wkappbot-code 0.3.25 → 0.3.27

package/README.md

@@ -63,7 +63,7 @@ The generated `opencode.json` holds the minimum: `$schema` and the plugin entry
 
 - One headless turn: `opencode run -m provider/model "prompt"`
 - Inside the TUI: `/models`
-- Any OpenAI-compatible endpoint: declare a provider with `"npm": "@ai-sdk/openai-compatible"` and `"options": { "baseURL": "{env:MY_BASE_URL}", "apiKey": "{env:MY_API_KEY}" }` in your own `opencode.json`. No key is stored in a file.
+- Any OpenAI-compatible endpoint: `wkappbot-code provider add acme --base-url-env MY_BASE_URL --api-key-env MY_API_KEY --model my-model` writes an `@ai-sdk/openai-compatible` provider into your `opencode.json` (`"baseURL": "{env:MY_BASE_URL}"`, `"apiKey": "{env:MY_API_KEY}"`), then `opencode run -m acme/my-model`. The arguments are env var NAMES: a key or a URL typed in their place is refused, and no key is stored in a file. The file is backed up first, a config that is not plain JSON is left untouched, and an existing provider of the same id needs `--force`. `provider list` prints ids and env var names only, `provider remove ID` deletes just that provider, `uninstall` keeps your providers, and `doctor` WARNs (names only) when a referenced variable is unset.
 
 ## In the browser WebVM (no login needed)
 

package/bin/wkappbot-code.js

@@ -18,6 +18,7 @@
 //   wkappbot-code doctor  [opts]       one PASS/WARN/FAIL/SKIP row per part (exit 1 if a required part fails)
 //   wkappbot-code update  [opts]       newer version.json -> tgz sha256-checked -> npm i -g -> install --update (lib/update.js)
 //   wkappbot-code config  [opts]       detect provider/model/plugin/harness, edit at a TTY, merge into opencode.json (lib/config.js)
+//   wkappbot-code provider add|list|remove   an OpenAI-compatible endpoint (env var NAMES only) in opencode.json (lib/providers.js)
 //   wkappbot-code uninstall [opts]     undo install: the recorded pre-install global core.hooksPath comes back, the
 //                  harness hook arms leave ~/.claude/settings.json (your own entries stay), the recorded shims
 //                  leave the bin dirs, ~/.wk-harness and ~/.wk-harness-hooks go, the plugin entry leaves opencode.json
@@ -43,6 +44,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { quietCheck, runUpdate, updateRow } from "../lib/update.js"; import { rmTreeHard } from "../lib/rmtree.js"; import { plainFileUrl } from "../lib/fileurl.js"; import { removeStaleWkskill } from "../lib/stale-wkskill.js"; import { checkPath, installBothLinks, removeCreatedLinks } from "../lib/doctor-path.js";
 import { applySets, askEach, buildConfig, configRow, detect, lineDiff, printDetected } from "../lib/config.js";
 import { aiCliRows, installAiClis, removeAiClis } from "../lib/ai-clis.js";
+import { providerCli, providerRow } from "../lib/providers.js";
 import { hooksRow, wireClaudeHooks } from "../lib/hook-wire.js";
 import { installStarterMd, removeStarterMd } from "../lib/starter-md.js";
 import { addAllows, removeAllows } from "../lib/allow-compact.js";
@@ -400,7 +402,7 @@ function installPlugin(o, kih, kihSource) {
 // The machine state an uninstall must give back, recorded ONCE (a re-install never overwrites the first record, or
 // it would record our own dispatcher as the "prior" hooksPath). Shim paths are those install may create.
 function shimCandidates() {
-  return [join(linkDir(), "wkappbot"), join(HARNESS_LINKS(), "wk-verify"), join(HARNESS_LINKS(), "wk-verify.cmd")];   // Windows (Git Bash) .cmd twins from harness-install.sh: recorded like the rest, so uninstall removes them, never a user file
+  return [join(linkDir(), "wkappbot"), join(linkDir(), "wkappbot-core"), join(HARNESS_LINKS(), "wk-verify"), join(HARNESS_LINKS(), "wk-verify.cmd")];   // wkappbot-core: the harness install.sh links it beside wkappbot (SDK e2e nopwsh u1: local-bin= vs local-bin=wkappbot-core)   // Windows (Git Bash) .cmd twins from harness-install.sh: recorded like the rest, so uninstall removes them, never a user file
 }
 const PRE_SETTINGS = () => join(STATE_HOME(), "settings.pre-install.json");
 function recordPrior(prev) {
@@ -646,6 +648,7 @@ function doctor(o) {
   add("config", !!entry, join(cfg, "opencode.json"), true);
   const oc = configRow(join(cfg, "opencode.json"));
   add("opencode-config", oc.ok, oc.detail, false);
+  try { const pv = providerRow(JSON.parse(readFileSync(join(cfg, "opencode.json"), "utf8"))); if (!pv.none) add("provider", pv.ok, pv.detail, false); } catch {}   // WARN names an unset env var (never its value)
   aiCliRows(add, !!(st.aiClis && st.aiClis.skipped));
   // bin: the core answers --version
   const dest = o.binDest ? resolve(o.binDest) : (st.bin && st.bin.dest) || binDest(o);
@@ -708,6 +711,8 @@ function doctor(o) {
   return bad ? 1 : 0;
 }
 
