wkappbot-code 0.3.26 → 0.3.27

package/README.md

@@ -63,7 +63,7 @@ The generated `opencode.json` holds the minimum: `$schema` and the plugin entry
 
 - One headless turn: `opencode run -m provider/model "prompt"`
 - Inside the TUI: `/models`
-- Any OpenAI-compatible endpoint: declare a provider with `"npm": "@ai-sdk/openai-compatible"` and `"options": { "baseURL": "{env:MY_BASE_URL}", "apiKey": "{env:MY_API_KEY}" }` in your own `opencode.json`. No key is stored in a file.
+- Any OpenAI-compatible endpoint: `wkappbot-code provider add acme --base-url-env MY_BASE_URL --api-key-env MY_API_KEY --model my-model` writes an `@ai-sdk/openai-compatible` provider into your `opencode.json` (`"baseURL": "{env:MY_BASE_URL}"`, `"apiKey": "{env:MY_API_KEY}"`), then `opencode run -m acme/my-model`. The arguments are env var NAMES: a key or a URL typed in their place is refused, and no key is stored in a file. The file is backed up first, a config that is not plain JSON is left untouched, and an existing provider of the same id needs `--force`. `provider list` prints ids and env var names only, `provider remove ID` deletes just that provider, `uninstall` keeps your providers, and `doctor` WARNs (names only) when a referenced variable is unset.
 
 ## In the browser WebVM (no login needed)
 

package/bin/wkappbot-code.js

@@ -18,6 +18,7 @@
 //   wkappbot-code doctor  [opts]       one PASS/WARN/FAIL/SKIP row per part (exit 1 if a required part fails)
 //   wkappbot-code update  [opts]       newer version.json -> tgz sha256-checked -> npm i -g -> install --update (lib/update.js)
 //   wkappbot-code config  [opts]       detect provider/model/plugin/harness, edit at a TTY, merge into opencode.json (lib/config.js)
+//   wkappbot-code provider add|list|remove   an OpenAI-compatible endpoint (env var NAMES only) in opencode.json (lib/providers.js)
 //   wkappbot-code uninstall [opts]     undo install: the recorded pre-install global core.hooksPath comes back, the
 //                  harness hook arms leave ~/.claude/settings.json (your own entries stay), the recorded shims
 //                  leave the bin dirs, ~/.wk-harness and ~/.wk-harness-hooks go, the plugin entry leaves opencode.json
@@ -43,6 +44,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { quietCheck, runUpdate, updateRow } from "../lib/update.js"; import { rmTreeHard } from "../lib/rmtree.js"; import { plainFileUrl } from "../lib/fileurl.js"; import { removeStaleWkskill } from "../lib/stale-wkskill.js"; import { checkPath, installBothLinks, removeCreatedLinks } from "../lib/doctor-path.js";
 import { applySets, askEach, buildConfig, configRow, detect, lineDiff, printDetected } from "../lib/config.js";
 import { aiCliRows, installAiClis, removeAiClis } from "../lib/ai-clis.js";
+import { providerCli, providerRow } from "../lib/providers.js";
 import { hooksRow, wireClaudeHooks } from "../lib/hook-wire.js";
 import { installStarterMd, removeStarterMd } from "../lib/starter-md.js";
 import { addAllows, removeAllows } from "../lib/allow-compact.js";
@@ -400,7 +402,7 @@ function installPlugin(o, kih, kihSource) {
 // The machine state an uninstall must give back, recorded ONCE (a re-install never overwrites the first record, or
 // it would record our own dispatcher as the "prior" hooksPath). Shim paths are those install may create.
 function shimCandidates() {
-  return [join(linkDir(), "wkappbot"), join(HARNESS_LINKS(), "wk-verify"), join(HARNESS_LINKS(), "wk-verify.cmd")];   // Windows (Git Bash) .cmd twins from harness-install.sh: recorded like the rest, so uninstall removes them, never a user file
+  return [join(linkDir(), "wkappbot"), join(linkDir(), "wkappbot-core"), join(HARNESS_LINKS(), "wk-verify"), join(HARNESS_LINKS(), "wk-verify.cmd")];   // wkappbot-core: the harness install.sh links it beside wkappbot (SDK e2e nopwsh u1: local-bin= vs local-bin=wkappbot-core)   // Windows (Git Bash) .cmd twins from harness-install.sh: recorded like the rest, so uninstall removes them, never a user file
 }
 const PRE_SETTINGS = () => join(STATE_HOME(), "settings.pre-install.json");
 function recordPrior(prev) {
@@ -646,6 +648,7 @@ function doctor(o) {
   add("config", !!entry, join(cfg, "opencode.json"), true);
   const oc = configRow(join(cfg, "opencode.json"));
   add("opencode-config", oc.ok, oc.detail, false);
+  try { const pv = providerRow(JSON.parse(readFileSync(join(cfg, "opencode.json"), "utf8"))); if (!pv.none) add("provider", pv.ok, pv.detail, false); } catch {}   // WARN names an unset env var (never its value)
   aiCliRows(add, !!(st.aiClis && st.aiClis.skipped));
   // bin: the core answers --version
   const dest = o.binDest ? resolve(o.binDest) : (st.bin && st.bin.dest) || binDest(o);
@@ -708,6 +711,8 @@ function doctor(o) {
   return bad ? 1 : 0;
 }
 
