wkappbot-code 0.3.19 → 0.3.22

package/bin/wkappbot-code.js

@@ -47,6 +47,7 @@ import { hooksRow, wireClaudeHooks } from "../lib/hook-wire.js";
 import { installStarterMd, removeStarterMd } from "../lib/starter-md.js";
 import { addAllows, removeAllows } from "../lib/allow-compact.js";
 import { ensurePrereqs } from "../lib/prereq.js";
+import { ensurePython } from "../lib/python-acquire.js";
 import { files as setupFiles, launchOpenCode, printBanner } from "../lib/setup-run.js";
 
 const PKG_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "..");
@@ -204,6 +205,13 @@ function installBin(o) {
   // need no core and still refuse the risky classes, but the install reports the missing core as a FAILED part (0.3.13).
   if (r.status === 3) return { ok: false, degraded: true, dest, note: "core not fetched (release host unreachable); hooks + lite harness run without it -- rerun wkappbot-code install once github.com is reachable" };
   if (r.status !== 0) return { ok: false, dest, note: "wk-bin-acquire rc " + r.status };
+  // Core recognizes this marker beside the actual executable; no Core rebuild needed.
+  if (IS_WIN) {
+    const core = join(target, "wkappbot-core.exe");
+    if (!existsSync(core)) return { ok: false, dest, note: "Windows core missing after acquire: " + core };
+    try { writeFileSync(join(target, ".wkappbot-code-install"), "wkappbot-code npm install\n"); }
+    catch (e) { return { ok: false, dest, note: "npm license marker: " + e.message }; }
+  }
   // Put `wkappbot` on PATH beside wkappbot-code itself, unless that name is already taken by someone else.
   let link = "";
   const ld = linkDir();
@@ -425,6 +433,8 @@ function install(o) {
   // is not on PATH is used from its folder, and a missing one is installed with winget (lib/prereq.js)
   st.prereq = ensurePrereqs({ log });
   if (!st.prereq.ok) bad++;
+  // 0.3.20 (owner 2026-11-09): a real Python before any step runs python -- the Store alias stub made install exit 49
+  st.python = ensurePython({ log });
   if (o.update) log("install --update: refreshing the core, the harness and the public skills");
   const ps = pwshPath();
   log("pwsh: " + (ps || "not found") + " -- the FULL harness (PowerShell 7) runs only on a dev seat (a harness checkout, or --dev-seat);" +
@@ -568,6 +578,12 @@ function uninstall(o) {
     if (body.includes(core)) { rmSync(cmdShim, { force: true }); linkRemoved = cmdShim; log("shim: removed " + cmdShim + " (it called the core this install placed)"); }
     else log("shim: kept " + cmdShim + " (it no longer calls " + core + ")");
   }
+  // Undo only our npm license marker; do not alter a marker owned by another installer.
+  if (IS_WIN && st.bin?.ok) {
+    const marker = join(dirname(core), ".wkappbot-code-install");
+    try { if (existsSync(marker) && readFileSync(marker, "utf8") === "wkappbot-code npm install\n") { rmSync(marker); log("bin: removed npm license marker " + marker); } }
+    catch (e) { rc = 1; log("bin: could not remove npm license marker (" + e.message + ")"); }
+  }
   // 3d. the AI CLIs this install added (lib/ai-clis.js), never one the user had before
   removeAiClis((st.aiClis && st.aiClis.installed) || [], log, process.env, undefined, (st.aiClis && st.aiClis.prefix) || "");
   // 4. the harness dirs we created, the plugin entry and our config folder
@@ -575,6 +591,7 @@ function uninstall(o) {
   const rmTree = (p, what) => {
     const r = rmTreeHard(p); if (r.ok) { if (what) log(what + ": removed " + p); return; }
     rc = 1; log((what || "remove") + ": could not remove " + p + " -- blocked by " + r.blockers.slice(0, 5).join("; ") + " -- delete it by hand");
+    if (IS_WIN) { const d = spawnSync("tasklist.exe", ["/v"], { encoding: "utf8", timeout: 15000 }); log("remove diagnostics (process list, not file owners): " + String(d.stdout || d.stderr || "").slice(0, 4000)); }
   };
   if (st.harness && st.harness.mode === "web" && pr.harnessDirExisted !== true && existsSync(HARNESS_DIR())) rmTree(HARNESS_DIR(), "harness");
   if (pr.hooksDirExisted !== true && existsSync(HOOKS_DIR())) rmTree(HOOKS_DIR(), "push-gate");

package/lib/hook-wire.js

@@ -13,6 +13,7 @@ import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { pickPython, stubWarning } from "./python-pick.js";
 
