wkappbot-code 0.3.20 → 0.3.23

package/README.md

@@ -12,7 +12,7 @@ The plugin `plugin/wisdom-kernel.js` maps OpenCode plugin events onto the harnes
 |---|---|---|
 | `tool.execute.before` | `pre` | Claude-shaped PreToolUse JSON (`tool_name`, `tool_input`, `session_id`, `cwd`). Exit 2 throws, which refuses the tool call with the guard's own message as the reason. |
 | `tool.execute.after` | `post` | fail-open |
-| `chat.message` | `prompt` | UserPromptSubmit: the intent lock owes a skill search (`wkskill search ...`) before real work |
+| `chat.message` | `prompt` | UserPromptSubmit: the intent lock owes a skill search (`wkappbot skill search ...`) before real work |
 | `event` `session.created` | `session` | SessionStart |
 | `event` `session.idle` | `stop-archive` | archive only, fail-open |
 | `experimental.chat.system.transform` | (none) | appends the reflex rules to the system prompt of EVERY model request, whatever the model (pinned to OpenCode 1.19.5; the e2e asserts every request carried them) |
@@ -57,7 +57,7 @@ The generated `opencode.json` holds the minimum: `$schema` and the plugin entry
 
 ## Uninstall
 
-`install` records, once, the machine state it changes: the global `core.hooksPath`, whether `~/.claude/settings.json`, `~/.wk-harness` and `~/.wk-harness-hooks` existed, and which shims it created (`wkappbot` beside the CLI, `wkskill` and `wk-verify` in `~/.local/bin`). `wkappbot-code uninstall` gives exactly that back: the recorded `core.hooksPath` (only when the current value is a hook folder the install wrote), the harness hook entries leave `settings.json` while yours stay (a file the install created is removed when nothing else is left), the recorded shims go, `~/.wk-harness` and `~/.wk-harness-hooks` go when the install created them, and the plugin entry leaves `opencode.json` (backed up first). It keeps `opencode-ai`, the core and its skills; `npm rm -g wkappbot-code` removes the CLI.
+`install` records, once, the machine state it changes: the global `core.hooksPath`, whether `~/.claude/settings.json`, `~/.wk-harness` and `~/.wk-harness-hooks` existed, and which shims it created (`wkappbot` beside the CLI and `wk-verify` in `~/.local/bin`; no `wkskill` command exists, the skill command is `wkappbot skill`). `wkappbot-code uninstall` gives exactly that back: the recorded `core.hooksPath` (only when the current value is a hook folder the install wrote), the harness hook entries leave `settings.json` while yours stay (a file the install created is removed when nothing else is left), the recorded shims go, `~/.wk-harness` and `~/.wk-harness-hooks` go when the install created them, and the plugin entry leaves `opencode.json` (backed up first). It keeps `opencode-ai`, the core and its skills; `npm rm -g wkappbot-code` removes the CLI.
 
 ## Model swap
 

package/bin/postinstall.js

@@ -7,7 +7,7 @@
 // CONTRACT: (a) ALWAYS exits 0 and returns within a moment -- the real work runs DETACHED and logs to
 // ~/.wkappbot-code/postinstall.log; (b) the worker runs `wkappbot-code install` (lays the web harness, wires
 // ~/.claude/settings.json through the lite harness -- PreToolUse, Stop, UserPromptSubmit, SessionStart -- the global git
-// hooks, the wkskill/wk-verify shims and the public skills, keeping every user setting), then `wkappbot-code doctor`,
+// hooks, the wk-verify shim and the public skills, keeping every user setting), then `wkappbot-code doctor`,
 // then a short self-test (lib/setup-run.js: core --version, skill read on-load, one hook allow, one hook refuse), and
 // writes ~/.wkappbot-code/postinstall.done {version, installRc, doctor:{pass,warn,fail,skip}, selftest:{n,m}, ...};
 // postinstall.running exists while the worker lives; (c) the first `wkappbot-code` run afterwards prints ONE summary

