@wipcomputer/wip-ldm-os 0.4.85-alpha.9 → 0.4.86

package/scripts/test-crc-pair-relink-audit-and-rotation.mjs

@@ -0,0 +1,164 @@
+import { readFileSync } from "node:fs";
+import {
+  codexDaemonPubkeyFingerprint,
+  createCodexDaemonPubkeyRegistry,
+  evaluateCodexDaemonReconnectPubkey,
+} from "../src/hosted-mcp/codex-relay-e2ee-registry.mjs";
+
+const server = readFileSync("src/hosted-mcp/server.mjs", "utf8");
+const pairHtml = readFileSync("src/hosted-mcp/app/pair.html", "utf8");
+const loginHtml = readFileSync("src/hosted-mcp/app/kaleidoscope-login.html", "utf8");
+const registrySource = readFileSync("src/hosted-mcp/codex-relay-e2ee-registry.mjs", "utf8");
+const ticket = readFileSync("ai/product/bugs/codex-remote-control/2026-05-05--codex--remote-control-pair-relink-audit-and-rotation.md", "utf8");
+
+function assertContains(haystack, needle, label) {
+  if (!haystack.includes(needle)) {
+    throw new Error(`${label} missing expected text: ${needle}`);
+  }
+}
+
+function assert(condition, label, detail = "") {
+  if (!condition) throw new Error(`${label}${detail ? ": " + detail : ""}`);
+}
+
+function createSilentLogger() {
+  return { log() {}, error() {} };
+}
+
+assertContains(server, "const CODEX_PAIR_PRESENCE_TTL_MS = 2 * 60 * 1000;", "short pair presence ttl");
+assertContains(server, "const codexPairPresenceTokens = new Map();", "pair presence token store");
+assertContains(server, "function generateCodexPairPresenceToken(agentId)", "pair presence token mint");
+assertContains(server, "function consumeCodexPairPresenceToken(token, agentId)", "pair presence token consume");
+assertContains(server, "codex_pair_presence_token: generateCodexPairPresenceToken(agentId)", "registration mints pair presence token");
+assertContains(server, "codex_pair_presence_token: generateCodexPairPresenceToken(entry.agentId)", "authentication mints pair presence token");
+assertContains(server, 'error: "fresh_presence_required"', "pair-complete fresh presence rejection");
+assertContains(server, "consumeCodexPairPresenceToken(pairPresenceToken, identity.agentId)", "pair-complete consumes pair presence token");
+assertContains(server, 'json(res, 404, { error: "invalid or already-used code" });', "pair code reuse rejection");
+assertContains(server, 'json(res, 410, { error: "code expired or already used" });', "pair code expiry rejection");
+assertContains(server, "invalidateCodexBrowserSessionsForAgent(identity.agentId, \"daemon key replaced\")", "daemon replacement invalidates stale browser sessions");
+assertContains(server, "evaluateCodexDaemonReconnectPubkey(", "daemon reconnect checks existing key policy");
+assertContains(server, "daemon key change requires fresh pair", "changed daemon reconnect key requires pair flow");
+assertContains(server, "daemonIdentityAccepted = activateCodexDaemonWs();", "daemon only becomes active after identity is accepted");
+assertContains(server, "daemon already online", "duplicate daemon cannot evict an online daemon");
+assertContains(server, "daemon identity required", "daemon frames require identity before routing");
+assertContains(server, "p.replaced_daemon_key = !!daemonKeyResult?.replaced;", "pair state records replacement status");
+assertContains(server, "replaced_daemon_key: !!p.replaced_daemon_key", "pair-status exposes relink replacement status");
+assertContains(pairHtml, "codex_pair_presence_token: getPairPresenceToken()", "pair page sends pair presence token");
+assertContains(pairHtml, "fresh_presence_required", "pair page handles fresh presence error");
+assertContains(pairHtml, "Remote Control relinked this laptop.", "pair page gives relink message");
+assertContains(loginHtml, "wip_codex_pair_presence_token", "login carries pair presence token into pair page");
+assertContains(registrySource, "CREATE TABLE IF NOT EXISTS codex_daemon_e2ee_key_audit", "pair audit table");