+// provider add|list|remove (lib/providers.js): env var NAMES into the user's opencode.json, no key stored
+if (process.argv[2] === "provider") process.exit(providerCli(process.argv.slice(3), { target: join(configDir({}), "opencode.json"), stamp }));
 const o = parseArgs(process.argv.slice(2));
 // install --update (from update) and these flags are forwarded to the re-run install of a fresh version.
 const fwd = process.argv.slice(3).filter((a) => a !== "--auto-update");
@@ -731,6 +736,7 @@ switch (o.cmd) {
   default:
     console.log("usage: wkappbot-code --version | install [--no-npm] [--no-ai-clis] [--no-allows] [--no-bin] [--no-harness] [--no-skills] [--web-harness] [--dev-seat]\n" +
       "         [--config-dir DIR] [--kih-dir DIR] [--bin-dest FILE] [--hq-dir DIR] [--update] [--auto-update] | doctor [--config-dir DIR]\n" +
-      "       | uninstall [--config-dir DIR] | update [install opts] | config [--yes] [--project] [--set key=value] [--config-dir DIR]");
+      "       | uninstall [--config-dir DIR] | update [install opts] | config [--yes] [--project] [--set key=value] [--config-dir DIR]\n" +
+      "       | provider add ID --base-url-env VAR --api-key-env VAR --model NAME | provider list | provider remove ID");
     process.exit(o.cmd === "help" || o.cmd === "--help" ? 0 : 64);
 }

