wkappbot-code 0.3.23 → 0.3.26

package/bin/wkappbot-code.js

@@ -40,7 +40,7 @@ import {
 import { homedir, tmpdir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { quietCheck, runUpdate, updateRow } from "../lib/update.js"; import { rmTreeHard } from "../lib/rmtree.js"; import { plainFileUrl } from "../lib/fileurl.js"; import { removeStaleWkskill } from "../lib/stale-wkskill.js";
+import { quietCheck, runUpdate, updateRow } from "../lib/update.js"; import { rmTreeHard } from "../lib/rmtree.js"; import { plainFileUrl } from "../lib/fileurl.js"; import { removeStaleWkskill } from "../lib/stale-wkskill.js"; import { checkPath, installBothLinks, removeCreatedLinks } from "../lib/doctor-path.js";
 import { applySets, askEach, buildConfig, configRow, detect, lineDiff, printDetected } from "../lib/config.js";
 import { aiCliRows, installAiClis, removeAiClis } from "../lib/ai-clis.js";
 import { hooksRow, wireClaudeHooks } from "../lib/hook-wire.js";
@@ -455,9 +455,8 @@ function install(o) {
     : ((prev.aiClis && (prev.aiClis.installed || []).length) ? prev.aiClis : { skipped: true });  // a skip still owns what an earlier install added
   const dest = binDest(o);
   st.bin = o.bin ? installBin(o) : { skipped: true, dest };
-  // 0.3.13 (owner 2026-11-09: "check that a missing core is handled as a failure"): NO core is a failed part on every
-  // road, an unreachable release host included. The hooks and the lite harness still install, so the risky classes are
-  // refused, but the install exits 1 and the banner says so until a rerun fetches the core.
+  if (o.bin) st.bin.links = installBothLinks({ dest, home: homedir(), env: process.env, log }).created;  // both bare names, recorded for uninstall
+  // 0.3.13: NO core is a failed part on every road (exit 1 until a rerun fetches it); the hooks and lite harness still install.
   if (o.bin && !st.bin.ok) { bad++; log("bin: FAILED -- no wkappbot core installed: " + st.bin.note); }
   st.harness = o.harness ? installHarness(o) : { skipped: true };
   if (o.harness && !st.harness.ok) { bad++; log("harness: FAILED -- " + st.harness.note); }
@@ -578,6 +577,7 @@ function uninstall(o) {
     if (body.includes(core)) { rmSync(cmdShim, { force: true }); linkRemoved = cmdShim; log("shim: removed " + cmdShim + " (it called the core this install placed)"); }
     else log("shim: kept " + cmdShim + " (it no longer calls " + core + ")");
   }
+  removeCreatedLinks(st.bin?.links || []).forEach((p) => log("links: removed " + p));  // only the links install recorded
   // Undo only our npm license marker; do not alter a marker owned by another installer.
   if (IS_WIN && st.bin?.ok) {
     const marker = join(dirname(core), ".wkappbot-code-install");
@@ -657,8 +657,8 @@ function doctor(o) {
     core = r.status === 0 ? (r.stdout || "").trim().split("\n")[0] : "";
     add("bin", !!core, core ? dest + "  " + core + (st.bin && st.bin.link ? "  (PATH link " + st.bin.link + ")" : "") : dest + " does not run", !!(st.bin && !st.bin.skipped));
   }
-  // kih-hook: the harness the plugin calls, and the verdict road it takes. No pwsh and no lite = NO verdict at all:
-  // that is a FAIL whatever the install mode, since the plugin then only refuses its own risky classes.
+  const pr = checkPath({ home: homedir(), env: process.env, platform: process.platform }); add("path", pr.ok, pr.text, true);
+  // kih-hook: the harness the plugin calls and its verdict road; no pwsh and no lite = NO verdict = FAIL whatever the install mode.
   const k = (entry && Array.isArray(entry) && entry[1] && entry[1].kihDir) || kihDir(o);
   const hk = hasHook(k);
   const ps = pwshPath();

package/lib/doctor-path.js

@@ -0,0 +1,293 @@
+// doctor-path.js -- the REQUIRED doctor row "path": are `wkappbot` AND `wkappbot-core` found by their BARE names
+// in a FRESH shell? Proto for wkappbot-code/lib/doctor-path.js. ES module, node built-ins only.