package/bin/wkappbot-code.js

@@ -40,7 +40,7 @@ import {
 import { homedir, tmpdir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { quietCheck, runUpdate, updateRow } from "../lib/update.js"; import { rmTreeHard } from "../lib/rmtree.js"; import { plainFileUrl } from "../lib/fileurl.js";
+import { quietCheck, runUpdate, updateRow } from "../lib/update.js"; import { rmTreeHard } from "../lib/rmtree.js"; import { plainFileUrl } from "../lib/fileurl.js"; import { removeStaleWkskill } from "../lib/stale-wkskill.js";
 import { applySets, askEach, buildConfig, configRow, detect, lineDiff, printDetected } from "../lib/config.js";
 import { aiCliRows, installAiClis, removeAiClis } from "../lib/ai-clis.js";
 import { hooksRow, wireClaudeHooks } from "../lib/hook-wire.js";
@@ -205,6 +205,13 @@ function installBin(o) {
   // need no core and still refuse the risky classes, but the install reports the missing core as a FAILED part (0.3.13).
   if (r.status === 3) return { ok: false, degraded: true, dest, note: "core not fetched (release host unreachable); hooks + lite harness run without it -- rerun wkappbot-code install once github.com is reachable" };
   if (r.status !== 0) return { ok: false, dest, note: "wk-bin-acquire rc " + r.status };
+  // Core recognizes this marker beside the actual executable; no Core rebuild needed.
+  if (IS_WIN) {
+    const core = join(target, "wkappbot-core.exe");
+    if (!existsSync(core)) return { ok: false, dest, note: "Windows core missing after acquire: " + core };
+    try { writeFileSync(join(target, ".wkappbot-code-install"), "wkappbot-code npm install\n"); }
+    catch (e) { return { ok: false, dest, note: "npm license marker: " + e.message }; }
+  }
   // Put `wkappbot` on PATH beside wkappbot-code itself, unless that name is already taken by someone else.
   let link = "";
   const ld = linkDir();
@@ -393,7 +400,7 @@ function installPlugin(o, kih, kihSource) {
 // The machine state an uninstall must give back, recorded ONCE (a re-install never overwrites the first record, or
 // it would record our own dispatcher as the "prior" hooksPath). Shim paths are those install may create.
 function shimCandidates() {
-  return [join(linkDir(), "wkappbot"), join(HARNESS_LINKS(), "wkskill"), join(HARNESS_LINKS(), "wk-verify"), join(HARNESS_LINKS(), "wkskill.cmd"), join(HARNESS_LINKS(), "wk-verify.cmd")];   // Windows (Git Bash) .cmd twins from harness-install.sh: recorded like the rest, so uninstall removes them, never a user file
+  return [join(linkDir(), "wkappbot"), join(HARNESS_LINKS(), "wk-verify"), join(HARNESS_LINKS(), "wk-verify.cmd")];   // Windows (Git Bash) .cmd twins from harness-install.sh: recorded like the rest, so uninstall removes them, never a user file
 }
 const PRE_SETTINGS = () => join(STATE_HOME(), "settings.pre-install.json");
 function recordPrior(prev) {
@@ -555,7 +562,7 @@ function uninstall(o) {
   }
   // 3b. the ~/.local/bin/wkappbot link: removed ONLY when it points at the core this install placed (the core file stays)
   const core = (st.bin && st.bin.dest) || binDest(o);
-  removeStarterMd(st.starterMd, log);
+  removeStarterMd(st.starterMd, log); removeStaleWkskill(HARNESS_LINKS(), log);  // an older harness install's counterfeit wkskill link (SDK e2e: local-bin=wkskill)
   let linkRemoved = "";
   for (const p of new Set(shimCandidates().concat([join(homedir(), ".local", "bin", "wkappbot")]))) {
     if (!isSymlink(p) || (st.shims || []).includes(p)) continue;
@@ -571,6 +578,12 @@ function uninstall(o) {
     if (body.includes(core)) { rmSync(cmdShim, { force: true }); linkRemoved = cmdShim; log("shim: removed " + cmdShim + " (it called the core this install placed)"); }
     else log("shim: kept " + cmdShim + " (it no longer calls " + core + ")");
   }
+  // Undo only our npm license marker; do not alter a marker owned by another installer.
+  if (IS_WIN && st.bin?.ok) {
+    const marker = join(dirname(core), ".wkappbot-code-install");
+    try { if (existsSync(marker) && readFileSync(marker, "utf8") === "wkappbot-code npm install\n") { rmSync(marker); log("bin: removed npm license marker " + marker); } }
+    catch (e) { rc = 1; log("bin: could not remove npm license marker (" + e.message + ")"); }
+  }
   // 3d. the AI CLIs this install added (lib/ai-clis.js), never one the user had before
   removeAiClis((st.aiClis && st.aiClis.installed) || [], log, process.env, undefined, (st.aiClis && st.aiClis.prefix) || "");
   // 4. the harness dirs we created, the plugin entry and our config folder
@@ -578,6 +591,7 @@ function uninstall(o) {
   const rmTree = (p, what) => {
     const r = rmTreeHard(p); if (r.ok) { if (what) log(what + ": removed " + p); return; }
     rc = 1; log((what || "remove") + ": could not remove " + p + " -- blocked by " + r.blockers.slice(0, 5).join("; ") + " -- delete it by hand");
+    if (IS_WIN) { const d = spawnSync("tasklist.exe", ["/v"], { encoding: "utf8", timeout: 15000 }); log("remove diagnostics (process list, not file owners): " + String(d.stdout || d.stderr || "").slice(0, 4000)); }
   };
   if (st.harness && st.harness.mode === "web" && pr.harnessDirExisted !== true && existsSync(HARNESS_DIR())) rmTree(HARNESS_DIR(), "harness");
   if (pr.hooksDirExisted !== true && existsSync(HOOKS_DIR())) rmTree(HOOKS_DIR(), "push-gate");