+assertContains(registrySource, "old_pubkey_fingerprint", "audit stores old key fingerprint");
+assertContains(registrySource, "new_pubkey_fingerprint", "audit stores new key fingerprint");
+assertContains(ticket, "status: done", "ticket marked done");
+
+const oldFingerprint = codexDaemonPubkeyFingerprint("old-spki-key");
+const newFingerprint = codexDaemonPubkeyFingerprint("new-spki-key");
+assert(oldFingerprint && oldFingerprint.startsWith("sha256:"), "fingerprint has sha256 prefix");
+assert(oldFingerprint !== newFingerprint, "fingerprint changes when daemon key changes");
+
+const registry = createCodexDaemonPubkeyRegistry({
+  usePrisma: false,
+  devMode: false,
+  logger: createSilentLogger(),
+});
+const first = await registry.register("acct:test-user-a", "old-spki-key", ["e2ee-v1"], "pair-complete");
+assert(first.registered === true, "first pair registers key");
+assert(first.replaced === false, "first pair is not replacement");
+const second = await registry.register("acct:test-user-a", "new-spki-key", ["e2ee-v1"], "pair-complete");
+assert(second.registered === true, "relink registers new key");
+assert(second.replaced === true, "relink replacement is detected");
+assert(second.old_fingerprint === oldFingerprint, "relink reports old fingerprint");
+assert(second.new_fingerprint === newFingerprint, "relink reports new fingerprint");
+assert(registry.auditLog.length === 2, "registry keeps audit entries");
+assert(registry.auditLog[1].replaced === true, "audit marks replacement");
+assert(registry.auditLog[1].old_pubkey_fingerprint === oldFingerprint, "audit stores old fingerprint");
+assert(registry.auditLog[1].new_pubkey_fingerprint === newFingerprint, "audit stores new fingerprint");
+
+const firstReconnectPolicy = evaluateCodexDaemonReconnectPubkey(null, "daemon-reconnect-key");
+assert(firstReconnectPolicy.allowed === true, "daemon reconnect can self-heal when no key is registered");
+assert(firstReconnectPolicy.replaced === false, "first daemon reconnect is not a replacement");
+const sameReconnectPolicy = evaluateCodexDaemonReconnectPubkey({ pubkey: "daemon-reconnect-key" }, "daemon-reconnect-key");
+assert(sameReconnectPolicy.allowed === true, "daemon reconnect can re-register the same key");
+assert(sameReconnectPolicy.replaced === false, "same-key daemon reconnect is not a replacement");
+const changedReconnectPolicy = evaluateCodexDaemonReconnectPubkey({ pubkey: "daemon-reconnect-key" }, "attacker-reconnect-key");
+assert(changedReconnectPolicy.allowed === false, "daemon reconnect cannot replace an existing key");
+assert(changedReconnectPolicy.reason === "fresh_pair_required", "changed daemon reconnect requires fresh pair");
+assert(changedReconnectPolicy.replaced === true, "changed daemon reconnect is detected as replacement");
+assert(changedReconnectPolicy.old_fingerprint === codexDaemonPubkeyFingerprint("daemon-reconnect-key"), "changed reconnect reports old fingerprint");
+assert(changedReconnectPolicy.new_fingerprint === codexDaemonPubkeyFingerprint("attacker-reconnect-key"), "changed reconnect reports new fingerprint");
+const invalidReconnectPolicy = evaluateCodexDaemonReconnectPubkey({ pubkey: "daemon-reconnect-key" }, "");
+assert(invalidReconnectPolicy.allowed === false, "daemon reconnect rejects missing pubkey");
+assert(invalidReconnectPolicy.reason === "invalid_daemon_pubkey", "missing daemon reconnect pubkey has explicit reason");
+const oversizedReconnectPolicy = evaluateCodexDaemonReconnectPubkey(null, "x".repeat(1025));
+assert(oversizedReconnectPolicy.allowed === false, "daemon reconnect rejects oversized pubkey");
+assert(oversizedReconnectPolicy.reason === "invalid_daemon_pubkey", "oversized daemon reconnect pubkey has explicit reason");
+
+const executeCalls = [];
+const persistedRegistry = createCodexDaemonPubkeyRegistry({
+  usePrisma: true,
+  devMode: false,
+  logger: createSilentLogger(),
+  prisma: {