 // The same harness-hook pattern as tools/wkharness-lite.sh --wire HARNESS_HOOK. ANCHORED (2026-11-09 review, proven on
 // fixtures): the loose form also took a user's own pwsh lint.ps1, bash ~/bin/session-start.sh and my-wkharness-notes.sh
@@ -147,8 +148,9 @@ export function ensureRules(kih, log = () => {}) {
   if (existsSync(want)) return "present";
   const shipped = join(kih, "tools", "wkharness-lite-rules.tsv");
   if (existsSync(shipped)) { mkdirSync(dirname(want), { recursive: true }); writeFileSync(want, readFileSync(shipped)); return "copied"; }
-  const py = spawnSync("sh", ["-c", "command -v python3"], { encoding: "utf8" });
-  if (py.status === 0) {
+  const py = pickPython();
+  if (py.stubs.length) log("hooks: " + stubWarning(py.stubs));
+  if (py.cmd) {
     const r = spawnSync("sh", [join(kih, "tools", "wkharness-lite.sh").replace(/\\/g, "/"), "--wire"], { encoding: "utf8" });
     if (r.status === 0 && existsSync(want)) return "built";
   }

package/lib/python-acquire.js

@@ -0,0 +1,114 @@
+// wkappbot-code lib/python-acquire.js -- a REAL Python 3 on Windows before any step calls python (owner 2026-11-09:
+// "the harness install fails with code 49 when the Store alias is there -- detect the fake python, then force-install").
+// 49 is 9009 % 256: the Microsoft Store alias stub (WindowsApps\python.exe) seen through Git Bash or node.
+// ensurePython: probe (lib/python-pick.js, which RUNS each candidate); if no real Python and win32:
+//   1. winget install --id Python.Python.3.12 --scope user --silent (accept agreements)
+//   2. else the python.org embeddable zip, pinned 3.12.7 and sha256-checked, unpacked into ~/.wk-harness/python
+//   3. the real python dir goes AHEAD of %LOCALAPPDATA%\Microsoft\WindowsApps in the user PATH and in this process
+//   4. re-probe, then ONE line: "OK python <version> <path>" or "FAIL python: <reason>". It never throws.
+// Off Windows it only probes and reports (the package manager owns python there; lib/prereq.js names it).
+// Spec: wkappbot skill read harness-installer-owns-all-setup
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { pickPython, stubWarning } from "./python-pick.js";
+
+export const EMBED = {
+  version: "3.12.7",
+  url: "https://www.python.org/ftp/python/3.12.7/python-3.12.7-embed-amd64.zip",
+  // measured 2026-11-09 from the python.org download over TLS (the release page lists no sha256 for this file)
+  sha256: "0d57bb6cb078b74d23dbfe91f77d6780d45bed328911609f1f7ee2ba1606bf44",
+};
+
+const realRun = (cmd, args, env, extra = {}) => spawnSync(cmd, args, { encoding: "utf8", env, timeout: 600000, windowsHide: true, ...extra });
+const pathKey = (env) => Object.keys(env).find((k) => k.toUpperCase() === "PATH") || "PATH";
+
+// dir first on a Windows PATH string (";" separated on every host, so the selftest runs anywhere), but always ahead
+// of any WindowsApps entry
+export function pathAheadOfWindowsApps(pathStr, dir) {
+  const parts = String(pathStr || "").split(";").filter((p) => p && p.toLowerCase() !== dir.toLowerCase());
+  const i = parts.findIndex((p) => /\\Microsoft\\WindowsApps\\?$/i.test(p));
+  if (i < 0) return [dir, ...parts].join(";");
+  parts.splice(i, 0, dir);
+  return parts.join(";");
+}
+
+// The folder winget's per-user Python lands in (LOCALAPPDATA\Programs\Python\Python3xx), newest first.
+function wingetPythonDir(env, exists, list) {
+  const base = join(env.LOCALAPPDATA || join(homedir(), "AppData", "Local"), "Programs", "Python");
+  let names = [];
+  try { names = list(base).filter((n) => /^Python3\d+$/i.test(n)).sort().reverse(); } catch { return ""; }
+  for (const n of names) if (exists(join(base, n, "python.exe"))) return join(base, n);
+  return "";
+}
+
+function setUserPath(dir, run, env) {
+  // the user PATH (registry), not the merged one; same ordering rule as tools/wk-fresh-windows-tools.ps1
+  const ps = (cmd, e) => run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", cmd], e);
+  const cur = ps("[Environment]::GetEnvironmentVariable('Path','User')", env);
+  if (!cur || cur.status !== 0) return false;
+  const next = pathAheadOfWindowsApps(String(cur.stdout || "").trim(), dir);
+  // the value travels in an env var, so no quoting of the PATH text is ever needed
+  const w = ps("[Environment]::SetEnvironmentVariable('Path',$env:WK_NEW_USER_PATH,'User')", { ...env, WK_NEW_USER_PATH: next });
+  return w && w.status === 0;
+}
+
+export function ensurePython(o = {}) {
+  const env = o.env || process.env, log = o.log || (() => {}), run = o.run || realRun;
+  const platform = o.platform || process.platform, exists = o.exists || existsSync, list = o.list || readdirSync;