package/lib/allow-compact.js

@@ -9,7 +9,6 @@ import { dirname } from "node:path";
 import { readSettings } from "./hook-wire.js";
 
 export const COMPACT_ALLOWS = [
-  "Bash(wkskill *)",               // skill read / search / like (the user's own store)
   "Bash(wkappbot skill *)",        // the same through the core
   "Bash(wkappbot file read *)",    // read-only file view
   "Bash(wk-verify)",               // live hook check, no arguments

package/lib/hook-wire.js

@@ -20,7 +20,10 @@ import { pickPython, stubWarning } from "./python-pick.js";
 // for harness hooks and deleted or rewrote them. Now a harness hook is a wkharness*.sh/.ps1/.cmd file name standing at a
 // path or word start, a file under a .wk-harness folder, the kih .claude/hooks scripts, or the two named sync hooks.
 const HARNESS_HOOK = /(^|[\s"'\\/])wkharness(-[\w-]+)?\.(sh|ps1|cmd)\b|\.wk-harness[\\/]|[\\/]\.claude[\\/]hooks[\\/](user-prompt-submit|session-start)\.sh\b|(^|[\s"'\\/])(wk-global-md-sync|wk-session-pull|wkappbot-shim)(\.[a-z0-9]+)?\b/;
-const ARMS = [["PreToolUse", "pre"], ["Stop", "stop"], ["UserPromptSubmit", "prompt"], ["SessionStart", "session"]];
+// The history arms (owner 2026-11-12) push the reflex history like the repo hooks: PostToolUse only for the cross-session
+// tools (a matcher, so no spawn per tool call), PreCompact, SessionEnd and StopFailure (a rate limit).
+const ARMS = [["PreToolUse", "pre"], ["Stop", "stop"], ["UserPromptSubmit", "prompt"], ["SessionStart", "session"],
+  ["PostToolUse", "post", "mcp__claude-code-remote__send_message|ReadNotifications"], ["PreCompact", "precompact"], ["SessionEnd", "sessionend"], ["StopFailure", "stopfail"]];
 const fwd = (p) => String(p || "").replace(/\\/g, "/").replace(/\/+$/, "");
 