+    async $executeRawUnsafe(sql, ...args) {
+      executeCalls.push({ sql, args });
+      return 1;
+    },
+  },
+});
+await persistedRegistry.register("acct:test-user-b", "persisted-spki-key", ["e2ee-v1"], "daemon-reconnect");
+const auditInsert = executeCalls.find((call) => call.sql.includes("INSERT INTO codex_daemon_e2ee_key_audit"));
+assert(auditInsert, "audit insert executes for persisted registry");
+assert(auditInsert.sql.includes("$7::timestamptz"), "audit insert casts registered_at parameter to timestamptz");
+assert(typeof auditInsert.args[6] === "string" && auditInsert.args[6].includes("T"), "audit insert passes ISO registered_at value");
+
+function pairCompleteModel({ hasDaemonPublicKey, pairPresenceOk, previousPubkey, nextPubkey }) {
+  if (hasDaemonPublicKey && !pairPresenceOk) return { code: 403, error: "fresh_presence_required" };
+  const replaced = !!(previousPubkey && nextPubkey && previousPubkey !== nextPubkey);
+  return { code: 200, replaced };
+}
+
+assert(
+  pairCompleteModel({
+    hasDaemonPublicKey: true,
+    pairPresenceOk: false,
+    previousPubkey: "old",
+    nextPubkey: "new",
+  }).code === 403,
+  "ck token alone cannot replace daemon key",
+);
+assert(
+  pairCompleteModel({
+    hasDaemonPublicKey: true,
+    pairPresenceOk: true,
+    previousPubkey: "old",
+    nextPubkey: "new",
+  }).replaced === true,
+  "fresh pair presence permits relink",
+);
+assert(
+  pairCompleteModel({
+    hasDaemonPublicKey: true,
+    pairPresenceOk: true,
+    previousPubkey: null,
+    nextPubkey: "new",
+  }).replaced === false,
+  "fresh pair presence permits first pair",
+);
+
+function pairCodeModel(pair, codeKnown, now) {
+  if (!codeKnown) return { code: 404, error: "invalid or already-used code" };
+  if (!pair || pair.status !== "pending" || now > pair.expires) {
+    return { code: 410, error: "code expired or already used" };
+  }
+  pair.status = "completed";
+  return { code: 200 };
+}
+
+const pair = { status: "pending", expires: 100 };
+assert(pairCodeModel(pair, true, 10).code === 200, "first pair-complete succeeds");
+assert(pairCodeModel(pair, true, 20).code === 410, "pair code reuse fails");
+assert(pairCodeModel({ status: "pending", expires: 100 }, true, 200).code === 410, "expired pair code fails");
+assert(pairCodeModel(null, false, 10).code === 404, "unknown pair code fails");
+
+console.log("crc pair relink audit and rotation checks passed");

package/scripts/test-crc-websocket-abuse-limits.mjs

@@ -0,0 +1,128 @@
+import { readFileSync } from "node:fs";
+import assert from "node:assert/strict";
+import {
+  CODEX_WS_CLOSE_CODES,
+  codexWsFrameByteLength,
+  createCodexWsAbuseLimitConfig,
+  createCodexWsConnectionGuard,
+  formatCodexWsLimitLog,
+  isCodexWsAgentDisabled,
+} from "../src/hosted-mcp/codex-relay-ws-abuse-limits.mjs";
+
+const server = readFileSync("src/hosted-mcp/server.mjs", "utf8");
+const deploy = readFileSync("src/hosted-mcp/deploy.sh", "utf8");
+
+function assertContains(source, needle, label) {
+  if (!source.includes(needle)) {
+    throw new Error(`${label} missing expected text: ${needle}`);
+  }
+}
+
+function assertBefore(source, first, second, label) {
+  const firstIndex = source.indexOf(first);
+  const secondIndex = firstIndex === -1 ? -1 : source.indexOf(second, firstIndex + first.length);
+  if (firstIndex === -1 || secondIndex === -1 || firstIndex >= secondIndex) {
+    throw new Error(`${label} expected "${first}" before "${second}"`);
+  }
+}
+
+const config = createCodexWsAbuseLimitConfig({
+  LDM_CODEX_WS_MAX_FRAME_BYTES: "10",
+  LDM_CODEX_WS_RATE_WINDOW_MS: "100",
+  LDM_CODEX_WS_MAX_MESSAGES_PER_WINDOW: "2",
+  LDM_CODEX_WS_MAX_BYTES_PER_WINDOW: "15",
+  LDM_CODEX_WS_MAX_BROWSER_SOCKETS_PER_THREAD: "3",
+  LDM_CODEX_WS_IDLE_TTL_MS: "50",
+  LDM_CODEX_WS_MAX_MALFORMED_FRAMES: "1",
+  LDM_CODEX_WS_MAX_PENDING_BYTES: "20",
+  LDM_CODEX_WS_KILL_SWITCH_AGENTS: "acct:blocked, acct:other",
