@wipcomputer/wip-ldm-os 0.4.85-alpha.9 → 0.4.87-alpha.1

package/scripts/test-doctor-commit-deployed.mjs

@@ -0,0 +1,300 @@
+#!/usr/bin/env node
+// Regression test: `ldm doctor --commit-deployed`.
+//
+// Covers:
+//   wip-tracking-private-only/bugs/installer/open-tickets/2026-07-06--cc-mini--ldm-doctor-commit-deployed.md
+//
+// The command records installer-deployed config drift in a tracked home tree so
+// the tree stops blocking `git pull`, gitignores runtime/transient junk, and
+// leaves personal choices. settings.json is split at JSON-key granularity:
+// installer-owned keys (hooks) commit, personal keys (model, permissions) stay.
+//
+// Follows the test-doctor-hook-dedupe.mjs harness: real bin/ldm.js against a
+// temp HOME with a real, disposable local git repo for the home tree. gh / npm
+// / crontab are shimmed on PATH and LDM_SELF_UPDATED=1 so no network, no PR, no
+// operator state is touched. No push, no merge: the command records locally.
+
+import { chmodSync, cpSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync, existsSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+
+const repo = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const cli = join(repo, 'bin', 'ldm.js');
+
+let failed = 0;
+function assert(cond, label, output = '') {
+  if (cond) {
+    console.log(`  [PASS] ${label}`);
+  } else {
+    console.log(`  [FAIL] ${label}`);
+    if (output) console.log(`         ${String(output).trim().split('\n').slice(-20).join('\n         ')}`);
+    failed++;
+  }
+}
+
+const OLD_HOOKS = { SessionStart: [{ matcher: '*', hooks: [{ type: 'command', command: 'node /old/boot-hook.mjs', timeout: 15 }] }] };
+const NEW_HOOKS = { SessionStart: [{ matcher: '*', hooks: [{ type: 'command', command: 'node /new/boot-hook.mjs', timeout: 15 }] }] };
+
+function git(dir, ...a) {
+  return execFileSync('git', ['-C', dir, ...a], { encoding: 'utf8' });
+}
+function writeJSON(p, obj) {
+  writeFileSync(p, JSON.stringify(obj, null, 2) + '\n');
+}
+
+// Build a fixture HOME with a real local git repo at HOME/.claude. `driftFn`
+// receives the repo dir and mutates it into the post-install dirty state.
+function setupHome(driftFn) {
+  const home = mkdtempSync(join(tmpdir(), 'ldm-commitdep-'));
+  const claude = join(home, '.claude');
+  const fakeBin = join(home, 'fakebin');
+  mkdirSync(join(claude, 'rules'), { recursive: true });
+  mkdirSync(fakeBin, { recursive: true });
+
+  // Baseline committed state.
+  writeJSON(join(claude, 'settings.json'), { model: 'sonnet', permissions: { defaultMode: 'default' }, hooks: OLD_HOOKS });
+  writeFileSync(join(claude, 'rules', 'base.md'), 'old rule\n');
+  // projects/ and cache/ already ignored; plans/ deliberately NOT, so the
+  // command has a new transient path to gitignore.
+  writeFileSync(join(claude, '.gitignore'), 'projects/\ncache/\n');
+
+  git(claude, 'init', '-q');
+  git(claude, 'config', 'user.email', 'test@example.com');
+  git(claude, 'config', 'user.name', 'Test');
+  git(claude, 'config', 'commit.gpgsign', 'false');
+  // Isolate the fixture from any global core.hooksPath (the real machine sets a
+  // pre-commit hook there that blocks commits on main). Kept OUTSIDE the repo so
+  // an added hook file never pollutes the repo's status. Tests that want a hook
+  // drop one into this dir explicitly.
+  const hooksDir = join(home, 'githooks');
+  mkdirSync(hooksDir, { recursive: true });
+  git(claude, 'config', 'core.hooksPath', hooksDir);
+  git(claude, 'add', '-A');
+  git(claude, 'commit', '-q', '-m', 'baseline');
+
+  driftFn(claude);
+
+  // Shims: never touched by this command, present for parity with doctor tests.
