wkappbot-code 0.3.19 → 0.3.20

package/bin/wkappbot-code.js

@@ -47,6 +47,7 @@ import { hooksRow, wireClaudeHooks } from "../lib/hook-wire.js";
 import { installStarterMd, removeStarterMd } from "../lib/starter-md.js";
 import { addAllows, removeAllows } from "../lib/allow-compact.js";
 import { ensurePrereqs } from "../lib/prereq.js";
+import { ensurePython } from "../lib/python-acquire.js";
 import { files as setupFiles, launchOpenCode, printBanner } from "../lib/setup-run.js";
 
 const PKG_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "..");
@@ -425,6 +426,8 @@ function install(o) {
   // is not on PATH is used from its folder, and a missing one is installed with winget (lib/prereq.js)
   st.prereq = ensurePrereqs({ log });
   if (!st.prereq.ok) bad++;
+  // 0.3.20 (owner 2026-11-09): a real Python before any step runs python -- the Store alias stub made install exit 49
+  st.python = ensurePython({ log });
   if (o.update) log("install --update: refreshing the core, the harness and the public skills");
   const ps = pwshPath();
   log("pwsh: " + (ps || "not found") + " -- the FULL harness (PowerShell 7) runs only on a dev seat (a harness checkout, or --dev-seat);" +

package/lib/hook-wire.js

@@ -13,6 +13,7 @@ import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { pickPython, stubWarning } from "./python-pick.js";
 
 // The same harness-hook pattern as tools/wkharness-lite.sh --wire HARNESS_HOOK. ANCHORED (2026-11-09 review, proven on
 // fixtures): the loose form also took a user's own pwsh lint.ps1, bash ~/bin/session-start.sh and my-wkharness-notes.sh
@@ -147,8 +148,9 @@ export function ensureRules(kih, log = () => {}) {
   if (existsSync(want)) return "present";
   const shipped = join(kih, "tools", "wkharness-lite-rules.tsv");
   if (existsSync(shipped)) { mkdirSync(dirname(want), { recursive: true }); writeFileSync(want, readFileSync(shipped)); return "copied"; }
-  const py = spawnSync("sh", ["-c", "command -v python3"], { encoding: "utf8" });
-  if (py.status === 0) {
+  const py = pickPython();
+  if (py.stubs.length) log("hooks: " + stubWarning(py.stubs));
+  if (py.cmd) {
     const r = spawnSync("sh", [join(kih, "tools", "wkharness-lite.sh").replace(/\\/g, "/"), "--wire"], { encoding: "utf8" });
     if (r.status === 0 && existsSync(want)) return "built";
   }

