wkappbot-code 0.0.0-stage → 0.3.1

package/lib/config.js

@@ -0,0 +1,122 @@
+// config.js -- the minimum opencode config for wkappbot-code (owner 2026-11-06: detect the needed items, let the user
+// edit them, then generate). Four items only: provider and model (from which API-key env var is PRESENT, or an
+// existing `opencode auth` login -- values are never read or printed), the wisdom-kernel plugin URL, the harness dir.
+// The file is MERGED: a backup first, every user key kept in place, no secret written (providers read env vars).
+// Spec: wkappbot skill read agent-harness-landscape-2026-howto
+import { existsSync, readFileSync, readSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export const KEYS = ["provider", "model", "plugin", "harness"];
+// env var -> opencode provider id -> default model ("provider/model", editable with --set model=...)
+export const PROVIDERS = [
+  ["ANTHROPIC_API_KEY", "anthropic", "anthropic/claude-sonnet-5-5"],
+  ["OPENAI_API_KEY", "openai", "openai/gpt-5"],
+  ["GEMINI_API_KEY", "google", "google/gemini-2.5-pro"],
+  ["GROQ_API_KEY", "groq", "groq/llama-3.3-70b-versatile"],
+  ["OPENROUTER_API_KEY", "openrouter", "openrouter/anthropic/claude-sonnet-4.5"],
+];
+const defaultModel = (prov) => { const d = PROVIDERS.find((p) => p[1] === prov); return d ? d[2] : prov + "/default"; };
+
+// Provider ids of an existing `opencode auth login` (key names only).
+export function authProviders(env = process.env) {
+  const p = join(env.XDG_DATA_HOME || join(homedir(), ".local", "share"), "opencode", "auth.json");
+  try { return Object.keys(JSON.parse(readFileSync(p, "utf8")) || {}); } catch { return []; }
+}
+
+// Detect the four items. user = the existing config object ({} when none).
+export function detect({ env = process.env, user = {}, pluginUrl = "", kih = "", kihSource = "kih checkout" } = {}) {
+  const it = {};
+  if (user && user.model) it.model = { value: String(user.model), source: "existing config" };
+  else {
+    const hit = PROVIDERS.find(([k]) => env[k]);
+    if (hit) it.model = { value: hit[2], source: "env " + hit[0] + " present" };
+    else {
+      const a = authProviders(env)[0];
+      if (a) it.model = { value: defaultModel(a), source: "opencode auth login (" + a + ")" };
+    }
+  }
+  if (it.model) it.provider = { value: it.model.value.split("/")[0], source: it.model.source };
+  if (pluginUrl) it.plugin = { value: pluginUrl, source: "installed package" };
+  if (kih) it.harness = { value: kih, source: kihSource };
+  return it;
+}
+
+export function printDetected(it, log) {
+  for (const k of KEYS) log(it[k] ? "detected " + k + " = " + it[k].value + " (" + it[k].source + ")" : "missing " + k);
+}
+
+// Keep provider and model consistent after an override.
+function reconcile(it, changed) {
+  if (changed === "model" && it.model) it.provider = { value: it.model.value.split("/")[0], source: it.model.source, forced: true };
+  if (changed === "provider" && it.provider && (!it.model || it.model.value.split("/")[0] !== it.provider.value))
+    it.model = { value: defaultModel(it.provider.value), source: it.provider.source, forced: true };
+}
+
+// --set key=value overrides (provider|model|plugin|harness). Returns the unknown keys.
+export function applySets(it, sets) {
+  const bad = [];
+  for (const s of sets) {
+    const i = s.indexOf("=");
+    const k = i > 0 ? s.slice(0, i) : s;
+    if (!KEYS.includes(k)) { bad.push(k); continue; }
+    it[k] = { value: s.slice(i + 1), source: "--set", forced: true };
+    reconcile(it, k);
+  }
+  return bad;
+}
+
+function readLineSync() {
+  const b = Buffer.alloc(1);
+  let s = "";
+  for (;;) {
+    let n = 0;
+    try { n = readSync(0, b, 0, 1, null); } catch (e) { if (e.code === "EAGAIN") continue; break; }
+    if (n === 0) break;
+    const c = b.toString("utf8");
+    if (c === "\n") break;
+    s += c;
+  }
+  return s.replace(/\r$/, "");
+}
+
+// At a TTY: one question per item; Enter keeps the detected value.