+// provider add|list|remove (lib/providers.js): env var NAMES into the user's opencode.json, no key stored
+if (process.argv[2] === "provider") process.exit(providerCli(process.argv.slice(3), { target: join(configDir({}), "opencode.json"), stamp }));
 const o = parseArgs(process.argv.slice(2));
 // install --update (from update) and these flags are forwarded to the re-run install of a fresh version.
 const fwd = process.argv.slice(3).filter((a) => a !== "--auto-update");
@@ -731,6 +736,7 @@ switch (o.cmd) {
   default:
     console.log("usage: wkappbot-code --version | install [--no-npm] [--no-ai-clis] [--no-allows] [--no-bin] [--no-harness] [--no-skills] [--web-harness] [--dev-seat]\n" +
       "         [--config-dir DIR] [--kih-dir DIR] [--bin-dest FILE] [--hq-dir DIR] [--update] [--auto-update] | doctor [--config-dir DIR]\n" +
-      "       | uninstall [--config-dir DIR] | update [install opts] | config [--yes] [--project] [--set key=value] [--config-dir DIR]");
+      "       | uninstall [--config-dir DIR] | update [install opts] | config [--yes] [--project] [--set key=value] [--config-dir DIR]\n" +
+      "       | provider add ID --base-url-env VAR --api-key-env VAR --model NAME | provider list | provider remove ID");
     process.exit(o.cmd === "help" || o.cmd === "--help" ? 0 : 64);
 }

package/lib/doctor-path.js

@@ -224,13 +224,19 @@ export function ensureLinks({ home, platform = process.platform, binDir, env = p
   // Windows runs the PATH logic even when both shims already existed: the doctor row reads the persistent PATH,
   // so a missing entry is a FAIL whether or not this run wrote a shim. POSIX keeps its old rule (a link was written).
   const pathWanted = needsPath && (created.length > 0 || platform === "win32");
+  // POSIX: note whether ~/.profile existed BEFORE addToPath, so uninstall deletes only a profile install created.
+  const profilePath = platform === "win32" ? "" : join(home, ".profile");
+  const profileExisted = !!profilePath && existsSync(profilePath);
   const pathAdded = pathWanted ? !!addToPath({ dir, home, platform, readRegPath }) : false;
-  return { created, dir, pathAdded };
+  const profileCreated = pathAdded && !profileExisted && !!profilePath && existsSync(profilePath) ? profilePath : "";
+  return { created, dir, pathAdded, profileCreated };
 }
 
 // removeCreatedLinks(created, opts) -> the entries actually removed. Deletes only the listed entries, nothing else.
 // A "PATH:<folder>" entry is the PATH entry install added: it is removed by removePath (exactly that folder),
-// never by unlink. opts: platform, home, and an injectable removePath({dir, home, platform}) -> boolean.
+// never by unlink. A "PROFILE:<path>" entry is the ~/.profile install created: it is deleted only when its text is
+// blank again (trim() empty), so a profile the user wrote into is never removed. opts: platform, home, and an
+// injectable removePath({dir, home, platform}) -> boolean.
 export function removeCreatedLinks(created = [], { platform = process.platform, home = process.env.HOME || process.env.USERPROFILE || "", removePath = defaultRemovePath } = {}) {
   const removed = [];
   for (const p of created) {
@@ -238,6 +244,13 @@ export function removeCreatedLinks(created = [], { platform = process.platform,
       try { if (removePath({ dir: p.slice(5), home, platform })) removed.push(p); } catch { /* not removed */ }
       continue;
     }
+    if (p.startsWith("PROFILE:")) {
+      try {
+        const f = p.slice(8);
+        if (existsSync(f) && readFileSync(f, "utf8").trim() === "") { unlinkSync(f); removed.push(p); }
+      } catch { /* not removed */ }
+      continue;
+    }
     try { unlinkSync(p); removed.push(p); } catch { /* already gone */ }
   }
   return removed;
@@ -259,6 +272,7 @@ export function installBothLinks({ dest, home, platform = process.platform, binD
   const r = ensureLinks({ home, platform, binDir: dir, env, targets, addToPath, readRegPath });
   const created = BINS.map(pathOf).filter((p) => r.created.includes(p) || ours.some((bin) => pathOf(bin) === p));
   if (r.pathAdded) created.push("PATH:" + dir);  // recorded only when this install wrote the PATH entry
+  if (r.profileCreated) created.push("PROFILE:" + r.profileCreated);  // right after PATH: the profile install made
   return { created, pathAdded: r.pathAdded, kept, dir };
 }
 

