wkappbot-code 0.3.22 → 0.3.23

package/README.md

@@ -12,7 +12,7 @@ The plugin `plugin/wisdom-kernel.js` maps OpenCode plugin events onto the harnes
 |---|---|---|
 | `tool.execute.before` | `pre` | Claude-shaped PreToolUse JSON (`tool_name`, `tool_input`, `session_id`, `cwd`). Exit 2 throws, which refuses the tool call with the guard's own message as the reason. |
 | `tool.execute.after` | `post` | fail-open |
-| `chat.message` | `prompt` | UserPromptSubmit: the intent lock owes a skill search (`wkskill search ...`) before real work |
+| `chat.message` | `prompt` | UserPromptSubmit: the intent lock owes a skill search (`wkappbot skill search ...`) before real work |
 | `event` `session.created` | `session` | SessionStart |
 | `event` `session.idle` | `stop-archive` | archive only, fail-open |
 | `experimental.chat.system.transform` | (none) | appends the reflex rules to the system prompt of EVERY model request, whatever the model (pinned to OpenCode 1.19.5; the e2e asserts every request carried them) |
@@ -57,7 +57,7 @@ The generated `opencode.json` holds the minimum: `$schema` and the plugin entry
 
 ## Uninstall
 
-`install` records, once, the machine state it changes: the global `core.hooksPath`, whether `~/.claude/settings.json`, `~/.wk-harness` and `~/.wk-harness-hooks` existed, and which shims it created (`wkappbot` beside the CLI, `wkskill` and `wk-verify` in `~/.local/bin`). `wkappbot-code uninstall` gives exactly that back: the recorded `core.hooksPath` (only when the current value is a hook folder the install wrote), the harness hook entries leave `settings.json` while yours stay (a file the install created is removed when nothing else is left), the recorded shims go, `~/.wk-harness` and `~/.wk-harness-hooks` go when the install created them, and the plugin entry leaves `opencode.json` (backed up first). It keeps `opencode-ai`, the core and its skills; `npm rm -g wkappbot-code` removes the CLI.
+`install` records, once, the machine state it changes: the global `core.hooksPath`, whether `~/.claude/settings.json`, `~/.wk-harness` and `~/.wk-harness-hooks` existed, and which shims it created (`wkappbot` beside the CLI and `wk-verify` in `~/.local/bin`; no `wkskill` command exists, the skill command is `wkappbot skill`). `wkappbot-code uninstall` gives exactly that back: the recorded `core.hooksPath` (only when the current value is a hook folder the install wrote), the harness hook entries leave `settings.json` while yours stay (a file the install created is removed when nothing else is left), the recorded shims go, `~/.wk-harness` and `~/.wk-harness-hooks` go when the install created them, and the plugin entry leaves `opencode.json` (backed up first). It keeps `opencode-ai`, the core and its skills; `npm rm -g wkappbot-code` removes the CLI.
 
 ## Model swap
 

package/bin/postinstall.js

@@ -7,7 +7,7 @@
 // CONTRACT: (a) ALWAYS exits 0 and returns within a moment -- the real work runs DETACHED and logs to
 // ~/.wkappbot-code/postinstall.log; (b) the worker runs `wkappbot-code install` (lays the web harness, wires
 // ~/.claude/settings.json through the lite harness -- PreToolUse, Stop, UserPromptSubmit, SessionStart -- the global git
-// hooks, the wkskill/wk-verify shims and the public skills, keeping every user setting), then `wkappbot-code doctor`,
+// hooks, the wk-verify shim and the public skills, keeping every user setting), then `wkappbot-code doctor`,
 // then a short self-test (lib/setup-run.js: core --version, skill read on-load, one hook allow, one hook refuse), and
 // writes ~/.wkappbot-code/postinstall.done {version, installRc, doctor:{pass,warn,fail,skip}, selftest:{n,m}, ...};
 // postinstall.running exists while the worker lives; (c) the first `wkappbot-code` run afterwards prints ONE summary