+export function askEach(it, out = process.stdout) {
+  for (const k of KEYS) {
+    out.write(k + " [" + (it[k] ? it[k].value : "none") + "]: ");
+    const a = readLineSync().trim();
+    if (a) { it[k] = { value: a, source: "typed", forced: true }; reconcile(it, k); }
+  }
+}
+
+// Merge the items into the user's config: user keys stay where they are; the wisdom-kernel plugin entry is replaced;
+// the template's provider/permission are added only where the user has none; model only when absent or overridden.
+export function buildConfig(user, it, template) {
+  const out = { ...user };
+  if (!out.$schema && template.$schema) out.$schema = template.$schema;
+  const ours = [it.plugin ? it.plugin.value : "", { kihDir: it.harness ? it.harness.value : "" }];
+  const keep = (Array.isArray(user.plugin) ? user.plugin : []).filter((p) => !String(Array.isArray(p) ? p[0] : p).includes("wisdom-kernel"));
+  out.plugin = [...keep, ours];
+  if (!out.provider) out.provider = template.provider;
+  else if (template.provider) for (const [k, v] of Object.entries(template.provider)) if (!(k in out.provider)) out.provider[k] = v;
+  if (!out.permission) out.permission = template.permission;
+  if (it.model && (it.model.forced || !user.model)) out.model = it.model.value;
+  return out;
+}
+
+// A small line diff for the printout: removed lines first, then added lines.
+export function lineDiff(before, after) {
+  const A = before.split("\n"), B = after.split("\n");
+  const sa = new Set(A), sb = new Set(B);
+  return [...A.filter((l) => l && !sb.has(l)).map((l) => "- " + l), ...B.filter((l) => l && !sa.has(l)).map((l) => "+ " + l)];
+}
+
+// The doctor row for an opencode.json path: { ok, detail }.
+export function configRow(target) {
+  let c = null;
+  try { c = JSON.parse(readFileSync(target, "utf8")); } catch { return { ok: false, detail: existsSync(target) ? target + " is not plain JSON" : "missing " + target }; }
+  const wired = (c.plugin || []).some((p) => String(Array.isArray(p) ? p[0] : p).includes("wisdom-kernel"));
+  const model = c.model ? String(c.model) : "";
+  if (model && wired) return { ok: true, detail: "provider " + model.split("/")[0] + ", model " + model + ", plugin wired" };
+  return { ok: false, detail: [model ? "" : "missing model", wired ? "" : "plugin not wired"].filter(Boolean).join(", ") + " in " + target };
+}

package/lib/update.js

@@ -0,0 +1,127 @@
+// update.js -- wkappbot-code self-update (owner 2026-11-06: an auto-update in the launcher, with QA).
+// Remote: <base>/version.json = {"name":"wkappbot-code","version":"X.Y.Z","tgz":"wkappbot-code.tgz","sha256":"<64 hex>"}
+// as the SDK Pages workflow publishes it; "tgz" (or "url"/"file") is resolved relative to version.json, and a missing
+// sha256 is read from SHA256SUMS beside it. WKAPPBOT_CODE_UPDATE_URL overrides the address (tests);
+// WKAPPBOT_CODE_NO_UPDATE_CHECK=1 turns the quiet check off. Spec: wkappbot skill read agent-harness-landscape-2026-howto
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+
+export const DEFAULT_UPDATE_URL = "https://kiexpert.github.io/wkappbot-kih/wkappbot-code/version.json";
+export const updateUrl = () => process.env.WKAPPBOT_CODE_UPDATE_URL || DEFAULT_UPDATE_URL;
+export const stampPath = () => join(homedir(), ".wkappbot-code", "last-update-check");
+const DAY_MS = 24 * 3600 * 1000;
+
+// -1 / 0 / 1 on the first three numeric parts ("0.3.10" > "0.3.9").