package/lib/python-acquire.js

@@ -0,0 +1,108 @@
+// wkappbot-code lib/python-acquire.js -- a REAL Python 3 on Windows before any step calls python (owner 2026-11-09:
+// "the harness install fails with code 49 when the Store alias is there -- detect the fake python, then force-install").
+// 49 is 9009 % 256: the Microsoft Store alias stub (WindowsApps\python.exe) seen through Git Bash or node.
+// ensurePython: probe (lib/python-pick.js, which RUNS each candidate); if no real Python and win32:
+//   1. winget install --id Python.Python.3.12 --scope user --silent (accept agreements)
+//   2. else the python.org embeddable zip, pinned 3.12.7 and sha256-checked, unpacked into ~/.wk-harness/python
+//   3. the real python dir goes AHEAD of %LOCALAPPDATA%\Microsoft\WindowsApps in the user PATH and in this process
+//   4. re-probe, then ONE line: "OK python <version> <path>" or "FAIL python: <reason>". It never throws.
+// Off Windows it only probes and reports (the package manager owns python there; lib/prereq.js names it).
+// Spec: wkappbot skill read harness-installer-owns-all-setup
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { pickPython, stubWarning } from "./python-pick.js";
+
+export const EMBED = {
+  version: "3.12.7",
+  url: "https://www.python.org/ftp/python/3.12.7/python-3.12.7-embed-amd64.zip",
+  // measured 2026-11-09 from the python.org download over TLS (the release page lists no sha256 for this file)
+  sha256: "0d57bb6cb078b74d23dbfe91f77d6780d45bed328911609f1f7ee2ba1606bf44",
+};
+
+const realRun = (cmd, args, env, extra = {}) => spawnSync(cmd, args, { encoding: "utf8", env, timeout: 600000, windowsHide: true, ...extra });
+const pathKey = (env) => Object.keys(env).find((k) => k.toUpperCase() === "PATH") || "PATH";
+
+// dir first on a Windows PATH string (";" separated on every host, so the selftest runs anywhere), but always ahead
+// of any WindowsApps entry
+export function pathAheadOfWindowsApps(pathStr, dir) {
+  const parts = String(pathStr || "").split(";").filter((p) => p && p.toLowerCase() !== dir.toLowerCase());
+  const i = parts.findIndex((p) => /\\Microsoft\\WindowsApps\\?$/i.test(p));
+  if (i < 0) return [dir, ...parts].join(";");
+  parts.splice(i, 0, dir);
+  return parts.join(";");
+}
+
+// The folder winget's per-user Python lands in (LOCALAPPDATA\Programs\Python\Python3xx), newest first.
+function wingetPythonDir(env, exists, list) {
+  const base = join(env.LOCALAPPDATA || join(homedir(), "AppData", "Local"), "Programs", "Python");
+  let names = [];
+  try { names = list(base).filter((n) => /^Python3\d+$/i.test(n)).sort().reverse(); } catch { return ""; }
+  for (const n of names) if (exists(join(base, n, "python.exe"))) return join(base, n);
+  return "";
+}
+
+function setUserPath(dir, run, env) {
+  // the user PATH (registry), not the merged one; same ordering rule as tools/wk-fresh-windows-tools.ps1
+  const ps = (cmd, e) => run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", cmd], e);
+  const cur = ps("[Environment]::GetEnvironmentVariable('Path','User')", env);
+  if (!cur || cur.status !== 0) return false;
+  const next = pathAheadOfWindowsApps(String(cur.stdout || "").trim(), dir);
+  // the value travels in an env var, so no quoting of the PATH text is ever needed
+  const w = ps("[Environment]::SetEnvironmentVariable('Path',$env:WK_NEW_USER_PATH,'User')", { ...env, WK_NEW_USER_PATH: next });
+  return w && w.status === 0;
+}
+
+export function ensurePython(o = {}) {
+  const env = o.env || process.env, log = o.log || (() => {}), run = o.run || realRun;
+  const platform = o.platform || process.platform, exists = o.exists || existsSync, list = o.list || readdirSync;
+  const home = o.home || homedir(), read = o.read || readFileSync;
+  const report = (ok, msg, extra = {}) => { log((ok ? "OK python " : "FAIL python: ") + msg); return { ok, note: msg, ...extra }; };
+  try {
+    let p = pickPython({ env, run: o.probeRun });
+    const warn = stubWarning(p.stubs);
+    if (p.cmd) {
+      const v = run(p.cmd, [...p.args, "-c", "import sys;print(sys.version.split()[0]);print(sys.executable)"], env, { shell: platform === "win32" });
+      const [ver, exe] = String((v && v.stdout) || "").trim().split(/\r?\n/);
+      return report(true, (ver || "3") + " " + (exe || p.cmd), { cmd: p.cmd, args: p.args, via: "present" });
+    }
+    if (warn) log(warn);
+    if (platform !== "win32") return report(false, "no python3 -- install it with the package manager (apt/dnf/brew install python3)", { via: "none" });
+    if (o.noInstall) return report(false, (warn ? "only the Microsoft Store alias stub" : "no Python 3") + " -- run: wkappbot-code install", { via: "none" });
+    let dir = "", via = "";
+    // 1. winget, per user
+    const wg = run("winget", ["install", "--id", "Python.Python.3.12", "-e", "--scope", "user", "--silent", "--accept-package-agreements", "--accept-source-agreements"], env, { shell: true });
+    log("python: winget install Python.Python.3.12 rc " + (wg ? wg.status : "?"));
+    dir = wingetPythonDir(env, exists, list);
+    if (dir) via = "winget";
+    // 2. the pinned embeddable zip
+    if (!dir) {
+      const target = join(home, ".wk-harness", "python"), zip = join(home, ".wk-harness", "python-embed.zip");
+      mkdirSync(target, { recursive: true });
+      const dl = run("curl", ["-fsSL", "--retry", "6", "--retry-delay", "5", "-m", "300", "-o", zip, EMBED.url], env);
+      if (!dl || dl.status !== 0) return report(false, "winget gave no Python and the download of " + EMBED.url + " failed (curl rc " + (dl ? dl.status : "?") + ")", { via: "none" });
+      const sum = createHash("sha256").update(read(zip)).digest("hex");
+      if (sum !== EMBED.sha256) return report(false, "the embeddable zip sha256 " + sum + " is not the pinned " + EMBED.sha256, { via: "none" });
+      const ux = run("tar", ["-xf", zip, "-C", target], env);
+      if (!ux || ux.status !== 0) return report(false, "could not unpack " + zip + " (tar rc " + (ux ? ux.status : "?") + ")", { via: "none" });
+      dir = target; via = "embed";
+    }
+    // 3. a python3.exe beside python.exe (winget and the zip ship only python.exe, so `python3` would still hit the
+    // WindowsApps stub), PYTHON_CMD for every later step, and the dir ahead of WindowsApps in this process and the user PATH
+    try { if (!exists(join(dir, "python3.exe"))) (o.copy || copyFileSync)(join(dir, "python.exe"), join(dir, "python3.exe")); } catch (e) { log("python: WARN no python3.exe beside python.exe (" + (e && e.message || e) + ")"); }
+    env.PYTHON_CMD = join(dir, "python.exe");
+    const k = pathKey(env);
+    env[k] = pathAheadOfWindowsApps(env[k], dir);
+    if (env !== process.env && o.env === undefined) { const pk = pathKey(process.env); process.env[pk] = pathAheadOfWindowsApps(process.env[pk], dir); }
+    if (!setUserPath(dir, run, env)) log("python: WARN could not write the user PATH; add " + dir + " ahead of WindowsApps");
+    // 4. re-probe the real exe by path
+    const exe = join(dir, "python.exe");
+    const v = run(exe, ["-c", "import sys;print(sys.version.split()[0])"], env);
+    if (v && v.status === 0 && /^3\./.test(String(v.stdout).trim())) return report(true, String(v.stdout).trim() + " " + exe, { cmd: exe, args: [], via });
+    return report(false, exe + " did not run (rc " + (v ? v.status : "?") + ")", { via });
+  } catch (e) {
+    return report(false, "unexpected: " + (e && e.message || e), { via: "none" });
+  }
+}