+});
+
+assert.equal(config.maxFrameBytes, 10);
+assert.equal(config.maxBrowserSocketsPerThread, 3);
+assert.equal(isCodexWsAgentDisabled(config, "acct:blocked"), true);
+assert.equal(isCodexWsAgentDisabled(config, "acct:allowed"), false);
+
+let nowMs = 1_000;
+const guard = createCodexWsConnectionGuard({
+  config,
+  agentId: "acct:allowed",
+  now: () => nowMs,
+});
+
+assert.equal(guard.observeFrame(11).code, CODEX_WS_CLOSE_CODES.oversizedFrame);
+assert.equal(guard.observeFrame(5).ok, true);
+assert.equal(guard.observeFrame(5).ok, true);
+assert.equal(guard.observeFrame(5).reason, "message rate limit");
+
+nowMs += 101;
+const byteGuard = createCodexWsConnectionGuard({ config, agentId: "acct:allowed", now: () => nowMs });
+assert.equal(byteGuard.observeFrame(8).ok, true);
+assert.equal(byteGuard.observeFrame(8).reason, "byte rate limit");
+
+const malformedGuard = createCodexWsConnectionGuard({ config, agentId: "acct:allowed", now: () => nowMs });
+assert.equal(malformedGuard.observeMalformed().ok, true);
+assert.equal(malformedGuard.observeMalformed().code, CODEX_WS_CLOSE_CODES.malformedFrames);
+
+const pendingGuard = createCodexWsConnectionGuard({ config, agentId: "acct:allowed", now: () => nowMs });
+assert.equal(pendingGuard.observePendingBytes(21).code, CODEX_WS_CLOSE_CODES.pendingBytes);
+
+const idleGuard = createCodexWsConnectionGuard({ config, agentId: "acct:allowed", now: () => nowMs });
+assert.equal(idleGuard.observeFrame(1).ok, true);
+assert.equal(idleGuard.observeIdle(nowMs + 51).code, CODEX_WS_CLOSE_CODES.idleTimeout);
+
+const killedGuard = createCodexWsConnectionGuard({ config, agentId: "acct:blocked", now: () => nowMs });
+assert.equal(killedGuard.observeFrame(1).code, CODEX_WS_CLOSE_CODES.operatorDisabled);
+assert.equal(codexWsFrameByteLength(Buffer.from("hello")), 5);
+assert.match(
+  formatCodexWsLimitLog({
+    agentId: "acct:blocked",
+    threadId: "thread-a",
+    connectionId: "conn-a",
+    reason: "message rate limit",
+  }),
+  /reason=message rate limit agent=acct:blocked thread=thread-a conn=conn-a/,
+);
+
+assertContains(server, "import {", "server imports abuse module");
+assertContains(server, "createCodexWsAbuseLimitConfig", "server configures websocket limits");
+assertContains(server, "isCodexWsAgentDisabled(CODEX_WS_ABUSE_LIMITS, identity.agentId)", "server checks operator kill switch");
+assertContains(server, "openBrowserSockets >= CODEX_WS_ABUSE_LIMITS.maxBrowserSocketsPerThread", "server limits browser sockets per thread");
+assertContains(server, "createCodexWsConnectionGuard({", "server creates per-socket guard");
+assertContains(server, "guard.observeFrame(codexWsFrameByteLength(data))", "server observes browser frame size and rate");
+assertContains(server, "guard.observeMalformed()", "server observes malformed browser frames");
+assertContains(server, "guard.observePendingBytes(daemonWs.bufferedAmount || 0)", "server observes pending daemon bytes");
+assertContains(server, "guard.observeIdle()", "server observes idle connections");
+assertContains(server, "closeCodexWsForLimit(ws, guardContext, decision)", "server closes idle sockets by limit");
+assertContains(server, "closeCodexWsForLimit(ws, guardContext, frameDecision)", "server closes frame abuse");
+assertContains(server, "closeCodexWsForLimit(ws, guardContext, malformedDecision)", "server closes malformed abuse");
+assertContains(server, "closeCodexWsForLimit(ws, guardContext, pendingDecision)", "server closes pending byte abuse");
+assertContains(server, "codex-relay-ws-abuse-limits.mjs", "deploy inventory includes abuse module");
+assertContains(deploy, "add_file \"codex-relay-ws-abuse-limits.mjs\"", "deploy copies abuse module");
+
+assertBefore(
+  server,
+  "openBrowserSockets >= CODEX_WS_ABUSE_LIMITS.maxBrowserSocketsPerThread",
+  "codexRelayWss.handleUpgrade(req, socket, head, (ws) => {",