package/lib/hook-wire.js

@@ -61,11 +61,19 @@ function route(cmd, lite) {
   return null;
 }
 
+// A dev seat: a harness checkout beside this lite (its .claude/hooks/wkharness-run.sh exists) that is not a web user install
+// (no .wk-user-install marker in the harness folder). Python --wire uses the same two tests (tools/wkharness-lite.sh).
+export function isDevSeat(lite) {
+  const kih = dirname(dirname(lite));
+  return existsSync(join(kih, ".claude", "hooks", "wkharness-run.sh")) && !existsSync(join(kih, ".wk-user-install"));
+}
+
 // The node port of --wire, plus the create step of the web installer. Throws on a settings file that is not JSON.
 export function wireSettings(path, lite) {
   const r = readSettings(path);
   if (!r.ok) throw new Error(path + " is not plain JSON (" + r.err + ")");
   const d = r.json || {};
+  const dev = isDevSeat(lite) && harnessHooks(d).some((h) => /wkharness-run\.sh/.test(h.command));
   const out = {};
   for (const [ev, groups] of Object.entries(d.hooks && typeof d.hooks === "object" ? d.hooks : {})) {
     const keep = [];
@@ -75,6 +83,8 @@ export function wireSettings(path, lite) {
       const seen = new Set(), hs = [];
       for (const h of asHooks(g)) {
         const cmd = String((h && h.command) || "");
+        // a dev seat runs its full harness and never also the lite one (owner 2026-11-12): lite entries go, the rest stay verbatim
+        if (dev) { if (!/wkharness-lite\.sh/.test(cmd)) hs.push(h); continue; }
         const c = HARNESS_HOOK.test(cmd) ? route(cmd, lite) : null;  // only a harness hook is ever rewritten
         if (c && !seen.has(c)) { seen.add(c); hs.push({ type: "command", command: c, timeout: 10 }); }
         else if (!c && !HARNESS_HOOK.test(cmd)) hs.push(h);  // a user's own hook stays verbatim
@@ -83,7 +93,8 @@ export function wireSettings(path, lite) {
     }
     if (keep.length) out[ev] = keep;
   }
-  for (const [ev, arm, matcher] of ARMS) {
+  // a dev seat gets no lite arm added: its full harness is the only chain
+  if (!dev) for (const [ev, arm, matcher] of ARMS) {
     const c = '"' + lite + '" ' + arm;
     if (!(out[ev] || []).some((g) => (g.hooks || []).some((h) => h.command === c)))
       (out[ev] = out[ev] || []).push({ ...(matcher ? { matcher } : {}), hooks: [{ type: "command", command: c, timeout: 10 }] });
@@ -124,6 +135,16 @@ function wireClaudeHooksInner(o) {
     log("hooks: WARN " + o.settings + " is not plain JSON (" + before.err + "); left untouched -- please fix it, then run: wkappbot-code install");
     return res;
   }
+  // A dev seat with both its full hook and a lite entry (owner 2026-11-12: two Stop chains fired): drop the lite entries
+  // and keep the full hook, whatever state the settings reports as.
+  const liteOnDisk = join(o.kih, "tools", "wkharness-lite.sh");
+  if (before.hooks.some((h) => /wkharness-run\.sh/.test(h.command)) && before.hooks.some((h) => /wkharness-lite\.sh/.test(h.command)) && isDevSeat(liteOnDisk)) {
+    wireSettings(o.settings, liteOnDisk);
+    const dev = analyzeHooks(o.settings, o.kih);
+    res.after = dev.state; res.changed = true;
+    log("hooks: " + o.settings + " runs the full harness on this dev seat; its lite hook entries were removed");
+    return res;
+  }
   if (before.state === "ours") { log("hooks: " + o.settings + " already runs every harness hook from " + o.kih); return res; }
   // A FULL harness hook (wkharness-run.sh, the pwsh hub of a dev seat) is never rewritten into the lite one where pwsh
   // runs: the rewrite would downgrade the owner's own seats. Leave it and say what to do.