+  for (const b of ['gh', 'npm', 'crontab']) {
+    writeFileSync(join(fakeBin, b), '#!/bin/sh\nexit 0\n');
+    chmodSync(join(fakeBin, b), 0o755);
+  }
+  return { home, claude, fakeBin, hooksDir };
+}
+
+function run({ home, claude, fakeBin }, extra = []) {
+  const args = ['doctor', '--commit-deployed', '--home', claude, ...extra];
+  try {
+    return execFileSync('node', [cli, ...args], {
+      env: { ...process.env, HOME: home, PATH: `${fakeBin}:${process.env.PATH}`, LDM_SELF_UPDATED: '1' },
+      encoding: 'utf-8',
+      timeout: 30000,
+    });
+  } catch (err) {
+    return (err.stdout || '') + (err.stderr || '');
+  }
+}
+
+function headJSON(claude, path) {
+  return JSON.parse(git(claude, 'show', `HEAD:${path}`));
+}
+function statusPorcelain(claude) {
+  return git(claude, 'status', '--porcelain').trim();
+}
+
+console.log('Test 1: deployed + transient drift, no personal drift -> clean tree');
+{
+  const w = setupHome((c) => {
+    const s = { model: 'sonnet', permissions: { defaultMode: 'default' }, hooks: NEW_HOOKS };
+    writeJSON(join(c, 'settings.json'), s);            // deployed key (hooks) changed
+    writeFileSync(join(c, 'rules', 'base.md'), 'new rule\n'); // deployed file changed
+    mkdirSync(join(c, 'plans'), { recursive: true });
+    writeFileSync(join(c, 'plans', 'session.json'), '{}\n');  // transient, NOT yet ignored
+    mkdirSync(join(c, 'projects'), { recursive: true });
+    writeFileSync(join(c, 'projects', 'x.json'), '{}\n');     // transient, already ignored
+  });
+  const out = run(w);
+  assert(/record installer-deployed config drift/.test(git(w.claude, 'log', '-1', '--format=%s')), 'recorded a chore(deploy) commit', out);
+  assert(headJSON(w.claude, 'settings.json').hooks.SessionStart[0].hooks[0].command === 'node /new/boot-hook.mjs', 'committed settings.json has the new hooks', out);
+  assert(headJSON(w.claude, 'settings.json').model === 'sonnet', 'committed settings.json keeps model (personal untouched)');
+  assert(git(w.claude, 'show', 'HEAD:rules/base.md') === 'new rule\n', 'committed the deployed rules/ change');
+  assert(readFileSync(join(w.claude, '.gitignore'), 'utf8').includes('plans/'), 'gitignored the new transient path (plans/)', out);
+  assert(statusPorcelain(w.claude) === '', 'tree is CLEAN after recording', statusPorcelain(w.claude));
+  const backups = existsSync(join(w.home, '.ldm', 'backups')) ? readdirSync(join(w.home, '.ldm', 'backups')) : [];
+  assert(backups.length === 1 && existsSync(join(w.home, '.ldm', 'backups', backups[0], 'MANIFEST.txt')), 'timestamped backup with manifest taken before mutation', backups.join(','));
+
+  // Idempotent second run.