package/bin/wkappbot-code.js

@@ -40,7 +40,7 @@ import {
 import { homedir, tmpdir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { quietCheck, runUpdate, updateRow } from "../lib/update.js"; import { rmTreeHard } from "../lib/rmtree.js"; import { plainFileUrl } from "../lib/fileurl.js";
+import { quietCheck, runUpdate, updateRow } from "../lib/update.js"; import { rmTreeHard } from "../lib/rmtree.js"; import { plainFileUrl } from "../lib/fileurl.js"; import { removeStaleWkskill } from "../lib/stale-wkskill.js";
 import { applySets, askEach, buildConfig, configRow, detect, lineDiff, printDetected } from "../lib/config.js";
 import { aiCliRows, installAiClis, removeAiClis } from "../lib/ai-clis.js";
 import { hooksRow, wireClaudeHooks } from "../lib/hook-wire.js";
@@ -400,7 +400,7 @@ function installPlugin(o, kih, kihSource) {
 // The machine state an uninstall must give back, recorded ONCE (a re-install never overwrites the first record, or
 // it would record our own dispatcher as the "prior" hooksPath). Shim paths are those install may create.
 function shimCandidates() {
-  return [join(linkDir(), "wkappbot"), join(HARNESS_LINKS(), "wkskill"), join(HARNESS_LINKS(), "wk-verify"), join(HARNESS_LINKS(), "wkskill.cmd"), join(HARNESS_LINKS(), "wk-verify.cmd")];   // Windows (Git Bash) .cmd twins from harness-install.sh: recorded like the rest, so uninstall removes them, never a user file
+  return [join(linkDir(), "wkappbot"), join(HARNESS_LINKS(), "wk-verify"), join(HARNESS_LINKS(), "wk-verify.cmd")];   // Windows (Git Bash) .cmd twins from harness-install.sh: recorded like the rest, so uninstall removes them, never a user file
 }
 const PRE_SETTINGS = () => join(STATE_HOME(), "settings.pre-install.json");
 function recordPrior(prev) {
@@ -562,7 +562,7 @@ function uninstall(o) {
   }
   // 3b. the ~/.local/bin/wkappbot link: removed ONLY when it points at the core this install placed (the core file stays)
   const core = (st.bin && st.bin.dest) || binDest(o);
-  removeStarterMd(st.starterMd, log);
+  removeStarterMd(st.starterMd, log); removeStaleWkskill(HARNESS_LINKS(), log);  // an older harness install's counterfeit wkskill link (SDK e2e: local-bin=wkskill)
   let linkRemoved = "";
   for (const p of new Set(shimCandidates().concat([join(homedir(), ".local", "bin", "wkappbot")]))) {
     if (!isSymlink(p) || (st.shims || []).includes(p)) continue;

package/lib/allow-compact.js

@@ -9,7 +9,6 @@ import { dirname } from "node:path";
 import { readSettings } from "./hook-wire.js";
 
 export const COMPACT_ALLOWS = [
-  "Bash(wkskill *)",               // skill read / search / like (the user's own store)
   "Bash(wkappbot skill *)",        // the same through the core
   "Bash(wkappbot file read *)",    // read-only file view
   "Bash(wk-verify)",               // live hook check, no arguments

package/lib/hook-wire.js

@@ -20,7 +20,10 @@ import { pickPython, stubWarning } from "./python-pick.js";
 // for harness hooks and deleted or rewrote them. Now a harness hook is a wkharness*.sh/.ps1/.cmd file name standing at a
 // path or word start, a file under a .wk-harness folder, the kih .claude/hooks scripts, or the two named sync hooks.
 const HARNESS_HOOK = /(^|[\s"'\\/])wkharness(-[\w-]+)?\.(sh|ps1|cmd)\b|\.wk-harness[\\/]|[\\/]\.claude[\\/]hooks[\\/](user-prompt-submit|session-start)\.sh\b|(^|[\s"'\\/])(wk-global-md-sync|wk-session-pull|wkappbot-shim)(\.[a-z0-9]+)?\b/;
-const ARMS = [["PreToolUse", "pre"], ["Stop", "stop"], ["UserPromptSubmit", "prompt"], ["SessionStart", "session"]];
+// The history arms (owner 2026-11-12) push the reflex history like the repo hooks: PostToolUse only for the cross-session
+// tools (a matcher, so no spawn per tool call), PreCompact, SessionEnd and StopFailure (a rate limit).
+const ARMS = [["PreToolUse", "pre"], ["Stop", "stop"], ["UserPromptSubmit", "prompt"], ["SessionStart", "session"],
+  ["PostToolUse", "post", "mcp__claude-code-remote__send_message|ReadNotifications"], ["PreCompact", "precompact"], ["SessionEnd", "sessionend"], ["StopFailure", "stopfail"]];
 const fwd = (p) => String(p || "").replace(/\\/g, "/").replace(/\/+$/, "");
 