+export function cmpVer(a, b) {
+  const p = (v) => String(v || "").replace(/^v/, "").split(/[.+-]/).slice(0, 3).map((n) => parseInt(n, 10) || 0);
+  const x = p(a), y = p(b);
+  for (let i = 0; i < 3; i++) if ((x[i] || 0) !== (y[i] || 0)) return (x[i] || 0) > (y[i] || 0) ? 1 : -1;
+  return 0;
+}
+
+function curl(url, out, secs) {
+  const r = spawnSync("curl", ["-fsSL", "-m", String(secs), url, "-o", out], { encoding: "utf8" });
+  return r.status === 0 ? "" : "curl " + url + " rc " + r.status + (r.stderr ? " " + r.stderr.trim() : "");
+}
+const rel = (base, p) => { try { return new URL(p, base).href; } catch { return p; } };
+
+// Read the remote version.json: { ok, version, sha256, tgzUrl } or { ok: false, err }.
+export function readRemote(secs = 20) {
+  const url = updateUrl();
+  const tmp = mkdtempSync(join(tmpdir(), "wkappbot-code-upd-"));
+  try {
+    const err = curl(url, join(tmp, "v.json"), secs);
+    if (err) return { ok: false, err };
+    let v = null;
+    try { v = JSON.parse(readFileSync(join(tmp, "v.json"), "utf8")); } catch { return { ok: false, err: "version.json is not JSON" }; }
+    if (!v || !v.version) return { ok: false, err: "version.json has no version" };
+    // A page for another package (or an unnamed one) is never an update: no downgrade, no cross-install.
+    if (!["wkappbot-code", "wk-appbot-code"].includes(String(v.name || ""))) return { ok: false, foreign: true, err: "version.json names package " + JSON.stringify(v.name || "") + ", not wkappbot-code" };
+    const tgzUrl = rel(url, v.url || v.tgz || v.file || "wkappbot-code.tgz");
+    let sha = String(v.sha256 || "").toLowerCase();
+    if (!/^[0-9a-f]{64}$/.test(sha) && !curl(rel(url, "SHA256SUMS"), join(tmp, "sums"), secs)) {
+      const name = tgzUrl.split("/").pop();
+      for (const l of readFileSync(join(tmp, "sums"), "utf8").split("\n")) {
+        const m = /^([0-9a-f]{64})\s+\*?(\S+)$/i.exec(l.trim());
+        if (m && m[2].split("/").pop() === name) sha = m[1].toLowerCase();
+      }
+    }
+    return { ok: true, version: String(v.version), sha256: sha, tgzUrl, source: "pages" };
+  } finally { rmSync(tmp, { recursive: true, force: true }); }
+}
+
+// The second source (owner 2026-11-06: NPM_TOKEN added, the SDK publishes to the registry): npm view, silent offline.
+// WKAPPBOT_CODE_NO_REGISTRY=1 skips it (tests).
+export function readRegistry(secs = 15) {
+  if (process.env.WKAPPBOT_CODE_NO_REGISTRY === "1") return { ok: false, err: "registry check off" };
+  const r = spawnSync("npm", ["view", "wkappbot-code", "version"], { encoding: "utf8", timeout: secs * 1000 });
+  const v = (r.stdout || "").trim().split("\n").pop();
+  return r.status === 0 && /^\d+\.\d+\.\d+/.test(v) ? { ok: true, version: v, source: "registry" } : { ok: false, err: "npm view rc " + r.status };
+}
+const readAny = (secs) => { const p = readRemote(secs); if (p.ok || p.foreign) return p; const g = readRegistry(secs); return g.ok ? g : p; };
+
+// `wkappbot-code update`: a newer remote is downloaded, sha256-checked, installed with npm i -g, then the NEW CLI
+// re-runs `install --update` (core, harness, public skills). A sha mismatch changes nothing. Returns the exit code.