+  "socket cap should run before websocket upgrade is accepted",
+);
+assertBefore(
+  server,
+  "const frameDecision = guard.observeFrame(codexWsFrameByteLength(data));",
+  "let text = data.toString();",
+  "frame limit should run before parsing or forwarding browser data",
+);
+assertBefore(
+  server,
+  "if (!envelope || typeof envelope !== \"object\" || Array.isArray(envelope)) {",
+  "const daemonWs = codexDaemons.get(identity.agentId);",
+  "malformed browser frames should not be forwarded",
+);
+assertBefore(
+  server,
+  "const pendingDecision = guard.observePendingBytes(daemonWs.bufferedAmount || 0);",
+  "daemonWs.send(text);",
+  "pending byte check should run before forwarding to daemon",
+);
+
+console.log("crc websocket abuse limit checks passed");

package/scripts/test-deploy-hook-ownership.mjs

@@ -0,0 +1,160 @@
+#!/usr/bin/env node
+// Regression test: manifest-driven boot-hook registration is single-owner.
+//
+// Covers:
+//   ai/product/bugs/installer/open-tickets/2026-07-05--cc-mini--deploy-hook-ownership-misses-boot-hook.md
+//
+// Before this fix, lib/deploy.mjs installClaudeCodeHookEvent() matched owned
+// hook entries by an extension-dir tag (`/<toolName>/`). The boot hook's
+// deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains
+// no `/wip-ldm-os/` segment, so the ownership match found nothing and appended
+// a fresh SessionStart entry on every manifest-driven `ldm install` (the real
+// mechanism behind the 10-entry accumulation on 2026-07-04).
+//
+// The fix routes boot-hook doors to configureSessionStartHook() (the single
+// canonical registrar), so the deploy path no longer appends.
+//
+// Cases:
+//   1. Fresh manifest install: exactly one boot entry, canonical command.
+//   2. Repeat manifest install: byte-identical settings.json (true no-op).
+//   3. Pre-accumulated + unrelated SessionStart hook: collapses boot entries
+//      to one, preserves the non-boot SessionStart entry (discriminates on the
+//      command, not the event).
+//   4. Dry run: reports intent, writes nothing.
+//
+// HOME must be set before importing deploy.mjs: both deploy.mjs (process.env.HOME)
+// and the transitively-imported src/boot/installer.mjs (os.homedir()) resolve
+// their HOME-based constants at module-load time.
+
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+// The temp prefix must not contain "boot-hook" or "shared/boot": those are the
+// ownership matchers, and the temp HOME ends up inside every fixture command.
+const tempHome = mkdtempSync(join(tmpdir(), 'ldm-deployown-'));
+process.env.HOME = tempHome;
+
+const { installClaudeCodeHook, setFlags } = await import('../lib/deploy.mjs');
+
+// Mirror detect.mjs: the wip-ldm-os package.json declares a single SessionStart
+// boot-hook door. deploy.mjs receives it as a one-element array.
+const bootDoor = {
+  event: 'SessionStart',
+  matcher: '*',
+  command: `node ${join(tempHome, '.ldm', 'shared', 'boot', 'boot-hook.mjs')}`,
+  timeout: 15,
+};
+const expectedCommand = `node ${join(tempHome, '.ldm', 'shared', 'boot', 'boot-hook.mjs')}`;
+
+let failed = 0;
+function assert(cond, label, detail = '') {
+  if (cond) {
+    console.log(`  [PASS] ${label}`);
+  } else {
+    console.log(`  [FAIL] ${label}`);
+    if (detail) console.log(`         ${detail}`);
+    failed++;
+  }
+}
+
+const settingsPath = join(tempHome, '.claude', 'settings.json');
+function seedSettings(obj) {
+  mkdirSync(join(tempHome, '.claude'), { recursive: true });
+  writeFileSync(settingsPath, JSON.stringify(obj, null, 2) + '\n');
+}
+function readSettings() {
+  return JSON.parse(readFileSync(settingsPath, 'utf-8'));
+}
+function bootEntries(settings) {
+  return (settings.hooks?.SessionStart || []).filter((entry) =>
+    (entry?.hooks || []).some((h) => h?.command?.includes('boot-hook'))
+  );
+}
+// Install through the manifest wrapper exactly as detect.mjs feeds it: an array.