+// Linux/macOS: a login bash (bash -lc) with HOME as given and the OS persistent PATH.
+// Windows: a new cmd.exe whose PATH is machine PATH + user PATH read from the registry.
+// PASS only when each bare-name run prints "wkappbot v". Any other outcome is FAIL for that name.
+import { execFileSync } from "node:child_process";
+import { appendFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+
+const OK_MARK = "wkappbot v";
+const BINS = ["wkappbot", "wkappbot-core"];
+
+// One REG_SZ/REG_EXPAND_SZ Path value from the registry; "" when absent or reg is unavailable.
+function winRegPath(key) {
+  try {
+    const out = execFileSync("reg", ["query", key, "/v", "Path"], {
+      encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 15000,
+    });
+    const m = out.match(/^\s*Path\s+REG_(?:EXPAND_)?SZ\s+(.*?)\s*$/m);
+    return m ? m[1] : "";
+  } catch {
+    return "";
+  }
+}
+
+// %VAR% expansion for registry values such as %USERPROFILE%\bin; unknown names are kept as written.
+function expandVars(s, env) {
+  return s.replace(/%([^%]+)%/g, (all, name) => (env[name] !== undefined ? env[name] : all));
+}
+
+// The real POSIX road: a login bash, as a user's new terminal starts. /etc/profile may reset PATH.
+export function loginShell(h, env, bin) {
+  try {
+    return execFileSync("bash", ["-lc", `command -v ${bin} && ${bin} --version`], {
+      encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 60000,
+      env: { HOME: h, PATH: env.PATH || "/usr/local/bin:/usr/bin:/bin" },
+    });
+  } catch (e) {
+    return typeof e.stdout === "string" ? e.stdout : "";
+  }
+}
+
+// checkPath({home, env, platform, readRegPath, runShell}) -> {ok, text}
+//   home        HOME (or USERPROFILE on Windows) the fresh shell starts in
+//   env         carries the OS persistent PATH (PATH key; default process.env)
+//   platform    process.platform by default; "win32" selects the registry road
+//   readRegPath injectable registry reader (tests pass a stub)
+//   runShell    injectable POSIX fresh-shell runner (default loginShell; the selftest injects a hermetic one)
+export function checkPath({ home, env = process.env, platform = process.platform, readRegPath = winRegPath, runShell = loginShell } = {}) {
+  const h = home || env.HOME || env.USERPROFILE || "";
+  let winPath = null;
+  const fails = [];
+  for (const bin of BINS) {
+    let out = "";
+    if (platform === "win32") {
+      if (winPath === null) {
+        const machine = expandVars(readRegPath("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment"), env);
+        const user = expandVars(readRegPath("HKCU\\Environment"), env);
+        winPath = [machine, user].filter(Boolean).join(";");
+      }
+      try {
+        out = execFileSync("cmd.exe", ["/d", "/s", "/c", `${bin} --version`], {
+          encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 60000,
+          env: { SystemRoot: env.SystemRoot || "C:\\Windows", USERPROFILE: h, HOME: h, PATH: winPath },
+        });
+      } catch (e) {
+        out = typeof e.stdout === "string" ? e.stdout : "";
+      }
+    } else {
+      out = runShell(h, env, bin);
+    }
+    if (!out.includes(OK_MARK)) fails.push(bin);
+  }
+  if (fails.length) return { ok: false, text: fails.map((b) => `path: FAIL ${b} not found by bare name in a fresh shell`).join("; ") };
+  return { ok: true, text: "path: PASS wkappbot and wkappbot-core found by bare name in a fresh shell" };
+}
+
+// ---- installer helper: create the missing links on the persistent PATH ----------------------------------------
+
+const WIN_MACHINE_KEY = "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment";
+const WIN_USER_KEY = "HKCU\\Environment";
+
+// The PERSISTENT PATH entries. win32: machine Path then user Path from the registry (%VAR% expanded), the same
+// values a new cmd.exe is built from; the process PATH is never consulted there. POSIX: the PATH given in env.