+export function runUpdate({ current, cliPath, installArgs = [], log = console.log }) {
+  const r = readAny(30);
+  if (r.foreign) { log("PASS update: no update (" + r.err + ")"); return 0; }
+  if (!r.ok) { log("FAIL update: cannot read " + updateUrl() + " -- " + r.err + " (registry: none)"); return 1; }
+  if (cmpVer(r.version, current) <= 0) { log("PASS update: up to date (installed " + current + ", latest " + r.version + " from " + r.source + ")"); return 0; }
+  if (r.source === "registry") {
+    // npm verifies the registry tarball's own integrity hash.
+    log("PASS update: " + r.version + " available (installed " + current + ") on the npm registry");
+    const g = spawnSync("npm", ["install", "-g", "wkappbot-code@" + r.version, "--no-audit", "--no-fund", "--silent"], { encoding: "utf8" });
+    if (g.status !== 0) { log("FAIL update: npm install -g wkappbot-code@" + r.version + " rc " + g.status); return 1; }
+    log("PASS update: npm install -g wkappbot-code " + r.version);
+    return reinstall(cliPath, installArgs, log);
+  }
+  log("PASS update: " + r.version + " available (installed " + current + ") at " + r.tgzUrl);
+  if (!/^[0-9a-f]{64}$/.test(r.sha256)) { log("FAIL update: no sha256 published for " + r.version + "; nothing changed"); return 1; }
+  const tmp = mkdtempSync(join(tmpdir(), "wkappbot-code-upd-"));
+  try {
+    const tgz = join(tmp, "wkappbot-code-" + r.version + ".tgz");
+    const err = curl(r.tgzUrl, tgz, 300);
+    if (err) { log("FAIL update: download -- " + err + "; nothing changed"); return 1; }
+    const got = createHash("sha256").update(readFileSync(tgz)).digest("hex");
+    if (got !== r.sha256) { log("FAIL update: sha256 MISMATCH (expected " + r.sha256 + ", got " + got + "); nothing changed"); return 1; }
+    log("PASS update: sha256 ok " + got);
+    const n = spawnSync("npm", ["install", "-g", tgz, "--no-audit", "--no-fund", "--silent"], { encoding: "utf8" });
+    if (n.status !== 0) { log("FAIL update: npm install -g rc " + n.status + " " + (n.stderr || "").trim()); return 1; }
+    log("PASS update: npm install -g wkappbot-code " + r.version);
+  } finally { rmSync(tmp, { recursive: true, force: true }); }
+  return reinstall(cliPath, installArgs, log);
+}
+
+// The NEW CLI (npm's bin link now points at it) refreshes the core, the harness and the public skills.
+function reinstall(cliPath, installArgs, log) {
+  const i = spawnSync(process.execPath, [cliPath, "install", "--update", ...installArgs],
+    { stdio: "inherit", env: { ...process.env, WKAPPBOT_CODE_NO_UPDATE_CHECK: "1" } });
+  log((i.status === 0 ? "PASS" : "FAIL") + " update: install --update rc " + i.status);
+  return i.status === 0 ? 0 : 1;
+}
+
+// The quiet check every other subcommand runs: at most once per 24 h (stamp written first), silent on any failure.
+// Returns the newer remote version, else "".
+export function quietCheck(current, log = console.log) {
+  if (process.env.WKAPPBOT_CODE_NO_UPDATE_CHECK === "1") return "";
+  const sp = stampPath();
+  try { if (Date.now() - statSync(sp).mtimeMs < DAY_MS) return ""; } catch {}
+  try { mkdirSync(dirname(sp), { recursive: true }); writeFileSync(sp, new Date().toISOString() + "\n"); } catch {}
+  let r = null;
+  try { r = readAny(5); } catch { return ""; }
+  if (!r || !r.ok || cmpVer(r.version, current) <= 0) return "";
+  log("wkappbot-code " + r.version + " available -- run wkappbot-code update");
+  return r.version;
+}
+
+// The doctor row: { ok, skip, detail } -- PASS when current is the latest (or newer), WARN when older, SKIP offline.