+function manifestInstall() {
+  return installClaudeCodeHook(join(tempHome, 'repo'), [bootDoor], 'wip-ldm-os');
+}
+
+try {
+  console.log('Test 1: fresh manifest install adds exactly one boot entry');
+  {
+    seedSettings({ hooks: {} });
+    manifestInstall();
+    const s = readSettings();
+    assert(bootEntries(s).length === 1, 'exactly one boot-hook SessionStart entry');
+    assert(
+      s.hooks.SessionStart[0].hooks[0].command === expectedCommand,
+      'command canonicalized to BOOT_DIR boot-hook.mjs',
+      `on disk: ${s.hooks.SessionStart[0].hooks[0].command}`
+    );
+  }
+
+  console.log('Test 2: repeat manifest install is a byte-identical no-op');
+  {
+    const before = readFileSync(settingsPath, 'utf-8');
+    manifestInstall();
+    const after = readFileSync(settingsPath, 'utf-8');
+    assert(before === after, 'settings.json byte-identical after second manifest install');
+    assert(bootEntries(readSettings()).length === 1, 'still exactly one boot-hook entry (no append)');
+  }
+
+  console.log('Test 3: pre-accumulated boot entries collapse; unrelated SessionStart hook preserved');
+  {
+    // Three legacy boot appends (the pre-fix accumulation) using the old
+    // hardcoded absolute path, plus an unrelated SessionStart guard entry.
+    const legacyBoot = {
+      matcher: '*',
+      hooks: [{ type: 'command', command: 'node /Users/someone/.ldm/shared/boot/boot-hook.mjs', timeout: 15 }],
+    };
+    const guardSessionStart = {
+      matcher: 'Read|Glob',
+      hooks: [{ type: 'command', command: `node ${join(tempHome, '.ldm', 'extensions', 'wip-branch-guard', 'guard.mjs')}`, timeout: 10 }],
+    };
+    seedSettings({
+      hooks: {
+        SessionStart: [
+          structuredClone(legacyBoot),
+          structuredClone(legacyBoot),
+          guardSessionStart,
+          structuredClone(legacyBoot),
+        ],
+      },
+    });
+    manifestInstall();
+    const s = readSettings();
+    assert(bootEntries(s).length === 1, 'boot entries collapsed to one');
+    assert(
+      s.hooks.SessionStart[0].hooks[0].command === expectedCommand,
+      'surviving boot entry canonicalized to BOOT_DIR'
+    );
+    assert(
+      s.hooks.SessionStart.some((e) => e.hooks?.[0]?.command?.includes('wip-branch-guard')),
+      'unrelated SessionStart guard entry preserved (discriminates on command, not event)'
+    );
+    assert(s.hooks.SessionStart.length === 2, 'exactly boot + guard remain');
+  }
+
+  console.log('Test 4: dry run reports intent and writes nothing');
+  {
+    seedSettings({ hooks: {} });
+    const before = readFileSync(settingsPath, 'utf-8');
+    setFlags({ dryRun: true });
+    try {
+      manifestInstall();
+    } finally {
+      setFlags({ dryRun: false });
+    }
+    const after = readFileSync(settingsPath, 'utf-8');
+    assert(before === after, 'settings.json untouched under dry run');
+    assert(bootEntries(readSettings()).length === 0, 'no boot entry written under dry run');
+  }
+} finally {
+  rmSync(tempHome, { recursive: true, force: true });
+}
+
+if (failed > 0) {
+  console.log(`\n${failed} assertion(s) failed`);
+  process.exit(1);
+}
+console.log('\nAll deploy-hook ownership tests passed');

package/scripts/test-doctor-hook-dedupe.mjs

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+// Regression test: `ldm doctor` duplicate-hook + invalid-model checks.
+//
+// Covers the 2026-07-04 tickets:
+//   ai/product/bugs/installer/open-tickets/2026-07-04--cc-mini--installer-sessionstart-hook-duplicate-registration.md
+//   ai/product/bugs/guard/2026-07-04--cc-mini--no-blessed-recipe-for-live-settings-remediation.md
+//
+// Cases:
+//   1. Duplicate-laden settings: doctor reports, does NOT write without --fix.