+function persistentEntries(env, platform, readRegPath) {
+  if (platform !== "win32") return (env.PATH || "").split(":");
+  const machine = expandVars(readRegPath(WIN_MACHINE_KEY), env);
+  const user = expandVars(readRegPath(WIN_USER_KEY), env);
+  return [machine, user].join(";").split(";");
+}
+
+const onPathList = (env, platform, dir, readRegPath = winRegPath) => {
+  const norm = (p) => p.replace(/[\\/]+$/, "").toLowerCase();
+  return persistentEntries(env, platform, readRegPath).some((p) => p && norm(p) === norm(dir));
+};
+
+function occupied(p) {
+  try { lstatSync(p); return true; } catch { return false; }
+}
+
+function defaultNpmPrefix(platform) {
+  try {
+    return execFileSync(platform === "win32" ? "npm.cmd" : "npm", ["prefix", "-g"], {
+      encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 20000, shell: platform === "win32",
+    }).trim();
+  } catch {
+    return "";
+  }
+}
+
+// The folder the links go in: npm global bin first, then ~/.local/bin. Prefers a folder already on PATH.
+// needsPath is true when neither is on the persistent PATH (then ensureLinks adds the chosen folder).
+export function pickBinDir({ home, env = process.env, platform = process.platform, npmPrefix = defaultNpmPrefix(platform), readRegPath = winRegPath } = {}) {
+  const npmBin = npmPrefix ? (platform === "win32" ? npmPrefix : join(npmPrefix, "bin")) : "";
+  const local = join(home, ".local", "bin");
+  const candidates = [npmBin, local].filter(Boolean);
+  const hit = candidates.find((d) => onPathList(env, platform, d, readRegPath));
+  if (hit) return { dir: hit, needsPath: false };
+  return { dir: candidates[0] || local, needsPath: true };
+}
+
+const exportLine = (dir) => `export PATH="${dir}:$PATH"`;
+const trimSlash = (p) => p.replace(/[\\/]+$/, "").toLowerCase();
+
+// PowerShell does the user-Path write: [Environment]::SetEnvironmentVariable broadcasts the settings change.
+// The folder arrives in an env var, never in the script text. Prints ADDED, or PRESENT when it is already there.
+const WIN_ADD_SCRIPT = [
+  "$ErrorActionPreference = 'Stop'",
+  "$d = $env:WK_PATH_DIR",
+  "$cur = [Environment]::GetEnvironmentVariable('Path', 'User')",
+  "if ($null -eq $cur) { $cur = '' }",
+  "$want = $d.TrimEnd([char[]]@('\\', '/')).ToLowerInvariant()",
+  "$hit = @($cur.Split(';') | Where-Object { $_ -and ($_.TrimEnd([char[]]@('\\', '/')).ToLowerInvariant() -eq $want) })",
+  "if ($hit.Count -gt 0) { Write-Output 'PRESENT'; exit 0 }",
+  "$new = if ($cur.Trim() -eq '') { $d } else { $cur.TrimEnd(';') + ';' + $d }",
+  "[Environment]::SetEnvironmentVariable('Path', $new, 'User')",
+  "Write-Output 'ADDED'",
+].join("\n");
+
+// Removes exactly the folder's entries from the user Path (untouched entries keep their order and text).
+const WIN_REMOVE_SCRIPT = [
+  "$ErrorActionPreference = 'Stop'",
+  "$d = $env:WK_PATH_DIR",
+  "$cur = [Environment]::GetEnvironmentVariable('Path', 'User')",
+  "if ($null -eq $cur) { Write-Output 'ABSENT'; exit 0 }",
+  "$want = $d.TrimEnd([char[]]@('\\', '/')).ToLowerInvariant()",
+  "$keep = @($cur.Split(';') | Where-Object { -not ($_ -and ($_.TrimEnd([char[]]@('\\', '/')).ToLowerInvariant() -eq $want)) })",
+  "$new = $keep -join ';'",
+  "if ($new -eq $cur) { Write-Output 'ABSENT'; exit 0 }",
+  "[Environment]::SetEnvironmentVariable('Path', $new, 'User')",
+  "Write-Output 'REMOVED'",
+].join("\n");
+
+function psRun(script, dir) {
+  return execFileSync("powershell", ["-NoProfile", "-NonInteractive", "-Command", script], {
+    encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 30000,
+    env: { ...process.env, WK_PATH_DIR: dir },
+  }).trim();
+}
+
+// Windows: append the folder to the USER Path. PowerShell first; the reg add road only when PowerShell fails.