package/lib/providers.js

@@ -0,0 +1,126 @@
+// providers.js -- `wkappbot-code provider add|list|remove`: an OpenAI-compatible endpoint written into the user's
+// opencode.json as an @ai-sdk/openai-compatible provider (owner 2026-11-12). The file holds env var NAMES only
+// ("{env:VAR}"); a key or a URL typed where a name belongs is refused and never echoed, and no env var value is read
+// except by the doctor row, which only checks that a variable is set and prints its name.
+// Pure build/merge/remove functions first, then the CLI body. Spec: wkappbot skill read agent-harness-landscape-2026
+import { copyFileSync, existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+
+export const NPM = "@ai-sdk/openai-compatible";
+export const ENV_NAME = /^[A-Z_][A-Z0-9_]*$/;
+const ID_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+
+// "" when v is a usable env var NAME; else a reason that never contains v.
+export function envNameProblem(v, label) {
+  const s = String(v == null ? "" : v);
+  if (!s) return label + " needs the NAME of an environment variable";
+  if (ENV_NAME.test(s)) return "";
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(s) || s.includes("/") || s.includes(".")) return label + " looks like a URL; pass the NAME of an env var that holds it (letters, digits, underscore, e.g. MY_BASE_URL)";
+  if (/^(sk|pk|gsk|ghp|xox|AIza|Bearer)[-_ ]?/i.test(s) || s.length > 40 || /[-\s]/.test(s)) return label + " looks like a secret; pass the NAME of an env var that holds it, never the value";
+  return label + " is not an env var name (it must match ^[A-Z_][A-Z0-9_]*$)";
+}
+
+// spec = { id, baseUrlEnv, apiKeyEnv, models: [names], label } -> { ok, error, id, block }
+export function buildProviderBlock(spec) {
+  const id = String(spec.id || "");
+  if (!ID_RE.test(id)) return { ok: false, error: "provider id must be lowercase letters, digits, - or _ (got a " + id.length + "-character id)" };
+  const e = envNameProblem(spec.baseUrlEnv, "--base-url-env") || envNameProblem(spec.apiKeyEnv, "--api-key-env");
+  if (e) return { ok: false, error: e };
+  const models = (spec.models || []).map(String).filter(Boolean);
+  if (!models.length) return { ok: false, error: "at least one --model NAME is required" };
+  const block = { npm: NPM, name: spec.label || id, options: { baseURL: "{env:" + spec.baseUrlEnv + "}", apiKey: "{env:" + spec.apiKeyEnv + "}" }, models: {} };
+  for (const m of models) block.models[m] = { name: m, tool_call: true };
+  return { ok: true, id, block };
+}
+
+// A new config: every user key kept; an existing same-id provider stays unless force.
+export function mergeProvider(cfg, id, block, force = false) {
+  const out = { ...cfg, provider: { ...(cfg.provider || {}) } };
+  if (out.provider[id] && !force) return { ok: false, error: "provider " + id + " already exists; pass --force to replace it" };
+  out.provider[id] = block;
+  return { ok: true, cfg: out };
+}
+
+// A new config without provider `id` (the provider key goes when it was the last one).
+export function removeProvider(cfg, id) {
+  if (!cfg.provider || !(id in cfg.provider)) return { ok: false, error: "no provider " + id };
+  const out = { ...cfg, provider: { ...cfg.provider } };
+  delete out.provider[id];
+  if (!Object.keys(out.provider).length) delete out.provider;
+  return { ok: true, cfg: out };
+}
+
+// The env var NAMES a provider block references ("{env:NAME}" in options); values are never read here.
+export function envRefs(block) {
+  const names = [];
+  for (const v of Object.values((block && block.options) || {})) for (const m of String(v).matchAll(/\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g)) if (!names.includes(m[1])) names.push(m[1]);
+  return names;
+}
+
+export const listProviders = (cfg) => Object.entries(cfg.provider || {}).map(([id, b]) => ({ id, npm: (b && b.npm) || "", refs: envRefs(b), models: Object.keys((b && b.models) || {}) }));
+
+// The doctor row: { ok, detail, none } -- none when the config declares no provider that references an env var.
+export function providerRow(cfg, env = process.env) {
+  const rows = listProviders(cfg).filter((r) => r.refs.length);
+  if (!rows.length) return { ok: true, none: true, detail: "no provider with env var references" };
+  const unset = [];
+  for (const r of rows) for (const n of r.refs) if (!env[n] && !unset.includes(n)) unset.push(n);
+  const ids = rows.map((r) => r.id).join(",");
+  return unset.length ? { ok: false, detail: ids + ": env var not set: " + unset.join(", ") } : { ok: true, detail: ids + ": every referenced env var is set" };
+}
+
+function parse(argv) {
+  const o = { sub: argv[0] || "", id: "", models: [], force: false, baseUrlEnv: "", apiKeyEnv: "", label: "", bad: "" };
+  for (let i = 1; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--base-url-env") o.baseUrlEnv = argv[++i] || "";
+    else if (a === "--api-key-env") o.apiKeyEnv = argv[++i] || "";
+    else if (a === "--model") o.models.push(argv[++i] || "");
+    else if (a === "--name") o.label = argv[++i] || "";
+    else if (a === "--force") o.force = true;
+    else if (a.startsWith("--")) o.bad = a;
+    else if (!o.id) o.id = a;
+    else o.bad = "extra argument";
+  }
+  return o;
+}
+
+export const USAGE = "usage: wkappbot-code provider add ID --base-url-env VAR --api-key-env VAR --model NAME [--model NAME ...] [--name LABEL] [--force]\n" +
+  "       | provider list | provider remove ID      (VAR is an environment variable NAME; no key or URL is ever stored)";
+
+// The CLI body. target = the opencode.json path. Returns the exit code.
+export function providerCli(argv, { target, log = console.log, err = console.error, stamp = () => Date.now().toString() }) {
+  const o = parse(argv);
+  if (o.bad) { err("provider: unknown option " + o.bad); return 64; }
+  if (!["add", "list", "remove"].includes(o.sub)) { log(USAGE); return o.sub === "" || o.sub === "--help" ? 0 : 64; }
+  let raw = "", cfg = {};
+  if (existsSync(target)) {
+    raw = readFileSync(target, "utf8");
+    try { cfg = JSON.parse(raw); } catch { err("provider: " + target + " is not plain JSON; left untouched -- edit it by hand"); return 1; }
+    if (!cfg || typeof cfg !== "object" || Array.isArray(cfg)) { err("provider: " + target + " is not a JSON object; left untouched"); return 1; }
+  }
+  if (o.sub === "list") {
+    const rows = listProviders(cfg);
+    if (!rows.length) log("no providers in " + target);
+    for (const r of rows) log(r.id + "  " + (r.npm || "-") + "  env: " + (r.refs.join(", ") || "-") + "  models: " + (r.models.join(", ") || "-"));
+    return 0;
+  }
+  let next;
+  if (o.sub === "add") {
+    const b = buildProviderBlock({ id: o.id, baseUrlEnv: o.baseUrlEnv, apiKeyEnv: o.apiKeyEnv, models: o.models, label: o.label });
+    if (!b.ok) { err("provider: " + b.error); return 2; }
+    const m = mergeProvider(cfg, b.id, b.block, o.force);
+    if (!m.ok) { err("provider: " + m.error); return 3; }
+    next = m.cfg;
+  } else {
+    if (!o.id) { err("provider remove needs an ID"); return 64; }
+    const m = removeProvider(cfg, o.id);
+    if (!m.ok) { err("provider: " + m.error); return 3; }
+    next = m.cfg;
+  }
+  const text = JSON.stringify(next, null, 2) + "\n";
+  if (raw) { const bak = target + ".bak-" + stamp(); copyFileSync(target, bak); log("backup " + bak); }
+  writeFileSync(target + ".tmp", text);
+  renameSync(target + ".tmp", target);
+  log("provider " + o.id + (o.sub === "add" ? " added to " : " removed from ") + target);
+  return 0;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wkappbot-code",
-  "version": "0.3.26",
+  "version": "0.3.27",
   "description": "wkappbot-code -- Wisdom Kernel: the pinned OpenCode bridge plus the reflex harness plugin, the wkappbot core, the web harness and the latest public skills in one install",
   "type": "module",
   "scripts": {