package/lib/python-pick.js

@@ -0,0 +1,38 @@
+// wkappbot-code lib/python-pick.js -- the ONE way the package chooses a Python 3 (owner order 2026-11-09).
+// A name on PATH is not a Python: on Windows %LOCALAPPDATA%\Microsoft\WindowsApps\python.exe and python3.exe are
+// Store app-execution-alias stubs. `command -v python3` finds them, yet running one prints "Python was not found
+// ... Microsoft Store" and exits 9009. So every candidate is RUN: python3, then python, then py -3, each with
+// -c "import sys;print(sys.version_info[0])", and accepted only on rc 0 with the output 3. A WindowsApps path, rc 9009
+// or the Store text marks a stub; pickPython reports it so the caller prints ONE warning (stubWarning).
+// Twin for sh: tools/wk-python-pick.sh (wk_python). Spec: wkappbot skill read harness-installer-owns-all-setup
+import { spawnSync } from "node:child_process";
+
+export const CANDIDATES = [["python3"], ["python"], ["py", "-3"]];
+const PROBE = ["-c", "import sys;print(sys.version_info[0])"];
+const STORE_RE = /Microsoft Store|WindowsApps|app execution alias/i;
+
+const realRun = (cmd, args, env) => spawnSync(cmd, args, { encoding: "utf8", env, timeout: 15000, shell: process.platform === "win32", windowsHide: true });
+
+// -> { cmd, args, stubs: [names] } ; cmd "" when no working Python 3 exists.
+export function pickPython(o = {}) {
+  const env = o.env || process.env, run = o.run || realRun, stubs = [];
+  if (env.PYTHON_CMD) {
+    const r = run(env.PYTHON_CMD, PROBE, env);
+    if (r && r.status === 0 && String(r.stdout || "").trim() === "3") return { cmd: env.PYTHON_CMD, args: [], stubs };
+  }
+  for (const [cmd, ...pre] of CANDIDATES) {
+    const r = run(cmd, [...pre, ...PROBE], env);
+    if (!r) continue;
+    const out = String(r.stdout || "") + String(r.stderr || "");
+    if (r.status === 0 && String(r.stdout || "").trim() === "3") return { cmd, args: pre, stubs };
+    if (r.status === 9009 || r.status === 49 || STORE_RE.test(out)) stubs.push(cmd);  // 49 = 9009 % 256 through a shell
+  }
+  return { cmd: "", args: [], stubs };
+}
+
+// The one WARN line for a Store stub, or "" when none was seen.
+export function stubWarning(stubs) {
+  if (!stubs || !stubs.length) return "";
+  return "WARN python: " + stubs.join(", ") + " is the Microsoft Store alias stub, not Python -- install Python 3, " +
+    "or turn the alias off under Settings > Apps > Advanced app settings > App execution aliases";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wkappbot-code",
-  "version": "0.3.19",
+  "version": "0.3.20",
   "description": "wkappbot-code -- Wisdom Kernel: the pinned OpenCode bridge plus the reflex harness plugin, the wkappbot core, the web harness and the latest public skills in one install",
   "type": "module",
   "scripts": {