+export function updateRow(current) {
+  if (process.env.WKAPPBOT_CODE_NO_UPDATE_CHECK === "1") return { skip: true, detail: "current " + current + " (check off: WKAPPBOT_CODE_NO_UPDATE_CHECK=1)" };
+  let r = null;
+  try { r = readAny(10); } catch (e) { r = { ok: false, err: String(e) }; }
+  if (!r.ok) return { skip: true, detail: "current " + current + " / latest ? (offline: " + r.err + ")" };
+  return { ok: cmpVer(current, r.version) >= 0, detail: "current " + current + " / latest " + r.version + " (" + r.source + ")" };
+}

package/lib/wk-bin-acquire.sh

@@ -0,0 +1,305 @@
+#!/usr/bin/env bash
+# wk-bin-acquire -- acquire, install and publish the wkappbot binary for every platform.
+#
+# Usage:
+#   wk-bin-acquire.sh acquire [--dest PATH] [--dry-run] [--offline]
+#     Platform from uname: linux-x64, osx-arm64, osx-x64, win-x64. Unix: PATH is the binary file.
+#     Source 1 (unless --offline): SDK latest release asset wkappbot-PLATFORM, accepted only when its
+#     sha256 matches its SHA256SUMS line. Source 2: REPO/bin/PLATFORM/wkappbot, accepted only when
+#     its sha256 matches the MANIFEST.md row. Windows: PATH is a directory that receives
+#     wkappbot.exe and wkappbot-core.exe (xz -dc of bin/win-x64/wkappbot-core.exe.xz), from bin/ only.
+#     Copies, never links; writes via a .new temp then mv; "up to date" when the sha already matches.
+#   wk-bin-acquire.sh publish SRC [--platform P] [--dry-run]
+#     Stores SRC in REPO/bin/P/ (a Windows core .exe as wkappbot-core.exe.xz, xz -9e -T0), rewrites
+#     its MANIFEST.md row, commits the two paths with mode 100755 (non-Windows), then pushes.
+#
+# Env: WK_BIN_NO_PUSH=1 skips the push; WKAPPBOT_DIR locates bin/wkpush.sh;
+#      WKAPPBOT_HOME selects the Windows install directory; WK_BIN_BASE replaces the SDK release download
+#      base (a selftest points it at a file:// mock).
+# Outside a git checkout (the copy shipped in the wkappbot-code npm package, wkappbot-code/lib/) REPO is
+# empty: acquire then takes only the verified SDK asset, and the repo fallback refuses with a clear line.
+set -euo pipefail
+
+WK_DRY=0
+WK_TMP=""
+SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="$(git -C "$SELF_DIR" rev-parse --show-toplevel 2>/dev/null || true)"
+
+die() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "die" || true
+  echo "wk-bin-acquire: $*" >&2
+  exit 1
+}
+
+note() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "note" || true
+  echo "wk-bin-acquire: $*" >&2
+}
+
+run() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "run" || true
+  if [ "$WK_DRY" = 1 ]; then
+    echo "DRY: $*"
+  else
+    "$@"
+  fi
+}
+
+sha_of() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "sha_of" || true
+  [ -f "$1" ] || return 1
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | cut -d' ' -f1
+  else
+    shasum -a 256 "$1" | cut -d' ' -f1
+  fi
+}
+
+platform_detect() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "platform_detect" || true
+  local s m
+  s="$(uname -s)"
+  m="$(uname -m)"
+  case "$s" in
+    Linux)
+      if [ "$m" = x86_64 ]; then echo linux-x64; else die "unsupported Linux arch: $m"; fi ;;
+    Darwin)
+      case "$m" in
+        arm64) echo osx-arm64 ;;
+        x86_64) echo osx-x64 ;;
+        *) die "unsupported macOS arch: $m" ;;
+      esac ;;
+    MINGW*|MSYS*|CYGWIN*) echo win-x64 ;;
+    *) die "unsupported OS: $s" ;;
+  esac
+}
+
+# manifest_field REL COL -- COL 3 platform, 4 version, 6 sha256 of the bin/MANIFEST.md row for REL.