+  const headBefore = git(w.claude, 'rev-parse', 'HEAD').trim();
+  const out2 = run(w);
+  assert(/already clean, nothing to record/.test(out2), 'second run is a no-op (tree already clean)', out2);
+  assert(git(w.claude, 'rev-parse', 'HEAD').trim() === headBefore, 'no extra commit on the clean second run');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 2: mixed settings.json (hooks + model) -> key granularity, personal left');
+{
+  const w = setupHome((c) => {
+    writeJSON(join(c, 'settings.json'), { model: 'opus', permissions: { defaultMode: 'default' }, hooks: NEW_HOOKS });
+    writeFileSync(join(c, 'rules', 'base.md'), 'new rule\n');
+  });
+  const out = run(w);
+  assert(headJSON(w.claude, 'settings.json').hooks.SessionStart[0].hooks[0].command === 'node /new/boot-hook.mjs', 'committed the hooks key', out);
+  assert(headJSON(w.claude, 'settings.json').model === 'sonnet', 'did NOT commit the personal model key (still old on HEAD)', out);
+  assert(JSON.parse(readFileSync(join(w.claude, 'settings.json'), 'utf8')).model === 'opus', 'working settings.json keeps the new personal model');
+  const dirty = statusPorcelain(w.claude).split('\n').filter(Boolean);
+  assert(dirty.length === 1 && /settings\.json$/.test(dirty[0]), 'only settings.json remains dirty (the personal delta)', statusPorcelain(w.claude));
+  assert(/Left uncommitted/.test(out) && /settings\.json \(model\)/.test(out), 'reports model left as personal', out);
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 3: --include-personal folds personal keys in -> clean tree');
+{
+  const w = setupHome((c) => {
+    writeJSON(join(c, 'settings.json'), { model: 'opus', permissions: { defaultMode: 'default' }, hooks: NEW_HOOKS });
+  });
+  const out = run(w, ['--include-personal']);
+  assert(headJSON(w.claude, 'settings.json').model === 'opus', 'committed the personal model under --include-personal', out);
+  assert(headJSON(w.claude, 'settings.json').hooks.SessionStart[0].hooks[0].command === 'node /new/boot-hook.mjs', 'committed the hooks too');
+  assert(statusPorcelain(w.claude) === '', 'tree clean with --include-personal', statusPorcelain(w.claude));
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 4: personal-only drift -> nothing committed, left for the user');
+{
+  const w = setupHome((c) => {
+    writeJSON(join(c, 'settings.json'), { model: 'opus', permissions: { defaultMode: 'default' }, hooks: OLD_HOOKS });
+  });
+  const headBefore = git(w.claude, 'rev-parse', 'HEAD').trim();
+  const out = run(w);
+  assert(/No deployed drift or new runtime paths to record/.test(out), 'reports nothing deployed to record', out);
+  assert(git(w.claude, 'rev-parse', 'HEAD').trim() === headBefore, 'no commit created for personal-only drift');
+  assert(JSON.parse(readFileSync(join(w.claude, 'settings.json'), 'utf8')).model === 'opus', 'personal model left in the working tree');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 5: dry run records nothing');
+{
+  const w = setupHome((c) => {
+    writeJSON(join(c, 'settings.json'), { model: 'sonnet', permissions: { defaultMode: 'default' }, hooks: NEW_HOOKS });
+  });
+  const headBefore = git(w.claude, 'rev-parse', 'HEAD').trim();
+  const out = run(w, ['--dry-run']);
+  assert(/\[DRY RUN\] Would record/.test(out), 'dry run reports intent', out);
+  assert(git(w.claude, 'rev-parse', 'HEAD').trim() === headBefore, 'dry run creates no commit');
+  assert(/ M settings\.json|settings\.json/.test(statusPorcelain(w.claude)), 'dry run leaves the tree unchanged (still dirty)');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 6: non-git home is reported, not crashed');
+{
+  const home = mkdtempSync(join(tmpdir(), 'ldm-commitdep-nogit-'));
+  const notRepo = join(home, 'plain');
+  mkdirSync(notRepo, { recursive: true });
+  const fakeBin = join(home, 'fakebin');
+  mkdirSync(fakeBin, { recursive: true });
+  for (const b of ['gh', 'npm', 'crontab']) { writeFileSync(join(fakeBin, b), '#!/bin/sh\nexit 0\n'); chmodSync(join(fakeBin, b), 0o755); }
+  let out = '';
+  try {
+    out = execFileSync('node', [cli, 'doctor', '--commit-deployed', '--home', notRepo], {
+      env: { ...process.env, HOME: home, PATH: `${fakeBin}:${process.env.PATH}`, LDM_SELF_UPDATED: '1' },
+      encoding: 'utf-8', timeout: 30000,
+    });
+  } catch (err) { out = (err.stdout || '') + (err.stderr || ''); }
+  assert(/Not a git work tree/.test(out), 'reports a non-git home cleanly', out);
+  rmSync(home, { recursive: true, force: true });
+}
+
+console.log('Test 7: pre-existing personal .gitignore edit is NOT swept into the deploy commit');
+{
+  const w = setupHome((c) => {
+    writeJSON(join(c, 'settings.json'), { model: 'sonnet', permissions: { defaultMode: 'default' }, hooks: NEW_HOOKS });
+    // User has an uncommitted personal .gitignore edit...