package/lib/providers.js

@@ -0,0 +1,126 @@
+// providers.js -- `wkappbot-code provider add|list|remove`: an OpenAI-compatible endpoint written into the user's
+// opencode.json as an @ai-sdk/openai-compatible provider (owner 2026-11-12). The file holds env var NAMES only
+// ("{env:VAR}"); a key or a URL typed where a name belongs is refused and never echoed, and no env var value is read
+// except by the doctor row, which only checks that a variable is set and prints its name.
+// Pure build/merge/remove functions first, then the CLI body. Spec: wkappbot skill read agent-harness-landscape-2026
+import { copyFileSync, existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+
+export const NPM = "@ai-sdk/openai-compatible";
+export const ENV_NAME = /^[A-Z_][A-Z0-9_]*$/;
+const ID_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+
+// "" when v is a usable env var NAME; else a reason that never contains v.
+export function envNameProblem(v, label) {
+  const s = String(v == null ? "" : v);
+  if (!s) return label + " needs the NAME of an environment variable";
+  if (ENV_NAME.test(s)) return "";
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(s) || s.includes("/") || s.includes(".")) return label + " looks like a URL; pass the NAME of an env var that holds it (letters, digits, underscore, e.g. MY_BASE_URL)";
+  if (/^(sk|pk|gsk|ghp|xox|AIza|Bearer)[-_ ]?/i.test(s) || s.length > 40 || /[-\s]/.test(s)) return label + " looks like a secret; pass the NAME of an env var that holds it, never the value";
+  return label + " is not an env var name (it must match ^[A-Z_][A-Z0-9_]*$)";
+}
+
+// spec = { id, baseUrlEnv, apiKeyEnv, models: [names], label } -> { ok, error, id, block }
+export function buildProviderBlock(spec) {
+  const id = String(spec.id || "");
+  if (!ID_RE.test(id)) return { ok: false, error: "provider id must be lowercase letters, digits, - or _ (got a " + id.length + "-character id)" };
+  const e = envNameProblem(spec.baseUrlEnv, "--base-url-env") || envNameProblem(spec.apiKeyEnv, "--api-key-env");
+  if (e) return { ok: false, error: e };
+  const models = (spec.models || []).map(String).filter(Boolean);
+  if (!models.length) return { ok: false, error: "at least one --model NAME is required" };
+  const block = { npm: NPM, name: spec.label || id, options: { baseURL: "{env:" + spec.baseUrlEnv + "}", apiKey: "{env:" + spec.apiKeyEnv + "}" }, models: {} };
+  for (const m of models) block.models[m] = { name: m, tool_call: true };
+  return { ok: true, id, block };
+}
+
+// A new config: every user key kept; an existing same-id provider stays unless force.
+export function mergeProvider(cfg, id, block, force = false) {
+  const out = { ...cfg, provider: { ...(cfg.provider || {}) } };
+  if (out.provider[id] && !force) return { ok: false, error: "provider " + id + " already exists; pass --force to replace it" };
+  out.provider[id] = block;
+  return { ok: true, cfg: out };
+}
+
+// A new config without provider `id` (the provider key goes when it was the last one).
+export function removeProvider(cfg, id) {
+  if (!cfg.provider || !(id in cfg.provider)) return { ok: false, error: "no provider " + id };
+  const out = { ...cfg, provider: { ...cfg.provider } };
+  delete out.provider[id];
+  if (!Object.keys(out.provider).length) delete out.provider;
+  return { ok: true, cfg: out };
+}
+
+// The env var NAMES a provider block references ("{env:NAME}" in options); values are never read here.
+export function envRefs(block) {
+  const names = [];
+  for (const v of Object.values((block && block.options) || {})) for (const m of String(v).matchAll(/\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g)) if (!names.includes(m[1])) names.push(m[1]);
+  return names;
+}
+
+export const listProviders = (cfg) => Object.entries(cfg.provider || {}).map(([id, b]) => ({ id, npm: (b && b.npm) || "", refs: envRefs(b), models: Object.keys((b && b.models) || {}) }));
+