+  const home = o.home || homedir(), read = o.read || readFileSync, EMB = o.embed || EMBED;
+  const report = (ok, msg, extra = {}) => { log((ok ? "OK python " : "FAIL python: ") + msg); return { ok, note: msg, ...extra }; };
+  try {
+    let p = pickPython({ env, run: o.probeRun });
+    const warn = stubWarning(p.stubs);
+    if (p.cmd) {
+      const v = run(p.cmd, [...p.args, "-c", "import sys;print(sys.version.split()[0]);print(sys.executable)"], env);  // no shell: see python-pick.js
+      const [ver, exe] = String((v && v.stdout) || "").trim().split(/\r?\n/);
+      return report(true, (ver || "3") + " " + (exe || p.cmd), { cmd: p.cmd, args: p.args, via: "present" });
+    }
+    if (warn) log(warn);
+    if (platform !== "win32") return report(false, "no python3 -- install it with the package manager (apt/dnf/brew install python3)", { via: "none" });
+    if (o.noInstall) return report(false, (warn ? "only the Microsoft Store alias stub" : "no Python 3") + " -- run: wkappbot-code install", { via: "none" });
+    let dir = "", via = "";
+    // 1. winget, per user
+    const wg = run("winget", ["install", "--id", "Python.Python.3.12", "-e", "--scope", "user", "--silent", "--accept-package-agreements", "--accept-source-agreements"], env, { shell: true });
+    log("python: winget install Python.Python.3.12 rc " + (wg ? wg.status : "?"));
+    dir = wingetPythonDir(env, exists, list);
+    if (dir) via = "winget";
+    // 2. the pinned embeddable zip
+    if (!dir) {
+      const target = join(home, ".wk-harness", "python"), zip = join(home, ".wk-harness", "python-embed.zip");
+      mkdirSync(target, { recursive: true });
+      const dl = run("curl", ["-fsSL", "--retry", "6", "--retry-delay", "5", "-m", "300", "-o", zip, EMB.url], env);
+      if (!dl || dl.status !== 0) return report(false, "winget gave no Python and the download of " + EMB.url + " failed (curl rc " + (dl ? dl.status : "?") + ")", { via: "none" });
+      const sum = createHash("sha256").update(read(zip)).digest("hex");
+      if (sum !== EMB.sha256) return report(false, "the embeddable zip sha256 " + sum + " is not the pinned " + EMB.sha256, { via: "none" });
+      // Windows: the bsdtar in System32 reads a zip; the GNU tar of Git Bash, first on PATH there, cannot (rc 128, 0.3.20)
+      const tarExe = platform === "win32" ? join(env.SystemRoot || env.windir || "C:\\Windows", "System32", "tar.exe") : "tar";
+      let ux = run(tarExe, ["-xf", zip, "-C", target], env);
+      if ((!ux || ux.status !== 0) && platform === "win32")
+        ux = run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", "Expand-Archive -Force -LiteralPath $env:WK_ZIP -DestinationPath $env:WK_DEST"], { ...env, WK_ZIP: zip, WK_DEST: target });
+      if (!ux || ux.status !== 0) return report(false, "could not unpack " + zip + " (" + tarExe + " rc " + (ux ? ux.status : "?") + ")", { via: "none" });
+      // the zip's pythonXY._pth keeps the script folder off sys.path, so harness scripts could not import their siblings
+      try { for (const n of list(target)) if (/^python\d*\._pth$/i.test(n)) (o.unlink || unlinkSync)(join(target, n)); } catch {}
+      dir = target; via = "embed";
+    }
+    // 3. a python3.exe beside python.exe (winget and the zip ship only python.exe, so `python3` would still hit the
+    // WindowsApps stub), PYTHON_CMD for every later step, and the dir ahead of WindowsApps in this process and the user PATH
+    try { if (!exists(join(dir, "python3.exe"))) (o.copy || copyFileSync)(join(dir, "python.exe"), join(dir, "python3.exe")); } catch (e) { log("python: WARN no python3.exe beside python.exe (" + (e && e.message || e) + ")"); }
+    env.PYTHON_CMD = join(dir, "python.exe");
+    const k = pathKey(env);
+    env[k] = pathAheadOfWindowsApps(env[k], dir);
+    if (env !== process.env && o.env === undefined) { const pk = pathKey(process.env); process.env[pk] = pathAheadOfWindowsApps(process.env[pk], dir); }
+    if (!setUserPath(dir, run, env)) log("python: WARN could not write the user PATH; add " + dir + " ahead of WindowsApps");
+    // 4. re-probe the real exe by path
+    const exe = join(dir, "python.exe");
+    const v = run(exe, ["-c", "import sys;print(sys.version.split()[0])"], env);
+    if (v && v.status === 0 && /^3\./.test(String(v.stdout).trim())) return report(true, String(v.stdout).trim() + " " + exe, { cmd: exe, args: [], via });
+    return report(false, exe + " did not run (rc " + (v ? v.status : "?") + ")", { via });
+  } catch (e) {
+    return report(false, "unexpected: " + (e && e.message || e), { via: "none" });
+  }
+}