+    writeFileSync(join(c, '.gitignore'), 'projects/\ncache/\npersonal-local/\n');
+    // ...and there is a new transient path that forces a gitignore addition.
+    mkdirSync(join(c, 'plans'), { recursive: true });
+    writeFileSync(join(c, 'plans', 'session.json'), '{}\n');
+  });
+  const out = run(w);
+  const committedGitignore = git(w.claude, 'show', 'HEAD:.gitignore');
+  assert(committedGitignore.includes('plans/'), 'the new transient pattern was committed', out);
+  assert(!committedGitignore.includes('personal-local/'), 'the pre-existing personal .gitignore edit was NOT committed', committedGitignore);
+  assert(readFileSync(join(w.claude, '.gitignore'), 'utf8').includes('personal-local/'), 'personal .gitignore edit still present in working tree');
+  const dirty = statusPorcelain(w.claude).split('\n').filter(Boolean);
+  assert(dirty.length === 1 && /\.gitignore$/.test(dirty[0]), 'only .gitignore (the personal edit) remains dirty', statusPorcelain(w.claude));
+  assert(/\.gitignore \(your existing edits/.test(out), 'reports .gitignore personal edits left', out);
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 8: malformed settings.json is skipped, never deletes committed hooks');
+{
+  const w = setupHome((c) => {
+    writeFileSync(join(c, 'settings.json'), '{ this is not valid json\n'); // corrupt working file
+    writeFileSync(join(c, 'rules', 'base.md'), 'new rule\n');              // a legit deployed change
+  });
+  const headBefore = git(w.claude, 'rev-parse', 'HEAD').trim();
+  const out = run(w);
+  assert(/settings\.json skipped/.test(out) && /not valid JSON/.test(out), 'warns and skips malformed settings.json', out);
+  // The committed settings.json must still carry the original hooks (not deleted).
+  const committed = headJSON(w.claude, 'settings.json');
+  assert(committed.hooks && committed.hooks.SessionStart, 'committed settings.json still has its hooks (not clobbered)', JSON.stringify(committed));
+  assert(committed.hooks.SessionStart[0].hooks[0].command === 'node /old/boot-hook.mjs', 'hooks unchanged at HEAD (no deletion commit)');
+  // The legit deployed rules/ change still got recorded (skip is scoped to settings.json).
+  assert(git(w.claude, 'rev-parse', 'HEAD').trim() !== headBefore, 'a commit was still made for the deployed rules/ change');
+  assert(git(w.claude, 'show', 'HEAD:rules/base.md') === 'new rule\n', 'rules/ change committed despite settings.json skip');
+  assert(/settings\.json/.test(statusPorcelain(w.claude)), 'malformed settings.json left dirty for manual repair');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 9: a tracked file under a transient prefix is left, not falsely claimed clean');
+{
+  const w = setupHome((c) => {
+    // Commit a tracked file under a transient prefix in the baseline drift...
+    mkdirSync(join(c, 'plans'), { recursive: true });
+    writeFileSync(join(c, 'plans', 'tracked.md'), 'v1\n');
+    git(c, 'add', '--', 'plans/tracked.md');
+    git(c, 'commit', '-q', '-m', 'add tracked transient');
+    // ...then modify it (tracked-transient drift) plus a real deployed change.