+// The doctor row: { ok, detail, none } -- none when the config declares no provider that references an env var.
+export function providerRow(cfg, env = process.env) {
+  const rows = listProviders(cfg).filter((r) => r.refs.length);
+  if (!rows.length) return { ok: true, none: true, detail: "no provider with env var references" };
+  const unset = [];
+  for (const r of rows) for (const n of r.refs) if (!env[n] && !unset.includes(n)) unset.push(n);
+  const ids = rows.map((r) => r.id).join(",");
+  return unset.length ? { ok: false, detail: ids + ": env var not set: " + unset.join(", ") } : { ok: true, detail: ids + ": every referenced env var is set" };
+}
+
+function parse(argv) {
+  const o = { sub: argv[0] || "", id: "", models: [], force: false, baseUrlEnv: "", apiKeyEnv: "", label: "", bad: "" };
+  for (let i = 1; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--base-url-env") o.baseUrlEnv = argv[++i] || "";
+    else if (a === "--api-key-env") o.apiKeyEnv = argv[++i] || "";
+    else if (a === "--model") o.models.push(argv[++i] || "");
+    else if (a === "--name") o.label = argv[++i] || "";
+    else if (a === "--force") o.force = true;
+    else if (a.startsWith("--")) o.bad = a;
+    else if (!o.id) o.id = a;
+    else o.bad = "extra argument";
+  }
+  return o;
+}
+
+export const USAGE = "usage: wkappbot-code provider add ID --base-url-env VAR --api-key-env VAR --model NAME [--model NAME ...] [--name LABEL] [--force]\n" +
+  "       | provider list | provider remove ID      (VAR is an environment variable NAME; no key or URL is ever stored)";
+
+// The CLI body. target = the opencode.json path. Returns the exit code.
+export function providerCli(argv, { target, log = console.log, err = console.error, stamp = () => Date.now().toString() }) {
+  const o = parse(argv);
+  if (o.bad) { err("provider: unknown option " + o.bad); return 64; }
+  if (!["add", "list", "remove"].includes(o.sub)) { log(USAGE); return o.sub === "" || o.sub === "--help" ? 0 : 64; }
+  let raw = "", cfg = {};
+  if (existsSync(target)) {
+    raw = readFileSync(target, "utf8");
+    try { cfg = JSON.parse(raw); } catch { err("provider: " + target + " is not plain JSON; left untouched -- edit it by hand"); return 1; }
+    if (!cfg || typeof cfg !== "object" || Array.isArray(cfg)) { err("provider: " + target + " is not a JSON object; left untouched"); return 1; }
+  }
+  if (o.sub === "list") {
+    const rows = listProviders(cfg);
+    if (!rows.length) log("no providers in " + target);
+    for (const r of rows) log(r.id + "  " + (r.npm || "-") + "  env: " + (r.refs.join(", ") || "-") + "  models: " + (r.models.join(", ") || "-"));
+    return 0;
+  }
+  let next;
+  if (o.sub === "add") {
+    const b = buildProviderBlock({ id: o.id, baseUrlEnv: o.baseUrlEnv, apiKeyEnv: o.apiKeyEnv, models: o.models, label: o.label });
+    if (!b.ok) { err("provider: " + b.error); return 2; }
+    const m = mergeProvider(cfg, b.id, b.block, o.force);
+    if (!m.ok) { err("provider: " + m.error); return 3; }
+    next = m.cfg;
+  } else {
+    if (!o.id) { err("provider remove needs an ID"); return 64; }
+    const m = removeProvider(cfg, o.id);
+    if (!m.ok) { err("provider: " + m.error); return 3; }
+    next = m.cfg;
+  }
+  const text = JSON.stringify(next, null, 2) + "\n";
+  if (raw) { const bak = target + ".bak-" + stamp(); copyFileSync(target, bak); log("backup " + bak); }
+  writeFileSync(target + ".tmp", text);
+  renameSync(target + ".tmp", target);
+  log("provider " + o.id + (o.sub === "add" ? " added to " : " removed from ") + target);
+  return 0;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wkappbot-code",
-  "version": "0.3.25",
+  "version": "0.3.27",
   "description": "wkappbot-code -- Wisdom Kernel: the pinned OpenCode bridge plus the reflex harness plugin, the wkappbot core, the web harness and the latest public skills in one install",
   "type": "module",
   "scripts": {