs the shared/boot (execution) copy.
+  const settings = {
+    hooks: {
+      SessionStart: [
+        { matcher: '*', hooks: [{ type: 'command', command: `node ${execTarget}`, timeout: 15 }] },
+      ],
+    },
+  };
+  const settingsPath = join(home, '.claude', 'settings.json');
+  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
+
+  writeFileSync(join(fakeBin, 'crontab'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'crontab'), 0o755);
+  writeFileSync(join(fakeBin, 'npm'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'npm'), 0o755);
+
+  return { home, fakeBin, execTarget };
+}
+
+function runDoctor({ home, fakeBin }, fix = false) {
+  const args = ['doctor'];
+  if (fix) args.push('--fix');
+  try {
+    return execFileSync('node', [cli, ...args], {
+      env: { ...process.env, HOME: home, PATH: `${fakeBin}:${process.env.PATH}`, LDM_SELF_UPDATED: '1' },
+      encoding: 'utf-8',
+      timeout: 30000,
+    });
+  } catch (err) {
+    return (err.stdout || '') + (err.stderr || '');
+  }
+}
+
+const STALE = '// stale boot hook code (pre-trim)\nprocess.exit(0);\n';
+
+console.log('Test 1: stale execution path is reported, not written without --fix');
+{
+  const w = setupHome({ execContent: STALE, libraryContent: srcBootContent });
+  const before = readFileSync(w.execTarget, 'utf-8');
+  const out = runDoctor(w);
+  const after = readFileSync(w.execTarget, 'utf-8');
+  assert(/boot hook stale at execution path/.test(out), 'reports stale at execution path', out);
+  assert(/a current copy exists at:.*library\/boot/.test(out), 'points at the fresh library/boot copy', out);
+  assert(before === after, 'execution-path file untouched without --fix');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 2: --fix redeploys the current boot hook to the execution path');
+{
+  const w = setupHome({ execContent: STALE, libraryContent: srcBootContent });
+  const out = runDoctor(w, true);
+  const after = readFileSync(w.execTarget, 'utf-8');
+  const backups = readdirSync(dirname(w.execTarget)).filter((f) => f.startsWith('boot-hook.mjs.bak-'));
+  assert(/Redeployed the current boot hook to the execution path/.test(out), 'reports redeploy under --fix', out);
+  assert(after === srcBootContent, 'execution-path file now matches current src/boot/boot-hook.mjs');
+  assert(backups.length === 1, `stale copy backed up before overwrite (found ${backups.length})`);
+  const again = runDoctor(w, true);
+  assert(!/boot hook stale at execution path/.test(again), 'second --fix run finds nothing stale', again);
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 3: in-sync execution path is not flagged');
+{
+  const w = setupHome({ execContent: srcBootContent, libraryContent: null });
+  const out = runDoctor(w);
+  assert(!/boot hook stale at execution path/.test(out), 'no stale report when exec path matches src', out);
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 4: no registered boot hook is a no-op (no crash, no false positive)');
+{
+  const home = mkdtempSync(join(tmpdir(), 'ldm-bootdir-none-'));
+  const ldmRoot = join(home, '.ldm');
+  const fakeBin = join(home, 'fakebin');
+  mkdirSync(join(ldmRoot, 'extensions'), { recursive: true });
+  mkdirSync(join(home, '.claude'), { recursive: true });
+  mkdirSync(fakeBin, { recursive: true });
+  writeFileSync(join(ldmRoot, 'version.json'), JSON.stringify({ version: pkg.version }, null, 2) + '\n');
+  writeFileSync(join(ldmRoot, 'extensions', 'registry.json'), JSON.stringify({ _format: 'v2', extensions: {} }, null, 2) + '\n');
+  writeFileSync(join(home, '.claude', 'settings.json'), JSON.stringify({ hooks: {} }, null, 2) + '\n');
+  writeFileSync(join(fakeBin, 'crontab'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'crontab'), 0o755);
+  writeFileSync(join(fakeBin, 'npm'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'npm'), 0o755);
+  const out = runDoctor({ home, fakeBin });
+  assert(!/boot hook stale at execution path/.test(out), 'no stale report when no boot hook is registered', out);
+  rmSync(home, { recursive: true, force: true });
+}
+
+if (failed > 0) {
+  console.log(`\n${failed} assertion(s) failed`);
+  process.exit(1);
+}
+console.log('\nAll boot-dir-truth tests passed');