+//   2. --fix collapses duplicates to 1, writes a timestamped backup first,
+//      preserves unrelated hooks and unknown keys.
+//   3. Invalid model value ("opus" + real ESC 0x1B + "[1m"): reported, removed under --fix.
+//   4. Malformed settings.json: warns and skips, file untouched, no crash.
+//
+// Follows the test-doctor-cron-target.mjs pattern: real bin/ldm.js doctor
+// against a temp HOME, crontab/npm shimmed on PATH so the operator's real
+// state is never read.
+
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+
+const repo = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const cli = join(repo, 'bin', 'ldm.js');
+const pkg = JSON.parse(readFileSync(join(repo, 'package.json'), 'utf8'));
+
+let failed = 0;
+function assert(cond, label, output = '') {
+  if (cond) {
+    console.log(`  [PASS] ${label}`);
+  } else {
+    console.log(`  [FAIL] ${label}`);
+    if (output) console.log(`         --- output (last lines) ---\n         ${output.trim().split('\n').slice(-25).join('\n         ')}`);
+    failed++;
+  }
+}
+
+function setupHome(settingsFactory) {
+  const home = mkdtempSync(join(tmpdir(), 'ldm-doctor-dedupe-'));
+  const ldmRoot = join(home, '.ldm');
+  const fakeBin = join(home, 'fakebin');
+  mkdirSync(join(ldmRoot, 'extensions'), { recursive: true });
+  mkdirSync(join(home, '.claude'), { recursive: true });
+  mkdirSync(fakeBin, { recursive: true });
+
+  writeFileSync(join(ldmRoot, 'version.json'), JSON.stringify({ version: pkg.version }, null, 2) + '\n');
+  writeFileSync(join(ldmRoot, 'extensions', 'registry.json'), JSON.stringify({ _format: 'v2', extensions: {} }, null, 2) + '\n');
+
+  // Hook scripts must exist on disk: doctor --fix runs the stale-path
+  // cleanup (#30) before the dedupe pass, and missing targets would be
+  // removed as stale instead of collapsed as duplicates.
+  const bootScript = join(ldmRoot, 'shared', 'boot', 'boot-hook.mjs');
+  const guardScript = join(ldmRoot, 'extensions', 'wip-branch-guard', 'guard.mjs');
+  const stopScript = join(ldmRoot, 'extensions', 'stop-hook.mjs');
+  for (const f of [bootScript, guardScript, stopScript]) {
+    mkdirSync(dirname(f), { recursive: true });
+    writeFileSync(f, 'process.exit(0);\n');
+  }
+
+  const paths = { bootScript, guardScript, stopScript };
+  const settingsContent = settingsFactory(paths);
+  const settingsPath = join(home, '.claude', 'settings.json');
+  writeFileSync(settingsPath, typeof settingsContent === 'string'
+    ? settingsContent
+    : JSON.stringify(settingsContent, null, 2) + '\n');
+
+  // Empty crontab + no-op npm on PATH (never touch operator state/network).