+// Returns true only when this call wrote the entry (so uninstall removes only what install added).
+function addUserPathWin(dir, readRegPath) {
+  try {
+    return psRun(WIN_ADD_SCRIPT, dir) === "ADDED";
+  } catch {
+    const cur = readRegPath(WIN_USER_KEY);
+    if (cur.split(";").some((p) => p && trimSlash(p) === trimSlash(dir))) return false;
+    const next = cur ? cur + ";" + dir : dir;
+    execFileSync("reg", ["add", WIN_USER_KEY, "/v", "Path", "/t", "REG_EXPAND_SZ", "/d", next, "/f"], { stdio: "ignore", timeout: 15000 });
+    return true;
+  }
+}
+
+// Default PATH addition: POSIX appends an export line to ~/.profile; Windows appends to the user Path value.
+// Returns true only when this call wrote the PATH entry.
+function defaultAddToPath({ dir, home, platform, readRegPath = winRegPath }) {
+  try {
+    if (platform === "win32") return addUserPathWin(dir, readRegPath);
+    const profile = join(home, ".profile");
+    const text = existsSync(profile) ? readFileSync(profile, "utf8") : "";
+    if (text.includes(dir)) return false;
+    appendFileSync(profile, `\n${exportLine(dir)}\n`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// Uninstall side of defaultAddToPath: removes exactly the entry install wrote. Returns true when something was removed.
+function defaultRemovePath({ dir, home, platform }) {
+  try {
+    if (platform === "win32") return psRun(WIN_REMOVE_SCRIPT, dir) === "REMOVED";
+    const profile = join(home, ".profile");
+    if (!existsSync(profile)) return false;
+    const lines = readFileSync(profile, "utf8").split("\n");
+    const keep = lines.filter((l) => l !== exportLine(dir));
+    if (keep.length === lines.length) return false;
+    writeFileSync(profile, keep.join("\n"));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// ensureLinks({home, platform, binDir, env, targets, npmPrefix, addToPath}) -> {created, dir, pathAdded}
+//   targets  REQUIRED {wkappbot: <core path>, "wkappbot-core": <core path>}; the installer passes the real files.
+//   Creates a link (POSIX symlink) or a .cmd shim (Windows) only where NOTHING exists yet: a user's own file is
+//   never overwritten and never listed in created. created is exactly what removeCreatedLinks may delete.
+export function ensureLinks({ home, platform = process.platform, binDir, env = process.env, targets, npmPrefix, addToPath = defaultAddToPath, readRegPath = winRegPath } = {}) {
+  if (!targets || !targets.wkappbot || !targets["wkappbot-core"]) throw new Error("ensureLinks: targets {wkappbot, wkappbot-core} required");
+  let dir = binDir, needsPath = false;
+  if (dir) needsPath = !onPathList(env, platform, dir, readRegPath);
+  else ({ dir, needsPath } = pickBinDir({ home, env, platform, npmPrefix, readRegPath }));
+  mkdirSync(dir, { recursive: true });
+  const created = [];
+  for (const bin of BINS) {
+    const dest = join(dir, platform === "win32" ? bin + ".cmd" : bin);
+    if (occupied(dest)) continue;
+    if (platform === "win32") writeFileSync(dest, `@"${targets[bin]}" %*\r\n`);
+    else symlinkSync(targets[bin], dest);
+    created.push(dest);
+  }
+  // Windows runs the PATH logic even when both shims already existed: the doctor row reads the persistent PATH,
+  // so a missing entry is a FAIL whether or not this run wrote a shim. POSIX keeps its old rule (a link was written).
+  const pathWanted = needsPath && (created.length > 0 || platform === "win32");
+  // POSIX: note whether ~/.profile existed BEFORE addToPath, so uninstall deletes only a profile install created.
+  const profilePath = platform === "win32" ? "" : join(home, ".profile");
+  const profileExisted = !!profilePath && existsSync(profilePath);
+  const pathAdded = pathWanted ? !!addToPath({ dir, home, platform, readRegPath }) : false;
+  const profileCreated = pathAdded && !profileExisted && !!profilePath && existsSync(profilePath) ? profilePath : "";
+  return { created, dir, pathAdded, profileCreated };
+}
+
+// removeCreatedLinks(created, opts) -> the entries actually removed. Deletes only the listed entries, nothing else.