+    writeFileSync(join(c, 'plans', 'tracked.md'), 'v2\n');
+    writeFileSync(join(c, 'rules', 'base.md'), 'new rule\n');
+  });
+  const out = run(w);
+  assert(git(w.claude, 'show', 'HEAD:rules/base.md') === 'new rule\n', 'deployed rules/ change committed', out);
+  assert(git(w.claude, 'show', 'HEAD:plans/tracked.md') === 'v1\n', 'tracked-transient file was NOT committed (still v1 at HEAD)');
+  assert(/tracked transient/.test(out), 'reports the tracked-transient file as left', out);
+  const dirty = statusPorcelain(w.claude).split('\n').filter(Boolean);
+  assert(dirty.length === 1 && /plans\/tracked\.md$/.test(dirty[0]), 'tracked-transient file remains dirty (honestly not claimed clean)', statusPorcelain(w.claude));
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 10: records even when a pre-commit hook blocks commits on main');
+{
+  const w = setupHome((c) => {
+    writeJSON(join(c, 'settings.json'), { model: 'sonnet', permissions: { defaultMode: 'default' }, hooks: NEW_HOOKS });
+    writeFileSync(join(c, 'rules', 'base.md'), 'new rule\n');
+  });
+  // Simulate the real machine: a pre-commit hook that hard-blocks `git commit`
+  // on main. The command lands its commit via plumbing, so it must still work.
+  const hook = join(w.hooksDir, 'pre-commit');
+  writeFileSync(hook, '#!/bin/sh\nif [ "$(git symbolic-ref --short HEAD)" = "main" ]; then echo "BLOCKED: no commits on main"; exit 1; fi\n');
+  chmodSync(hook, 0o755);
+  // Ensure the fixture is actually on main and the hook really blocks a plain commit.
+  execFileSync('git', ['-C', w.claude, 'branch', '-M', 'main'], { encoding: 'utf8' });
+  let blocked = false;
+  try { execFileSync('git', ['-C', w.claude, 'commit', '-q', '--allow-empty', '-m', 'probe'], { encoding: 'utf8' }); }
+  catch { blocked = true; }
+  assert(blocked, 'sanity: a plain git commit on main is blocked by the hook');
+
+  const out = run(w);
+  assert(git(w.claude, 'log', '-1', '--format=%s').includes('record installer-deployed config drift'), 'command still recorded the commit on main via plumbing', out);
+  assert(git(w.claude, 'show', 'HEAD:rules/base.md') === 'new rule\n', 'deployed change landed despite the blocking hook');
+  assert(statusPorcelain(w.claude) === '', 'tree clean after recording past the hook', statusPorcelain(w.claude));
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+if (failed > 0) {
+  console.log(`\n${failed} assertion(s) failed`);
+  process.exit(1);
+}
+console.log('\nAll doctor commit-deployed tests passed');

package/scripts/test-doctor-hook-dedupe.mjs

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+// Regression test: `ldm doctor` duplicate-hook + invalid-model checks.
+//
+// Covers the 2026-07-04 tickets:
+//   ai/product/bugs/installer/open-tickets/2026-07-04--cc-mini--installer-sessionstart-hook-duplicate-registration.md
+//   ai/product/bugs/guard/2026-07-04--cc-mini--no-blessed-recipe-for-live-settings-remediation.md
+//
+// Cases:
+//   1. Duplicate-laden settings: doctor reports, does NOT write without --fix.
+//   2. --fix collapses duplicates to 1, writes a timestamped backup first,
+//      preserves unrelated hooks and unknown keys.
+//   3. Invalid model value ("opus" + real ESC 0x1B + "[1m"): reported, removed under --fix.
+//   4. Malformed settings.json: warns and skips, file untouched, no crash.
+//
+// Follows the test-doctor-cron-target.mjs pattern: real bin/ldm.js doctor
+// against a temp HOME, crontab/npm shimmed on PATH so the operator's real
+// state is never read.