 export function readSettings(path) {
@@ -80,10 +83,10 @@ export function wireSettings(path, lite) {
     }
     if (keep.length) out[ev] = keep;
   }
-  for (const [ev, arm] of ARMS) {
+  for (const [ev, arm, matcher] of ARMS) {
     const c = '"' + lite + '" ' + arm;
     if (!(out[ev] || []).some((g) => (g.hooks || []).some((h) => h.command === c)))
-      (out[ev] = out[ev] || []).push({ hooks: [{ type: "command", command: c, timeout: 10 }] });
+      (out[ev] = out[ev] || []).push({ ...(matcher ? { matcher } : {}), hooks: [{ type: "command", command: c, timeout: 10 }] });
   }
   d.hooks = out;
   mkdirSync(dirname(path), { recursive: true });

package/lib/python-acquire.js

@@ -10,7 +10,7 @@
 // Spec: wkappbot skill read harness-installer-owns-all-setup
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { pickPython, stubWarning } from "./python-pick.js";
@@ -58,13 +58,13 @@ function setUserPath(dir, run, env) {
 export function ensurePython(o = {}) {
   const env = o.env || process.env, log = o.log || (() => {}), run = o.run || realRun;
   const platform = o.platform || process.platform, exists = o.exists || existsSync, list = o.list || readdirSync;
-  const home = o.home || homedir(), read = o.read || readFileSync;
+  const home = o.home || homedir(), read = o.read || readFileSync, EMB = o.embed || EMBED;
   const report = (ok, msg, extra = {}) => { log((ok ? "OK python " : "FAIL python: ") + msg); return { ok, note: msg, ...extra }; };
   try {
     let p = pickPython({ env, run: o.probeRun });
     const warn = stubWarning(p.stubs);
     if (p.cmd) {
-      const v = run(p.cmd, [...p.args, "-c", "import sys;print(sys.version.split()[0]);print(sys.executable)"], env, { shell: platform === "win32" });
+      const v = run(p.cmd, [...p.args, "-c", "import sys;print(sys.version.split()[0]);print(sys.executable)"], env);  // no shell: see python-pick.js
       const [ver, exe] = String((v && v.stdout) || "").trim().split(/\r?\n/);
       return report(true, (ver || "3") + " " + (exe || p.cmd), { cmd: p.cmd, args: p.args, via: "present" });
     }
@@ -81,12 +81,18 @@ export function ensurePython(o = {}) {
     if (!dir) {
       const target = join(home, ".wk-harness", "python"), zip = join(home, ".wk-harness", "python-embed.zip");
       mkdirSync(target, { recursive: true });
-      const dl = run("curl", ["-fsSL", "--retry", "6", "--retry-delay", "5", "-m", "300", "-o", zip, EMBED.url], env);
-      if (!dl || dl.status !== 0) return report(false, "winget gave no Python and the download of " + EMBED.url + " failed (curl rc " + (dl ? dl.status : "?") + ")", { via: "none" });
+      const dl = run("curl", ["-fsSL", "--retry", "6", "--retry-delay", "5", "-m", "300", "-o", zip, EMB.url], env);
+      if (!dl || dl.status !== 0) return report(false, "winget gave no Python and the download of " + EMB.url + " failed (curl rc " + (dl ? dl.status : "?") + ")", { via: "none" });
       const sum = createHash("sha256").update(read(zip)).digest("hex");
-      if (sum !== EMBED.sha256) return report(false, "the embeddable zip sha256 " + sum + " is not the pinned " + EMBED.sha256, { via: "none" });
-      const ux = run("tar", ["-xf", zip, "-C", target], env);
-      if (!ux || ux.status !== 0) return report(false, "could not unpack " + zip + " (tar rc " + (ux ? ux.status : "?") + ")", { via: "none" });
+      if (sum !== EMB.sha256) return report(false, "the embeddable zip sha256 " + sum + " is not the pinned " + EMB.sha256, { via: "none" });
+      // Windows: the bsdtar in System32 reads a zip; the GNU tar of Git Bash, first on PATH there, cannot (rc 128, 0.3.20)
+      const tarExe = platform === "win32" ? join(env.SystemRoot || env.windir || "C:\\Windows", "System32", "tar.exe") : "tar";
+      let ux = run(tarExe, ["-xf", zip, "-C", target], env);
+      if ((!ux || ux.status !== 0) && platform === "win32")
+        ux = run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", "Expand-Archive -Force -LiteralPath $env:WK_ZIP -DestinationPath $env:WK_DEST"], { ...env, WK_ZIP: zip, WK_DEST: target });
+      if (!ux || ux.status !== 0) return report(false, "could not unpack " + zip + " (" + tarExe + " rc " + (ux ? ux.status : "?") + ")", { via: "none" });
+      // the zip's pythonXY._pth keeps the script folder off sys.path, so harness scripts could not import their siblings
+      try { for (const n of list(target)) if (/^python\d*\._pth$/i.test(n)) (o.unlink || unlinkSync)(join(target, n)); } catch {}
       dir = target; via = "embed";
     }
     // 3. a python3.exe beside python.exe (winget and the zip ship only python.exe, so `python3` would still hit the