+// A "PATH:<folder>" entry is the PATH entry install added: it is removed by removePath (exactly that folder),
+// never by unlink. A "PROFILE:<path>" entry is the ~/.profile install created: it is deleted only when its text is
+// blank again (trim() empty), so a profile the user wrote into is never removed. opts: platform, home, and an
+// injectable removePath({dir, home, platform}) -> boolean.
+export function removeCreatedLinks(created = [], { platform = process.platform, home = process.env.HOME || process.env.USERPROFILE || "", removePath = defaultRemovePath } = {}) {
+  const removed = [];
+  for (const p of created) {
+    if (p.startsWith("PATH:")) {
+      try { if (removePath({ dir: p.slice(5), home, platform })) removed.push(p); } catch { /* not removed */ }
+      continue;
+    }
+    if (p.startsWith("PROFILE:")) {
+      try {
+        const f = p.slice(8);
+        if (existsSync(f) && readFileSync(f, "utf8").trim() === "") { unlinkSync(f); removed.push(p); }
+      } catch { /* not removed */ }
+      continue;
+    }
+    try { unlinkSync(p); removed.push(p); } catch { /* already gone */ }
+  }
+  return removed;
+}
+
+// installBothLinks({dest, home, platform, binDir, env, log}) -> {created, pathAdded, kept, dir}
+//   ALWAYS makes both bare names, wkappbot and wkappbot-core, in binDir (env WK_LINK_DIR, else ~/.local/bin).
+//   dest is the core file; Windows wkappbot-core.cmd points at wkappbot-core.exe beside it. A user's own file
+//   stays and is listed in kept (and logged), never in created. A path already holding THIS install's link (a
+//   re-install) is ours: it is recorded in created again, so uninstall removes it and the folder is left empty.
+export function installBothLinks({ dest, home, platform = process.platform, binDir, env = process.env, log = () => {}, addToPath = defaultAddToPath, readRegPath = winRegPath } = {}) {
+  const dir = binDir || env.WK_LINK_DIR || join(home, ".local", "bin");
+  const coreExe = platform === "win32" ? join(dirname(dest), "wkappbot-core.exe") : dest;
+  const targets = { wkappbot: dest, "wkappbot-core": coreExe };
+  const pathOf = (bin) => join(dir, platform === "win32" ? bin + ".cmd" : bin);
+  const ours = BINS.filter((bin) => occupied(pathOf(bin)) && isOurLink(pathOf(bin), targets[bin], platform));
+  const kept = BINS.filter((bin) => occupied(pathOf(bin)) && !ours.includes(bin));
+  for (const bin of kept) log("links: kept " + join(dir, bin) + " (not ours)");
+  const r = ensureLinks({ home, platform, binDir: dir, env, targets, addToPath, readRegPath });
+  const created = BINS.map(pathOf).filter((p) => r.created.includes(p) || ours.some((bin) => pathOf(bin) === p));
+  if (r.pathAdded) created.push("PATH:" + dir);  // recorded only when this install wrote the PATH entry
+  if (r.profileCreated) created.push("PROFILE:" + r.profileCreated);  // right after PATH: the profile install made
+  return { created, pathAdded: r.pathAdded, kept, dir };
+}
+
+// An occupied link path is OURS when a POSIX symlink resolves to the target this install would create, or a
+// Windows .cmd shim names that target. Anything else (a user's own file or symlink) is not ours.
+function isOurLink(p, target, platform) {
+  try {
+    if (platform === "win32") return readFileSync(p, "utf8").includes(`"${target}"`);
+    return lstatSync(p).isSymbolicLink() && resolve(dirname(p), readlinkSync(p)) === resolve(target);
+  } catch {
+    return false;
+  }
+}
+
+// removeRecorded(created): the uninstall side of installBothLinks; removes only what that install recorded.