+
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+
+const repo = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const cli = join(repo, 'bin', 'ldm.js');
+const pkg = JSON.parse(readFileSync(join(repo, 'package.json'), 'utf8'));
+
+let failed = 0;
+function assert(cond, label, output = '') {
+  if (cond) {
+    console.log(`  [PASS] ${label}`);
+  } else {
+    console.log(`  [FAIL] ${label}`);
+    if (output) console.log(`         --- output (last lines) ---\n         ${output.trim().split('\n').slice(-25).join('\n         ')}`);
+    failed++;
+  }
+}
+
+function setupHome(settingsFactory) {
+  const home = mkdtempSync(join(tmpdir(), 'ldm-doctor-dedupe-'));
+  const ldmRoot = join(home, '.ldm');
+  const fakeBin = join(home, 'fakebin');
+  mkdirSync(join(ldmRoot, 'extensions'), { recursive: true });
+  mkdirSync(join(home, '.claude'), { recursive: true });
+  mkdirSync(fakeBin, { recursive: true });
+
+  writeFileSync(join(ldmRoot, 'version.json'), JSON.stringify({ version: pkg.version }, null, 2) + '\n');
+  writeFileSync(join(ldmRoot, 'extensions', 'registry.json'), JSON.stringify({ _format: 'v2', extensions: {} }, null, 2) + '\n');
+
+  // Hook scripts must exist on disk: doctor --fix runs the stale-path
+  // cleanup (#30) before the dedupe pass, and missing targets would be
+  // removed as stale instead of collapsed as duplicates.
+  const bootScript = join(ldmRoot, 'shared', 'boot', 'boot-hook.mjs');
+  const guardScript = join(ldmRoot, 'extensions', 'wip-branch-guard', 'guard.mjs');
+  const stopScript = join(ldmRoot, 'extensions', 'stop-hook.mjs');
+  for (const f of [bootScript, guardScript, stopScript]) {
+    mkdirSync(dirname(f), { recursive: true });
+    writeFileSync(f, 'process.exit(0);\n');
+  }
+
+  const paths = { bootScript, guardScript, stopScript };
+  const settingsContent = settingsFactory(paths);
+  const settingsPath = join(home, '.claude', 'settings.json');
+  writeFileSync(settingsPath, typeof settingsContent === 'string'
+    ? settingsContent
+    : JSON.stringify(settingsContent, null, 2) + '\n');
+
+  // Empty crontab + no-op npm on PATH (never touch operator state/network).
+  writeFileSync(join(fakeBin, 'crontab'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'crontab'), 0o755);
+  writeFileSync(join(fakeBin, 'npm'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'npm'), 0o755);
+
+  return { home, fakeBin, settingsPath, paths };
+}
+
+function runDoctor({ home, fakeBin }, fix = false) {
+  const args = ['doctor'];
+  if (fix) args.push('--fix');
+  try {
+    return execFileSync('node', [cli, ...args], {
+      env: { ...process.env, HOME: home, PATH: `${fakeBin}:${process.env.PATH}`, LDM_SELF_UPDATED: '1' },
+      encoding: 'utf-8',
+      timeout: 30000,
+    });
+  } catch (err) {
+    return (err.stdout || '') + (err.stderr || '');
+  }
+}
+
+const bootCmd = (paths) => `node ${paths.bootScript}`;
+const bootEntry = (paths) => ({ matcher: '*', hooks: [{ type: 'command', command: bootCmd(paths), timeout: 15 }] });
+const guardEntry = (paths) => ({ hooks: [{ type: 'command', command: `node ${paths.guardScript}`, timeout: 10 }] });
+
+function dupeLadenSettings(paths) {
+  return {
+    unknownTopLevelKey: { keep: 'me' },
+    permissions: { defaultMode: 'default' },
+    hooks: {
+      SessionStart: [
+        ...Array.from({ length: 5 }, () => bootEntry(paths)),
+        guardEntry(paths),
+        ...Array.from({ length: 5 }, () => bootEntry(paths)),
+      ],
+      Stop: [{ hooks: [{ type: 'command', command: `node ${paths.stopScript}` }] }],
+    },
+  };
+}
+
+console.log('Test 1: duplicates reported, no write without --fix');
+{
+  const w = setupHome(dupeLadenSettings);
+  const before = readFileSync(w.settingsPath, 'utf-8');
+  const out = runDoctor(w);
+  const after = readFileSync(w.settingsPath, 'utf-8');
+  assert(/SessionStart: 10 identical hook entries/.test(out), 'reports 10 identical SessionStart entries', out);