+manifest_field() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "manifest_field" || true
+  awk -F'|' -v p="$1" -v c="$2" '
+    { x = $2; gsub(/^[ \t]+|[ \t]+$/, "", x)
+      if (x == p) { y = $c; gsub(/^[ \t]+|[ \t]+$/, "", y); print y; exit } }' "$REPO/bin/MANIFEST.md"
+}
+
+default_dest_unix() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "default_dest_unix" || true
+  if [ -w /opt/wkappbot ] || { [ ! -e /opt/wkappbot ] && [ -w /opt ]; }; then
+    echo /opt/wkappbot/wkappbot
+  else
+    echo "$HOME/.local/opt/wkappbot/wkappbot"
+  fi
+}
+
+default_dest_win() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "default_dest_win" || true
+  if [ -n "${WKAPPBOT_HOME:-}" ]; then
+    echo "$WKAPPBOT_HOME/bin"
+  else
+    echo "$HOME/wkappbot/bin"
+  fi
+}
+
+# sdk_fetch PLAT DIR -- prints the verified asset path, or returns 1 and prints nothing.
+sdk_fetch() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "sdk_fetch" || true
+  local plat="$1" dir="$2" asset base want got
+  asset="wkappbot-$plat"
+  base="${WK_BIN_BASE:-https://github.com/kiexpert/wkappbot-sdk/releases/latest/download}"
+  curl -fsSL -m 120 "$base/$asset" -o "$dir/$asset" || return 1
+  curl -fsSL -m 120 "$base/SHA256SUMS" -o "$dir/SHA256SUMS" || return 1
+  want="$(awk -v f="$asset" '{ n = $2; sub(/^\*/, "", n); if (n == f) { print $1; exit } }' "$dir/SHA256SUMS")"
+  [ -n "$want" ] || return 1
+  got="$(sha_of "$dir/$asset" || true)"
+  [ "$got" = "$want" ] || return 1
+  echo "$dir/$asset"
+}
+
+# repo_file REL -- prints REPO/bin/REL when its sha256 matches the MANIFEST row, else dies.
+repo_file() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "repo_file" || true
+  local rel="$1" want got
+  [ -n "$REPO" ] || die "no verified SDK asset and no repo copy of bin/$rel (this copy is not inside a kih checkout)"
+  want="$(manifest_field "$rel" 6 || true)"
+  [ -n "$want" ] || die "no MANIFEST row for bin/$rel"
+  got="$(sha_of "$REPO/bin/$rel" || true)"
+  [ -n "$got" ] || die "missing bin/$rel"
+  [ "$got" = "$want" ] || die "sha256 mismatch for bin/$rel: MANIFEST $want, file $got"
+  echo "$REPO/bin/$rel"
+}
+
+# install_file SRC DEST LABEL -- copy via .new then mv; "up to date" when DEST already matches.
+install_file() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "install_file" || true
+  local src="$1" dest="$2" label="$3" sum verb="installed"
+  sum="$(sha_of "$src")"
+  if [ -f "$dest" ] && [ "$(sha_of "$dest" || true)" = "$sum" ]; then
+    echo "up to date: $dest (source: $label) sha256=$sum"
+    return 0
+  fi
+  if [ "$WK_DRY" = 1 ]; then verb="would install"; fi
+  run mkdir -p "$(dirname "$dest")"
+  run cp "$src" "$dest.new"
+  run chmod +x "$dest.new"
+  run mv -f "$dest.new" "$dest"
+  echo "$verb: $dest (source: $label) sha256=$sum"
+}
+
+acquire_unix() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "acquire_unix" || true
+  local dest="$1" plat="$2" offline="$3" src label
+  [ -n "$dest" ] || dest="$(default_dest_unix)"
+  if [ "$offline" = 0 ] && src="$(sdk_fetch "$plat" "$WK_TMP")"; then
+    label="SDK release wkappbot-$plat"
+  else
+    if [ "$offline" = 0 ]; then note "SDK asset unavailable or unverified, using repo bin/$plat"; fi
+    src="$(repo_file "$plat/wkappbot")"
+    label="repo bin/$plat/wkappbot"
+  fi
+  install_file "$src" "$dest" "$label"
+}
+
+acquire_win() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "acquire_win" || true
+  local dest="$1" exe xzsrc core
+  [ -n "$dest" ] || dest="$(default_dest_win)"
+  note "win-x64 installs from bin/ only: the two-file set has no single SDK asset"
+  exe="$(repo_file "win-x64/wkappbot.exe")"
+  xzsrc="$(repo_file "win-x64/wkappbot-core.exe.xz")"
+  core="$WK_TMP/wkappbot-core.exe"
+  xz -dc "$xzsrc" > "$core"
+  install_file "$exe" "$dest/wkappbot.exe" "repo bin/win-x64/wkappbot.exe"
+  install_file "$core" "$dest/wkappbot-core.exe" "repo bin/win-x64/wkappbot-core.exe.xz"
+}
+
+acquire() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "acquire" || true
+  local dest="" offline=0 plat
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --dest) dest="${2:-}"; [ -n "$dest" ] || die "--dest needs a path"; shift 2 ;;
+      --dry-run) WK_DRY=1; shift ;;
+      --offline) offline=1; shift ;;
+      *) die "acquire: unknown argument: $1" ;;
+    esac
+  done
+  plat="$(platform_detect)"
+  if [ "$plat" = win-x64 ]; then
+    acquire_win "$dest"
+  else
+    acquire_unix "$dest" "$plat" "$offline"
+  fi
+}
+
+# rewrite_manifest REL ROW -- replaces REL's row, or appends ROW after the last table row.