+export function removeRecorded(created) {
+  return removeCreatedLinks(Array.isArray(created) ? created : []);
+}

package/lib/hook-wire.js

@@ -61,11 +61,19 @@ function route(cmd, lite) {
   return null;
 }
 
+// A dev seat: a harness checkout beside this lite (its .claude/hooks/wkharness-run.sh exists) that is not a web user install
+// (no .wk-user-install marker in the harness folder). Python --wire uses the same two tests (tools/wkharness-lite.sh).
+export function isDevSeat(lite) {
+  const kih = dirname(dirname(lite));
+  return existsSync(join(kih, ".claude", "hooks", "wkharness-run.sh")) && !existsSync(join(kih, ".wk-user-install"));
+}
+
 // The node port of --wire, plus the create step of the web installer. Throws on a settings file that is not JSON.
 export function wireSettings(path, lite) {
   const r = readSettings(path);
   if (!r.ok) throw new Error(path + " is not plain JSON (" + r.err + ")");
   const d = r.json || {};
+  const dev = isDevSeat(lite) && harnessHooks(d).some((h) => /wkharness-run\.sh/.test(h.command));
   const out = {};
   for (const [ev, groups] of Object.entries(d.hooks && typeof d.hooks === "object" ? d.hooks : {})) {
     const keep = [];
@@ -75,6 +83,8 @@ export function wireSettings(path, lite) {
       const seen = new Set(), hs = [];
       for (const h of asHooks(g)) {
         const cmd = String((h && h.command) || "");
+        // a dev seat runs its full harness and never also the lite one (owner 2026-11-12): lite entries go, the rest stay verbatim
+        if (dev) { if (!/wkharness-lite\.sh/.test(cmd)) hs.push(h); continue; }
         const c = HARNESS_HOOK.test(cmd) ? route(cmd, lite) : null;  // only a harness hook is ever rewritten
         if (c && !seen.has(c)) { seen.add(c); hs.push({ type: "command", command: c, timeout: 10 }); }
         else if (!c && !HARNESS_HOOK.test(cmd)) hs.push(h);  // a user's own hook stays verbatim
@@ -83,7 +93,8 @@ export function wireSettings(path, lite) {
     }
     if (keep.length) out[ev] = keep;
   }
-  for (const [ev, arm, matcher] of ARMS) {
+  // a dev seat gets no lite arm added: its full harness is the only chain
+  if (!dev) for (const [ev, arm, matcher] of ARMS) {
     const c = '"' + lite + '" ' + arm;
     if (!(out[ev] || []).some((g) => (g.hooks || []).some((h) => h.command === c)))
       (out[ev] = out[ev] || []).push({ ...(matcher ? { matcher } : {}), hooks: [{ type: "command", command: c, timeout: 10 }] });
@@ -124,6 +135,16 @@ function wireClaudeHooksInner(o) {
     log("hooks: WARN " + o.settings + " is not plain JSON (" + before.err + "); left untouched -- please fix it, then run: wkappbot-code install");
     return res;
   }
+  // A dev seat with both its full hook and a lite entry (owner 2026-11-12: two Stop chains fired): drop the lite entries
+  // and keep the full hook, whatever state the settings reports as.
+  const liteOnDisk = join(o.kih, "tools", "wkharness-lite.sh");
+  if (before.hooks.some((h) => /wkharness-run\.sh/.test(h.command)) && before.hooks.some((h) => /wkharness-lite\.sh/.test(h.command)) && isDevSeat(liteOnDisk)) {
+    wireSettings(o.settings, liteOnDisk);
+    const dev = analyzeHooks(o.settings, o.kih);
+    res.after = dev.state; res.changed = true;
+    log("hooks: " + o.settings + " runs the full harness on this dev seat; its lite hook entries were removed");
+    return res;
+  }
   if (before.state === "ours") { log("hooks: " + o.settings + " already runs every harness hook from " + o.kih); return res; }
   // A FULL harness hook (wkharness-run.sh, the pwsh hub of a dev seat) is never rewritten into the lite one where pwsh
   // runs: the rewrite would downgrade the owner's own seats. Leave it and say what to do.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wkappbot-code",
-  "version": "0.3.23",
+  "version": "0.3.26",
   "description": "wkappbot-code -- Wisdom Kernel: the pinned OpenCode bridge plus the reflex harness plugin, the wkappbot core, the web harness and the latest public skills in one install",
   "type": "module",
   "scripts": {