+  assert(/ldm doctor --fix to collapse 9 duplicate hook entries/.test(out), 'suggests --fix with count', out);
+  assert(before === after, 'settings.json untouched without --fix');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 2: --fix collapses, backs up first, preserves everything else');
+{
+  const w = setupHome(dupeLadenSettings);
+  const out = runDoctor(w, true);
+  const s = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  const bootCount = s.hooks.SessionStart.filter((e) => e.hooks?.[0]?.command === bootCmd(w.paths)).length;
+  const backups = readdirSync(join(w.home, '.claude')).filter((f) => f.startsWith('settings.json.bak-'));
+  assert(/Collapsed 9 duplicate hook entries/.test(out), 'reports 9 collapsed', out);
+  assert(bootCount === 1, `boot-hook entries collapsed to 1 (got ${bootCount})`);
+  assert(s.hooks.SessionStart.length === 2, 'boot hook + branch guard remain');
+  assert(s.hooks.Stop.length === 1, 'unrelated Stop hook preserved');
+  assert(s.unknownTopLevelKey?.keep === 'me', 'unknown top-level key preserved');
+  assert(backups.length === 1, `timestamped backup written (found ${backups.length})`);
+  if (backups.length === 1) {
+    const bak = JSON.parse(readFileSync(join(w.home, '.claude', backups[0]), 'utf-8'));
+    assert(bak.hooks.SessionStart.length === 11, 'backup holds the pre-fix state');
+  }
+  const again = runDoctor(w, true);
+  assert(!/Collapsed/.test(again), 'second --fix run finds nothing to collapse', again);
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 3: invalid model value reported and removed under --fix');
+{
+  // The corruption fixture carries a REAL ESC control char (0x1B): "opus"
+  // plus an ANSI bold fragment, which is what a terminal paste persists.
+  // Printable brackets alone are NOT corruption (see Test 4).
+  const w = setupHome((paths) => ({ model: 'opus\x1b[1m', hooks: { SessionStart: [bootEntry(paths)] } }));
+  const out = runDoctor(w);
+  assert(/model value is invalid/.test(out), 'reports invalid model', out);
+  const before = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  assert(typeof before.model === 'string', 'model untouched without --fix');
+  const fixOut = runDoctor(w, true);
+  const s = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  assert(/Removed invalid model value/.test(fixOut), 'reports removal under --fix', fixOut);
+  assert(!('model' in s), 'model key removed from disk');
+  assert(s.hooks.SessionStart.length === 1, 'hooks untouched by model fix');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 4: valid model values are left alone (including bracketed 1M-context IDs)');
+{
+  const w = setupHome(() => ({ model: 'claude-fable-5[1m]', hooks: {} }));
+  const out = runDoctor(w, true);
+  const s = JSON.parse(readFileSync(w.settingsPath, 'utf-8'));
+  assert(!/model value is invalid/.test(out), 'no invalid-model report for bracketed 1M id', out);
+  assert(s.model === 'claude-fable-5[1m]', 'legitimate 1M-context model preserved');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 5: malformed settings.json warns, skips, file untouched');
+{
+  const w = setupHome(() => '{ this is not json\n');
+  const before = readFileSync(w.settingsPath, 'utf-8');
+  const out = runDoctor(w, true);
+  const after = readFileSync(w.settingsPath, 'utf-8');
+  assert(/not valid JSON; skipping hook\/model checks/.test(out), 'warns about malformed JSON', out);
+  assert(before === after, 'malformed file untouched');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+if (failed > 0) {
+  console.log(`\n${failed} assertion(s) failed`);
+  process.exit(1);
+}
+console.log('\nAll doctor hook-dedupe tests passed');

package/scripts/test-install-prompt-policy.mjs

@@ -0,0 +1,84 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = fileURLToPath(new URL("..", import.meta.url));
+
+const files = [
+  "README.md",
+  "SKILL.md",
+  "shared/templates/install-prompt.md",
+];
+