+rewrite_manifest() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "rewrite_manifest" || true
+  local rel="$1" row="$2" m="$REPO/bin/MANIFEST.md"
+  if [ "$WK_DRY" = 1 ]; then
+    echo "DRY: set bin/MANIFEST.md row: $row"
+    return 0
+  fi
+  [ -f "$m" ] || die "no $m"
+  grep -q '^|' "$m" || die "no table in $m"
+  awk -v p="$rel" -v nr="$row" '
+    function rowpath(s,   a, x) { split(s, a, "|"); x = a[2]; gsub(/^[ \t]+|[ \t]+$/, "", x); return x }
+    { L[NR] = $0
+      if ($0 ~ /^\|/) { last = NR; if (rowpath($0) == p) hit = NR } }
+    END {
+      for (i = 1; i <= NR; i++) {
+        if (i == hit) print nr; else print L[i]
+        if (hit == "" && i == last) print nr
+      }
+    }' "$m" > "$m.new"
+  mv -f "$m.new" "$m"
+}
+
+# push_bin GPATH -- pushes the two committed paths; skipped with WK_BIN_NO_PUSH=1.
+push_bin() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "push_bin" || true
+  local gpath="$1" wkp="${WKAPPBOT_DIR:-$(dirname "$REPO")/WKAppBot}/bin/wkpush.sh"
+  if [ "${WK_BIN_NO_PUSH:-0}" = 1 ]; then
+    echo "push skipped: WK_BIN_NO_PUSH=1"
+    return 0
+  fi
+  if [ -f "$wkp" ]; then
+    run bash "$wkp" -C "$REPO" -m "$gpath" bin/MANIFEST.md
+  else
+    run git -C "$REPO" push origin HEAD:main
+  fi
+}
+
+publish() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "publish" || true
+  local src plat="" base rel gpath mode="copy" stored sha bytes v="" ver desc newrow dest msg
+  src="${1:-}"
+  [ -n "$src" ] || die "publish: SRC required"
+  shift
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --platform) plat="${2:-}"; [ -n "$plat" ] || die "--platform needs a value"; shift 2 ;;
+      --dry-run) WK_DRY=1; shift ;;
+      *) die "publish: unknown argument: $1" ;;
+    esac
+  done
+  [ -n "$plat" ] || plat="$(platform_detect)"
+  [ -f "$src" ] || die "publish: no such file: $src"
+  base="$(basename "$src")"
+  rel="$plat/$base"
+  if [ "$plat" = win-x64 ]; then
+    case "$base" in
+      *core*.exe) rel="$plat/wkappbot-core.exe.xz"; mode="xz" ;;
+    esac
+  fi
+  gpath="bin/$rel"
+  # Scratch copy only: the repo is touched by run() lines alone, so --dry-run changes nothing.