+  writeFileSync(join(fakeBin, 'crontab'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'crontab'), 0o755);
+  writeFileSync(join(fakeBin, 'npm'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'npm'), 0o755);
+
+  return { home, fakeBin, settingsPath, paths };
+}
+
+function runDoctor({ home, fakeBin }, fix = false) {
+  const args = ['doctor'];
+  if (fix) args.push('--fix');
+  try {
+    return execFileSync('node', [cli, ...args], {
+      env: { ...process.env, HOME: home, PATH: `${fakeBin}:${process.env.PATH}`, LDM_SELF_UPDATED: '1' },
+      encoding: 'utf-8',
+      timeout: 30000,
+    });
+  } catch (err) {
+    return (err.stdout || '') + (err.stderr || '');
+  }
+}
+
+const bootCmd = (paths) => `node ${paths.bootScript}`;
+const bootEntry = (paths) => ({ matcher: '*', hooks: [{ type: 'command', command: bootCmd(paths), timeout: 15 }] });
+const guardEntry = (paths) => ({ hooks: [{ type: 'command', command: `node ${paths.guardScript}`, timeout: 10 }] });
+
+function dupeLadenSettings(paths) {
+  return {
+    unknownTopLevelKey: { keep: 'me' },
+    permissions: { defaultMode: 'default' },
+    hooks: {
+      SessionStart: [
+        ...Array.from({ length: 5 }, () => bootEntry(paths)),
+        guardEntry(paths),
+        ...Array.from({ length: 5 }, () => bootEntry(paths)),
+      ],
+      Stop: [{ hooks: [{ type: 'command', command: `node ${paths.stopScript}` }] }],
+    },
+  };
+}
+
+console.log('Test 1: duplicates reported, no write without --fix');
+{
+  const w = setupHome(dupeLadenSettings);
+  const before = readFileSync(w.settingsPath, 'utf-8');
+  const out = runDoctor(w);
+  const after = readFileSync(w.settingsPath, 'utf-8');
+  assert(/SessionStart: 10 identical hook entries/.test(out), 'reports 10 identical SessionStart entries', out);
+  assert(/ldm doctor --fix to collapse 9 duplicate hook entries/.test(out), 'suggests --fix with count', out);
+  assert(before === after, 'settings.json untouched without --fix');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 2: --fix collapses, backs up first, preserves everything else');
+{
+  const w = setupHome(dupeLadenSettings);
+  const out = runDoctor(w, true);
+  const s = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  const bootCount = s.hooks.SessionStart.filter((e) => e.hooks?.[0]?.command === bootCmd(w.paths)).length;
+  const backups = readdirSync(join(w.home, '.claude')).filter((f) => f.startsWith('settings.json.bak-'));
+  assert(/Collapsed 9 duplicate hook entries/.test(out), 'reports 9 collapsed', out);
+  assert(bootCount === 1, `boot-hook entries collapsed to 1 (got ${bootCount})`);
+  assert(s.hooks.SessionStart.length === 2, 'boot hook + branch guard remain');
+  assert(s.hooks.Stop.length === 1, 'unrelated Stop hook preserved');
+  assert(s.unknownTopLevelKey?.keep === 'me', 'unknown top-level key preserved');
+  assert(backups.length === 1, `timestamped backup written (found ${backups.length})`);
+  if (backups.length === 1) {
+    const bak = JSON.parse(readFileSync(join(w.home, '.claude', backups[0]), 'utf-8'));
+    assert(bak.hooks.SessionStart.length === 11, 'backup holds the pre-fix state');
+  }
+  const again = runDoctor(w, true);
+  assert(!/Collapsed/.test(again), 'second --fix run finds nothing to collapse', again);
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 3: invalid model value reported and removed under --fix');
+{
+  // The corruption fixture carries a REAL ESC control char (0x1B): "opus"
+  // plus an ANSI bold fragment, which is what a terminal paste persists.
+  // Printable brackets alone are NOT corruption (see Test 4).
+  const w = setupHome((paths) => ({ model: 'opus\x1b[1m', hooks: { SessionStart: [bootEntry(paths)] } }));
+  const out = runDoctor(w);
+  assert(/model value is invalid/.test(out), 'reports invalid model', out);
+  const before = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  assert(typeof before.model === 'string', 'model untouched without --fix');
+  const fixOut = runDoctor(w, true);
+  const s = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  assert(/Removed invalid model value/.test(fixOut), 'reports removal under --fix', fixOut);
+  assert(!('model' in s), 'model key removed from disk');
+  assert(s.hooks.SessionStart.length === 1, 'hooks untouched by model fix');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 4: valid model values are left alone (including bracketed 1M-context IDs)');
+{
+  const w = setupHome(() => ({ model: 'claude-fable-5[1m]', hooks: {} }));
+  const out = runDoctor(w, true);
+  const s = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  assert(!/model value is invalid/.test(out), 'no invalid-model report for bracketed 1M id', out);
+  assert(s.model === 'claude-fable-5[1m]', 'legitimate 1M-context model preserved');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 5: malformed settings.json warns, skips, file untouched');
+{
+  const w = setupHome(() => '{ this is not json\n');
+  const before = readFileSync(w.settingsPath, 'utf-8');
+  const out = runDoctor(w, true);
+  const after = readFileSync(w.settingsPath, 'utf-8');
+  assert(/not valid JSON; skipping hook\/model checks/.test(out), 'warns about malformed JSON', out);
+  assert(before === after, 'malformed file untouched');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+if (failed > 0) {
+  console.log(`\n${failed} assertion(s) failed`);
+  process.exit(1);
+}
+console.log('\nAll doctor hook-dedupe tests passed');