 export function readSettings(path) {
@@ -80,10 +83,10 @@ export function wireSettings(path, lite) {
     }
     if (keep.length) out[ev] = keep;
   }
-  for (const [ev, arm] of ARMS) {
+  for (const [ev, arm, matcher] of ARMS) {
     const c = '"' + lite + '" ' + arm;
     if (!(out[ev] || []).some((g) => (g.hooks || []).some((h) => h.command === c)))
-      (out[ev] = out[ev] || []).push({ hooks: [{ type: "command", command: c, timeout: 10 }] });
+      (out[ev] = out[ev] || []).push({ ...(matcher ? { matcher } : {}), hooks: [{ type: "command", command: c, timeout: 10 }] });
   }
   d.hooks = out;
   mkdirSync(dirname(path), { recursive: true });

package/lib/stale-wkskill.js

@@ -0,0 +1,23 @@
+// stale-wkskill.js -- uninstall also removes the counterfeit wkskill command an OLDER harness install left in the link dir
+// (owner 2026-11-11: the fake wkskill is deleted; spokesman 2026-11-12: SDK e2e "after: local-bin=wkskill", RESULT 20/21 on every leg).
+// A link or .cmd twin is removed ONLY while it still points into a harness (its target or body names wkharness or wk-harness);
+// a wkskill file or link of the user's own stays. Spec: wkappbot skill read harness-installer-owns-all-setup
+import { lstatSync, readFileSync, readlinkSync, rmSync } from "node:fs";
+import { join } from "node:path";
+
+const isHarness = (s) => /wkharness|wk-harness/.test(String(s || ""));
+
+// -> the paths removed; log gets one line per candidate
+export function removeStaleWkskill(dir, log = () => {}) {
+  const removed = [];
+  for (const n of ["wkskill", "wkskill.cmd"]) {
+    const p = join(dir, n);
+    let st;
+    try { st = lstatSync(p); } catch { continue; }
+    let body = "";
+    try { body = st.isSymbolicLink() ? readlinkSync(p) : readFileSync(p, "utf8"); } catch { /* unreadable: kept */ }
+    if (isHarness(body)) { rmSync(p, { force: true }); removed.push(p); log("shim: removed " + p + " (the counterfeit wkskill command an older harness install linked)"); }
+    else log("shim: kept " + p + " (not a harness link)");
+  }
+  return removed;
+}

package/lib/wk-hook.js

@@ -301,16 +301,16 @@ export function isFastRead(tool, input) {
 }
 
 // SHIM PATH (SDK ROOT C 2026-11-06, run 42289814533): OpenCode's bash tool runs /bin/zsh on macOS, whose default PATH
-// has no ~/.local/bin, so "zsh:1: command not found: wkskill" and a Mac user could never pay the intent lock. A bash call
-// that names wkskill or wk-verify gets the shim dir (WK_LINK_DIR, else ~/.local/bin, where harness install.sh links
+// has no ~/.local/bin, so "zsh:1: command not found: wkappbot" and a Mac user could never pay the intent lock. A bash call
+// that names wkappbot or wk-verify gets the shim dir (WK_LINK_DIR, else ~/.local/bin, where harness install.sh links
 // them) prepended to PATH for that one command; nothing else changes. Returns the command to run (unchanged when the
 // shim is absent or the command names neither shim).
 export function withShimPath(tool, args, linkDir) {
   if (claudeToolName(tool) !== "Bash" || !args || typeof args.command !== "string") return args && args.command;
   const c = args.command;
-  if (!/(^|[\s;&|(`])(wkskill|wk-verify)(\s|$)/.test(c)) return c;
+  if (!/(^|[\s;&|(`])(wkappbot|wk-verify)(\s|$)/.test(c)) return c;
   const dir = linkDir || process.env.WK_LINK_DIR || join(homedir(), ".local", "bin");
-  if (!existsSync(join(dir, "wkskill")) && !existsSync(join(dir, "wk-verify"))) return c;
+  if (!existsSync(join(dir, "wkappbot")) && !existsSync(join(dir, "wk-verify"))) return c;
   if (c.startsWith("PATH=")) return c;
   return "PATH=" + JSON.stringify(dir) + ':"$PATH"; export PATH; ' + c;
 }
@@ -323,10 +323,10 @@ export const RULES_MARK = "[wisdom-kernel rules]";
 export const RULES = [
   RULES_MARK + " You run under the Wisdom Kernel harness (wkappbot-code). On every turn:",
   "1. One command per shell call; never chain a write with anything else.",
-  "2. A refusal names a skill: run wkskill read <id> (or wkappbot skill read <id>) and apply its remedy; never route around it.",
+  "2. A refusal names a skill: run wkappbot skill read <id> and apply its remedy; never route around it.",
   "3. Never use git --no-verify or git push --force, never change core.hooksPath, never rm -r a home directory, / or the project source.",
   "4. Never edit or delete files under .git.",
-  "5. After a new user prompt, run wkskill search <three or more words> before the first write; read-only tools stay open.",
+  "5. After a new user prompt, run wkappbot skill search <three or more words> before the first write; read-only tools stay open.",
 ].join("\n");
 