package/lib/python-pick.js

@@ -0,0 +1,45 @@
+// wkappbot-code lib/python-pick.js -- the ONE way the package chooses a Python 3 (owner order 2026-11-09).
+// A name on PATH is not a Python: on Windows %LOCALAPPDATA%\Microsoft\WindowsApps\python.exe and python3.exe are
+// Store app-execution-alias stubs. `command -v python3` finds them, yet running one prints "Python was not found
+// ... Microsoft Store" and exits 9009. So every candidate is RUN: python3, then python, then py -3, each with
+// -c "import sys;print(sys.version_info[0])", and accepted only on rc 0 with the output 3. A WindowsApps path, rc 9009
+// or the Store text marks a stub; pickPython reports it so the caller prints ONE warning (stubWarning).
+// Twin for sh: tools/wk-python-pick.sh (wk_python). Spec: wkappbot skill read harness-installer-owns-all-setup
+import { spawnSync } from "node:child_process";
+
+export const CANDIDATES = [["python3"], ["python"], ["py", "-3"]];
+// Windows asks python and py -3 first: python.org and tool-cache installs ship python.exe with no python3.exe, so
+// python3 there is usually the WindowsApps stub (spokesman order 2026-11-10).
+export const candidatesFor = (platform) => (platform === "win32" ? [["python"], ["py", "-3"], ["python3"]] : CANDIDATES);
+const PROBE = ["-c", "import sys;print(sys.version_info[0])"];
+const STORE_RE = /Microsoft Store|WindowsApps|app execution alias/i;
+
+// NEVER a shell: on win32 shell:true handed the probe to cmd.exe unquoted, so the ";" and "(" of -c broke it and every
+// REAL Python failed (0.3.20, SDK os-qa 42730232937 win-x64). Node finds python.exe and py.exe on PATH by itself, and
+// a WindowsApps stub still runs and exits 9009.
+export const spawnOpts = (env, timeout = 15000) => ({ encoding: "utf8", env, timeout, shell: false, windowsHide: true });
+const realRun = (cmd, args, env) => spawnSync(cmd, args, spawnOpts(env));
+
+// -> { cmd, args, stubs: [names] } ; cmd "" when no working Python 3 exists.
+export function pickPython(o = {}) {
+  const env = o.env || process.env, run = o.run || realRun, stubs = [];
+  if (env.PYTHON_CMD) {
+    const r = run(env.PYTHON_CMD, PROBE, env);
+    if (r && r.status === 0 && String(r.stdout || "").trim() === "3") return { cmd: env.PYTHON_CMD, args: [], stubs };
+  }
+  for (const [cmd, ...pre] of candidatesFor(o.platform || process.platform)) {
+    const r = run(cmd, [...pre, ...PROBE], env);
+    if (!r) continue;
+    const out = String(r.stdout || "") + String(r.stderr || "");
+    if (r.status === 0 && String(r.stdout || "").trim() === "3") return { cmd, args: pre, stubs };
+    if (r.status === 9009 || r.status === 49 || STORE_RE.test(out)) stubs.push(cmd);  // 49 = 9009 % 256 through a shell
+  }
+  return { cmd: "", args: [], stubs };
+}
+
+// The one WARN line for a Store stub, or "" when none was seen.
+export function stubWarning(stubs) {
+  if (!stubs || !stubs.length) return "";
+  return "WARN python: " + stubs.join(", ") + " is the Microsoft Store alias stub, not Python -- install Python 3, " +
+    "or turn the alias off under Settings > Apps > Advanced app settings > App execution aliases";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wkappbot-code",
-  "version": "0.3.19",
+  "version": "0.3.22",
   "description": "wkappbot-code -- Wisdom Kernel: the pinned OpenCode bridge plus the reflex harness plugin, the wkappbot core, the web harness and the latest public skills in one install",
   "type": "module",
   "scripts": {