package/lib/python-pick.js

@@ -8,10 +8,17 @@
 import { spawnSync } from "node:child_process";
 
 export const CANDIDATES = [["python3"], ["python"], ["py", "-3"]];
+// Windows asks python and py -3 first: python.org and tool-cache installs ship python.exe with no python3.exe, so
+// python3 there is usually the WindowsApps stub (spokesman order 2026-11-10).
+export const candidatesFor = (platform) => (platform === "win32" ? [["python"], ["py", "-3"], ["python3"]] : CANDIDATES);
 const PROBE = ["-c", "import sys;print(sys.version_info[0])"];
 const STORE_RE = /Microsoft Store|WindowsApps|app execution alias/i;
 
-const realRun = (cmd, args, env) => spawnSync(cmd, args, { encoding: "utf8", env, timeout: 15000, shell: process.platform === "win32", windowsHide: true });
+// NEVER a shell: on win32 shell:true handed the probe to cmd.exe unquoted, so the ";" and "(" of -c broke it and every
+// REAL Python failed (0.3.20, SDK os-qa 42730232937 win-x64). Node finds python.exe and py.exe on PATH by itself, and
+// a WindowsApps stub still runs and exits 9009.
+export const spawnOpts = (env, timeout = 15000) => ({ encoding: "utf8", env, timeout, shell: false, windowsHide: true });
+const realRun = (cmd, args, env) => spawnSync(cmd, args, spawnOpts(env));
 
 // -> { cmd, args, stubs: [names] } ; cmd "" when no working Python 3 exists.
 export function pickPython(o = {}) {
@@ -20,7 +27,7 @@ export function pickPython(o = {}) {
     const r = run(env.PYTHON_CMD, PROBE, env);
     if (r && r.status === 0 && String(r.stdout || "").trim() === "3") return { cmd: env.PYTHON_CMD, args: [], stubs };
   }
-  for (const [cmd, ...pre] of CANDIDATES) {
+  for (const [cmd, ...pre] of candidatesFor(o.platform || process.platform)) {
     const r = run(cmd, [...pre, ...PROBE], env);
     if (!r) continue;
     const out = String(r.stdout || "") + String(r.stderr || "");