 // The top step lines of the on-load skill, fetched ONCE per process (one OpenCode server = its sessions) in the
@@ -337,7 +337,7 @@ export function onLoadLines(kihDir) {
   if (_onload) return _onload;
   _onload = new Promise((res) => {
     const k = kihDir || resolveKihDir();
-    const cands = [process.env.WK_APPBOT_SKILL_CMD, k && join(k, "bin", "wkskill"), "wkskill"].filter(Boolean);
+    const cands = [process.env.WK_APPBOT_SKILL_CMD, k && join(k, "bin", "wkappbot"), "wkappbot"].filter(Boolean);
     let out = "", done = false;
     const finish = () => {
       if (done) return; done = true;
@@ -347,9 +347,9 @@ export function onLoadLines(kihDir) {
       res(lines.slice(0, 3).map((l) => l.slice(0, 240)));
     };
     try {
-      const target = cands.find((p) => p === "wkskill" || existsSync(p)), opt = { stdio: ["ignore", "pipe", "ignore"] };
-      // Windows: a shell-less spawn cannot run a .cmd shim, the bare wkskill name (PATHEXT) or an extensionless sh script
-      const c = process.platform !== "win32" ? spawn(target, ["read", "on-load"], opt) : /\.exe$/i.test(target) ? spawn(target, ["read", "on-load"], opt) : /\.(cmd|bat)$/i.test(target) || target === "wkskill" ? spawn(target, ["read", "on-load"], { ...opt, shell: true }) : spawn("sh", [target.replace(/\\/g, "/"), "read", "on-load"], opt);
+      const target = cands.find((p) => p === "wkappbot" || existsSync(p)), opt = { stdio: ["ignore", "pipe", "ignore"] };
+      // Windows: a shell-less spawn cannot run a .cmd shim, the bare wkappbot name (PATHEXT) or an extensionless sh script
+      const c = process.platform !== "win32" ? spawn(target, ["skill", "read", "on-load"], opt) : /\.exe$/i.test(target) ? spawn(target, ["skill", "read", "on-load"], opt) : /\.(cmd|bat)$/i.test(target) || target === "wkappbot" ? spawn(target, ["skill", "read", "on-load"], { ...opt, shell: true }) : spawn("sh", [target.replace(/\\/g, "/"), "skill", "read", "on-load"], opt);
       c.stdout.on("data", (d) => { out += d; if (out.length > 65536) c.kill("SIGKILL"); });
       c.on("error", finish); c.on("close", finish);
       setTimeout(() => { try { c.kill("SIGKILL"); } catch {} finish(); }, 8000).unref();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wkappbot-code",
-  "version": "0.3.22",
+  "version": "0.3.23",
   "description": "wkappbot-code -- Wisdom Kernel: the pinned OpenCode bridge plus the reflex harness plugin, the wkappbot core, the web harness and the latest public skills in one install",
   "type": "module",
   "scripts": {

package/plugin/wisdom-kernel.js

@@ -51,7 +51,7 @@ export const WisdomKernel = async (ctx = {}, options = {}) => {
             (tail ? ": " + tail : "") + ". Fix the harness (wkappbot-code doctor) and retry.");
         }
       }
-      // macOS /bin/zsh has no ~/.local/bin on PATH: a wkskill call gets the shim dir for that one command (lib/wk-hook.js).
+      // macOS /bin/zsh has no ~/.local/bin on PATH: a wkappbot call gets the shim dir for that one command (lib/wk-hook.js).
       try { if (args && typeof args.command === "string") args.command = H.withShimPath(inp.tool, args); } catch {}
     },
     "tool.execute.after": async (input, output) => {

package/templates/global-CLAUDE.md

@@ -5,7 +5,7 @@ change it, install never touches it again, and `wkappbot-code uninstall` leaves
 
 ## How to work
 - Reply in the language the user writes in. Keep replies short and concrete; lead with the result.
-- Before real work, find the skill that governs it: `wkskill search <three or more words>`, then `wkskill read <id>`,
+- Before real work, find the skill that governs it: `wkappbot skill search <three or more words>`, then `wkappbot skill read <id>`,
   and follow the road it gives. Search again for any term you are not sure of, instead of guessing.
 - Run, do not guess: prove a change by running its test or command, and report the real output, failures included.
 - One command per tool call. Change only what the task needs, and back up a config file before you edit it.