+  stored="$WK_TMP/stored"
+  if [ "$mode" = xz ]; then xz -9e -T0 -c "$src" > "$stored"; else cp "$src" "$stored"; fi
+  sha="$(sha_of "$stored")"
+  bytes="$(wc -c < "$stored" | tr -d ' ')"
+  # A Windows core is never executed here; every other SRC reports its own version line.
+  if [ "$mode" = copy ]; then
+    v="$("$src" --version 2>/dev/null | head -n 1 || true)"
+  fi
+  if [ -n "$v" ]; then v="${v#wkappbot }"; v="${v//|/}"; fi
+  ver="$(manifest_field "$rel" 4 || true)"
+  if [ -n "$v" ]; then ver="$v"; fi
+  [ -n "$ver" ] || ver="unknown"
+  desc="$(manifest_field "$rel" 3 || true)"
+  [ -n "$desc" ] || desc="$plat"
+  newrow="| $rel | $desc | $ver | $bytes | $sha |"
+  dest="$REPO/$gpath"
+  run mkdir -p "$(dirname "$dest")"
+  run cp "$stored" "$dest"
+  if [ "$plat" != win-x64 ]; then run chmod 755 "$dest"; fi
+  rewrite_manifest "$rel" "$newrow"
+  msg="bin: publish $plat binary ${sha:0:12}"
+  run git -C "$REPO" add -- "$gpath" bin/MANIFEST.md
+  if [ "$plat" != win-x64 ]; then run git -C "$REPO" update-index --chmod=+x -- "$gpath"; fi
+  run git -C "$REPO" commit -m "$msg" -- "$gpath" bin/MANIFEST.md
+  push_bin "$gpath"
+}
+
+usage() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "usage" || true
+  cat <<'EOF'
+usage: wk-bin-acquire.sh acquire [--dest PATH] [--dry-run] [--offline]
+       wk-bin-acquire.sh publish SRC [--platform P] [--dry-run]
+EOF
+}
+
+main() {
+  command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "main" || true
+  local verb="${1:-}"
+  WK_TMP="$(mktemp -d)"
+  trap 'rm -rf "$WK_TMP"' EXIT
+  if [ $# -gt 0 ]; then shift; fi
+  case "$verb" in
+    acquire) acquire "$@" ;;
+    publish) publish "$@" ;;
+    -h|--help) usage ;;
+    *) usage; die "unknown verb: '$verb' (acquire|publish)" ;;
+  esac
+}
+
+main "$@"

package/opencode.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": [
+    ["__WK_PLUGIN_URL__", { "kihDir": "__WK_KIH_DIR__" }]
+  ],
+  "permission": {
+    "edit": "ask",
+    "webfetch": "ask",
+    "bash": {
+      "*": "ask",
+      "ls*": "allow",
+      "pwd": "allow",
+      "git status*": "allow",
+      "git diff*": "allow",
+      "git log*": "allow"
+    }
+  },
+  "provider": {
+    "qwen-inhouse": {
+      "npm": "@ai-sdk/openai-compatible",
+      "name": "In-house Qwen (OpenAI-compatible)",
+      "options": {
+        "baseURL": "{env:QWEN_BASE_URL}",
+        "apiKey": "{env:QWEN_API_KEY}"
+      },
+      "models": {
+        "qwen3-coder": { "name": "Qwen3 Coder (in-house)" }
+      }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,33 @@
 {
   "name": "wkappbot-code",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.3.1",
+  "description": "wkappbot-code -- Wisdom Kernel: the pinned OpenCode bridge plus the reflex harness plugin, the wkappbot core, the web harness and the latest public skills in one install",
+  "type": "module",
+  "bin": {
+    "wkappbot-code": "bin/wkappbot-code.js",
+    "wk-appbot-code": "bin/wkappbot-code.js"
+  },
+  "files": [
+    "bin/",
+    "lib/",
+    "plugin/",
+    "opencode.json",
+    "install.sh",
+    "README.md"
+  ],
+  "wkAppbotCode": {
+    "opencodeVersion": "1.19.5"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kiexpert/wkappbot-sdk.git"
+  },
+  "homepage": "https://github.com/kiexpert/wkappbot-sdk",
+  "publishConfig": {
+    "access": "public"
+  }
+}