package/lib/stale-wkskill.js

@@ -0,0 +1,23 @@
+// stale-wkskill.js -- uninstall also removes the counterfeit wkskill command an OLDER harness install left in the link dir
+// (owner 2026-11-11: the fake wkskill is deleted; spokesman 2026-11-12: SDK e2e "after: local-bin=wkskill", RESULT 20/21 on every leg).
+// A link or .cmd twin is removed ONLY while it still points into a harness (its target or body names wkharness or wk-harness);
+// a wkskill file or link of the user's own stays. Spec: wkappbot skill read harness-installer-owns-all-setup
+import { lstatSync, readFileSync, readlinkSync, rmSync } from "node:fs";
+import { join } from "node:path";
+
+const isHarness = (s) => /wkharness|wk-harness/.test(String(s || ""));
+
+// -> the paths removed; log gets one line per candidate
+export function removeStaleWkskill(dir, log = () => {}) {
+  const removed = [];
+  for (const n of ["wkskill", "wkskill.cmd"]) {
+    const p = join(dir, n);
+    let st;
+    try { st = lstatSync(p); } catch { continue; }
+    let body = "";
+    try { body = st.isSymbolicLink() ? readlinkSync(p) : readFileSync(p, "utf8"); } catch { /* unreadable: kept */ }
+    if (isHarness(body)) { rmSync(p, { force: true }); removed.push(p); log("shim: removed " + p + " (the counterfeit wkskill command an older harness install linked)"); }
+    else log("shim: kept " + p + " (not a harness link)");
+  }
+  return removed;
+}

package/lib/wk-hook.js

@@ -301,16 +301,16 @@ export function isFastRead(tool, input) {
 }
 
 // SHIM PATH (SDK ROOT C 2026-11-06, run 42289814533): OpenCode's bash tool runs /bin/zsh on macOS, whose default PATH
-// has no ~/.local/bin, so "zsh:1: command not found: wkskill" and a Mac user could never pay the intent lock. A bash call
-// that names wkskill or wk-verify gets the shim dir (WK_LINK_DIR, else ~/.local/bin, where harness install.sh links
+// has no ~/.local/bin, so "zsh:1: command not found: wkappbot" and a Mac user could never pay the intent lock. A bash call
+// that names wkappbot or wk-verify gets the shim dir (WK_LINK_DIR, else ~/.local/bin, where harness install.sh links
 // them) prepended to PATH for that one command; nothing else changes. Returns the command to run (unchanged when the
 // shim is absent or the command names neither shim).
 export function withShimPath(tool, args, linkDir) {
   if (claudeToolName(tool) !== "Bash" || !args || typeof args.command !== "string") return args && args.command;
   const c = args.command;
-  if (!/(^|[\s;&|(`])(wkskill|wk-verify)(\s|$)/.test(c)) return c;
+  if (!/(^|[\s;&|(`])(wkappbot|wk-verify)(\s|$)/.test(c)) return c;
   const dir = linkDir || process.env.WK_LINK_DIR || join(homedir(), ".local", "bin");
-  if (!existsSync(join(dir, "wkskill")) && !existsSync(join(dir, "wk-verify"))) return c;
+  if (!existsSync(join(dir, "wkappbot")) && !existsSync(join(dir, "wk-verify"))) return c;
   if (c.startsWith("PATH=")) return c;
   return "PATH=" + JSON.stringify(dir) + ':"$PATH"; export PATH; ' + c;
 }
@@ -323,10 +323,10 @@ export const RULES_MARK = "[wisdom-kernel rules]";
 export const RULES = [
   RULES_MARK + " You run under the Wisdom Kernel harness (wkappbot-code). On every turn:",
   "1. One command per shell call; never chain a write with anything else.",
-  "2. A refusal names a skill: run wkskill read <id> (or wkappbot skill read <id>) and apply its remedy; never route around it.",
+  "2. A refusal names a skill: run wkappbot skill read <id> and apply its remedy; never route around it.",
   "3. Never use git --no-verify or git push --force, never change core.hooksPath, never rm -r a home directory, / or the project source.",
   "4. Never edit or delete files under .git.",
-  "5. After a new user prompt, run wkskill search <three or more words> before the first write; read-only tools stay open.",
+  "5. After a new user prompt, run wkappbot skill search <three or more words> before the first write; read-only tools stay open.",
 ].join("\n");
 