+const contents = Object.fromEntries(
+  files.map((file) => [file, readFileSync(join(repoRoot, file), "utf8")]),
+);
+
+const failures = [];
+
+for (const file of ["README.md", "shared/templates/install-prompt.md"]) {
+  const text = contents[file];
+  for (const phrase of [
+    "Use the install document and live local checks as the source of truth.",
+    "Do not search memory or prior notes for this install. Do not pre-load context from `MEMORY.md`, `crystal_search`, local skill dev guides, or other local memory before fetching the install document.",
+    "Do not run GitHub commands during this install flow. Do not run or request approval for `gh release`, `gh api`, or `gh search`.",
+    "If release notes are not available from local or npm metadata, say that and do not fetch them from GitHub.",
+    "If installed: run `ldm status`",
+    "check available npm tracks from the install document",
+    "If yes to dry run, use the selected track's dry-run path from the install document.",
+    "If I say install, use the selected track's install path from the install document, then run `ldm doctor`.",
+    "install the CLI first using the selected track's bootstrap command from the install document",
+    "Then run:\n`ldm init --dry-run`",
+    "If I say install, run:\n`ldm init`",
+  ]) {
+    if (!text.includes(phrase)) {
+      failures.push(`${file} missing install prompt phrase: ${phrase}`);
+    }
+  }
+  if (text.includes("If it is, run ldm install --dry-run")) {
+    failures.push(`${file} still tells installed users to start with ldm install --dry-run`);
+  }
+}
+
+const skill = contents["SKILL.md"];
+for (const phrase of [
+  "Memory policy for install flows: do not consult `MEMORY.md`, do not run `crystal_search`, and do not search prior notes when this skill is invoked, including in any parallel or batched exploration step.",
+  "The only context sources for this install flow are `https://wip.computer/install/wip-ldm-os.txt` and the live local commands that document prescribes.",
+  "Read that document and run those commands. Do not pre-load other context.",
+  "Do not run GitHub commands during the install-state flow.",
+  "Do not run or request approval for `gh release list`, `gh release view`, `gh api repos/*`, `gh search`, or any other GitHub query unless the user explicitly asks for release notes.",
+  "npm view @wipcomputer/wip-ldm-os dist-tags --json",
+  "The README prompt should stay short. This install document owns the detailed track rules.",
+  "stable/current/latest: `ldm install --dry-run`",
+  "beta/latest beta: `ldm install --beta --dry-run`",
+  "alpha/latest alpha: `ldm install --alpha --dry-run`",
+  "beta/latest beta: `npm install -g @wipcomputer/wip-ldm-os@beta`",
+  "alpha/latest alpha: `npm install -g @wipcomputer/wip-ldm-os@alpha`",
+  "Use the output of `ldm status`, installed package metadata, and npm metadata.",
+  "Do not use GitHub commands here.",
+  "If npm metadata for a package does not include release notes:",
+  "Say \"release notes not available from local metadata.\"",
+  "Do not infer release-note content from package descriptions, commit messages, or repo READMEs.",
+  "An approval dialog is not a user request.",
+]) {
+  if (!skill.includes(phrase)) {
+    failures.push(`SKILL.md missing install policy phrase: ${phrase}`);
+  }
+}
+
+if (/gh release (list|view) --repo/.test(skill)) {
+  failures.push("SKILL.md still includes concrete gh release commands in the install flow");
+}
+
+const temporalMemoryPolicyPhrase = "your first action is " + "to fetch";
+if (skill.includes(temporalMemoryPolicyPhrase)) {
+  failures.push("SKILL.md still uses temporal first-action memory-policy phrasing");
+}
+
+if (failures.length > 0) {
+  console.error("install prompt policy checks failed:");
+  for (const failure of failures) console.error(`  - ${failure}`);
+  process.exit(1);
+}
+
+console.log("install-prompt-policy: LDM OS prompt and install doc agree");