 // The top step lines of the on-load skill, fetched ONCE per process (one OpenCode server = its sessions) in the
@@ -337,7 +337,7 @@ export function onLoadLines(kihDir) {
   if (_onload) return _onload;
   _onload = new Promise((res) => {
     const k = kihDir || resolveKihDir();
-    const cands = [process.env.WK_APPBOT_SKILL_CMD, k && join(k, "bin", "wkskill"), "wkskill"].filter(Boolean);
+    const cands = [process.env.WK_APPBOT_SKILL_CMD, k && join(k, "bin", "wkappbot"), "wkappbot"].filter(Boolean);
     let out = "", done = false;
     const finish = () => {
       if (done) return; done = true;
@@ -347,9 +347,9 @@ export function onLoadLines(kihDir) {
       res(lines.slice(0, 3).map((l) => l.slice(0, 240)));
     };
     try {
-      const target = cands.find((p) => p === "wkskill" || existsSync(p)), opt = { stdio: ["ignore", "pipe", "ignore"] };
-      // Windows: a shell-less spawn cannot run a .cmd shim, the bare wkskill name (PATHEXT) or an extensionless sh script
-      const c = process.platform !== "win32" ? spawn(target, ["read", "on-load"], opt) : /\.exe$/i.test(target) ? spawn(target, ["read", "on-load"], opt) : /\.(cmd|bat)$/i.test(target) || target === "wkskill" ? spawn(target, ["read", "on-load"], { ...opt, shell: true }) : spawn("sh", [target.replace(/\\/g, "/"), "read", "on-load"], opt);
+      const target = cands.find((p) => p === "wkappbot" || existsSync(p)), opt = { stdio: ["ignore", "pipe", "ignore"] };
+      // Windows: a shell-less spawn cannot run a .cmd shim, the bare wkappbot name (PATHEXT) or an extensionless sh script
+      const c = process.platform !== "win32" ? spawn(target, ["skill", "read", "on-load"], opt) : /\.exe$/i.test(target) ? spawn(target, ["skill", "read", "on-load"], opt) : /\.(cmd|bat)$/i.test(target) || target === "wkappbot" ? spawn(target, ["skill", "read", "on-load"], { ...opt, shell: true }) : spawn("sh", [target.replace(/\\/g, "/"), "skill", "read", "on-load"], opt);
       c.stdout.on("data", (d) => { out += d; if (out.length > 65536) c.kill("SIGKILL"); });
       c.on("error", finish); c.on("close", finish);
       setTimeout(() => { try { c.kill("SIGKILL"); } catch {} finish(); }, 8000).unref();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wkappbot-code",
-  "version": "0.3.20",
+  "version": "0.3.23",
   "description": "wkappbot-code -- Wisdom Kernel: the pinned OpenCode bridge plus the reflex harness plugin, the wkappbot core, the web harness and the latest public skills in one install",
   "type": "module",
   "scripts": {

package/plugin/wisdom-kernel.js

@@ -51,7 +51,7 @@ export const WisdomKernel = async (ctx = {}, options = {}) => {
             (tail ? ": " + tail : "") + ". Fix the harness (wkappbot-code doctor) and retry.");
         }
       }
-      // macOS /bin/zsh has no ~/.local/bin on PATH: a wkskill call gets the shim dir for that one command (lib/wk-hook.js).
+      // macOS /bin/zsh has no ~/.local/bin on PATH: a wkappbot call gets the shim dir for that one command (lib/wk-hook.js).
       try { if (args && typeof args.command === "string") args.command = H.withShimPath(inp.tool, args); } catch {}
     },
     "tool.execute.after": async (input, output) => {

package/templates/global-CLAUDE.md

@@ -5,7 +5,7 @@ change it, install never touches it again, and `wkappbot-code uninstall` leaves
 
 ## How to work
 - Reply in the language the user writes in. Keep replies short and concrete; lead with the result.
-- Before real work, find the skill that governs it: `wkskill search <three or more words>`, then `wkskill read <id>`,
+- Before real work, find the skill that governs it: `wkappbot skill search <three or more words>`, then `wkappbot skill read <id>`,
   and follow the road it gives. Search again for any term you are not sure of, instead of guessing.
 - Run, do not guess: prove a change by running its test or command, and report the real output, failures included.
 - One command per tool call. Change only what the task needs, and back up a config file before you edit it.