wkappbot-code 0.3.3 → 0.3.5

package/README.md

@@ -1,74 +1,71 @@
 # wkappbot-code -- Wisdom Kernel (WK)
 
-A prototype OpenCode distribution: the upstream OpenCode release, pinned to `opencode-ai@1.19.5`, plus one kih plugin. wkappbot-code contains no coding engine of its own.
+An OpenCode distribution: the upstream OpenCode release, pinned to `opencode-ai@1.19.5`, plus one harness plugin. wkappbot-code contains no coding engine of its own.
 
 ## Bridge, not harness
 
-OpenCode is the **bridge**. It connects any model (Claude, GPT, Qwen, Kimi, GLM and local models) to files, shell, LSP and its clients. kih is the **harness**: the discipline layer that rides on the bridge, made of refusal gates, skill learning, memory and pace. In wkappbot-code the kernel loads bridges the way an OS kernel loads drivers. OpenCode, Claude Code and Codex are the drivers, and each model is a device behind them.
+OpenCode is the **bridge**. It connects any model (Claude, GPT, Qwen, Kimi, GLM and local models) to files, shell, LSP and its clients. The harness is the discipline layer that rides on the bridge: refusal gates, skill learning, memory and pace. In wkappbot-code the kernel loads bridges the way an OS kernel loads drivers. OpenCode, Claude Code and Codex are the drivers, and each model is a device behind them.
 
-The plugin `plugin/wisdom-kernel.js` maps OpenCode plugin events onto the existing kih hook launcher `.claude/hooks/wkharness-run.sh`:
+The plugin `plugin/wisdom-kernel.js` maps OpenCode plugin events onto the harness hook launcher `.claude/hooks/wkharness-run.sh`. The file exports only the plugin function (OpenCode calls every named export as a plugin); its helpers live in `lib/wk-hook.js`, installed beside it.
 
-| OpenCode event | kih arm | effect |
+| OpenCode event | harness arm | effect |
 |---|---|---|
-| `tool.execute.before` | `pre` | Claude-shaped PreToolUse JSON (`tool_name`, `tool_input`, `session_id`, `cwd`). Exit 2 throws, which refuses the tool call with the hook's stderr as the reason. |
+| `tool.execute.before` | `pre` | Claude-shaped PreToolUse JSON (`tool_name`, `tool_input`, `session_id`, `cwd`). Exit 2 throws, which refuses the tool call with the guard's own message as the reason. |
 | `tool.execute.after` | `post` | fail-open |
+| `chat.message` | `prompt` | UserPromptSubmit: the intent lock owes a skill search (`wkskill search ...`) before real work |
+| `event` `session.created` | `session` | SessionStart |
 | `event` `session.idle` | `stop-archive` | archive only, fail-open |
+| `experimental.chat.system.transform` | (none) | appends the reflex rules to the system prompt of EVERY model request, whatever the model (pinned to OpenCode 1.19.5; the e2e asserts every request carried them) |
+| `chat.params` | (none) | logged to `~/.wkappbot-code/plugin.log` only; your model settings are never changed |
 
 Tool names are mapped as `bash`/`edit`/`write`/`read` -> `Bash`/`Edit`/`Write`/`Read`, with camelCase args (`filePath`, `oldString`) mapped to snake_case (`file_path`, `old_string`).
 
-## Install
+**Fast path.** A read tool (`read`, `glob`, `grep`, `list`) or one plain read-only shell command (`ls`, `cat`, `grep`, `head`, `echo`, `git status/log/diff/show` ... with no chain, pipe, redirect or substitution, and no secret-looking path) runs no hook at all, so it never waits for PowerShell.
 
-```bash
-bash wkappbot-code/install.sh            # npm i -g opencode-ai@1.19.5, copy plugin + config (idempotent)
-bash wkappbot-code/install.sh --no-npm   # wire the plugin only
-bash wkappbot-code/selftest.sh           # RESULT N/N; --synthetic-only where no kih hook can run
-```
+**Fail direction.** A hook verdict decides: exit 0 allows, exit 2 refuses. When no verdict comes back (no harness found, a crash, a hook killed at its time budget) the call is allowed, **except** the risky classes, which are refused (fail-closed): `git --no-verify` (and `git commit -n`), `git push --force` (`-f`, `--force-with-lease`, a `+ref`), any change of `core.hooksPath`, `rm -r` of HOME, `/` or the project, and any write under `.git`. The sh lite harness refuses the same classes on its own.
 
-### One command installs everything
+**Which harness gives the verdict.** A user install (the web harness, marked by `~/.wk-harness/.wk-user-install`) always uses the sh lite harness `tools/wkharness-lite.sh`: the risk floor above, the intent lock and the study lock, about 10 ms per call. The full PowerShell harness runs only on a dev seat (a harness checkout, or `install --dev-seat`) where `pwsh` is on PATH; there the lite guard still runs first for every OpenCode call.
 
-Get the CLI by one of three roads, then run `wkappbot-code install` once:
+## Install
 
 ```bash
-npm i -g https://kiexpert.github.io/wkappbot-kih/wkappbot-code/wkappbot-code.tgz   # web: the scrub-gated tgz the SDK workflow ships daily (SHA256SUMS + version.json beside it)
-npm i -g wkappbot-code                                                        # registry (published only when the SDK has NPM_TOKEN)
-npm pack ./wkappbot-code && npm i -g ./wkappbot-code-0.3.3.tgz                  # from a checkout
-
-wkappbot-code install      # every part below, idempotent
-wkappbot-code doctor       # one PASS/WARN/FAIL/SKIP row per part
+npm i -g wkappbot-code          # or the web tgz below
+wkappbot-code install           # every part below, idempotent
+wkappbot-code doctor            # one PASS/WARN/FAIL/SKIP row per part
+wkappbot-code uninstall         # undo it (see below)
 wkappbot-code --version
-# the old command name wk-appbot-code (0.2.x) still works: it is a second bin entry for the same file
 ```
 
+Other roads to the CLI: `npm i -g https://kiexpert.github.io/wkappbot-kih/wkappbot-code/wkappbot-code.tgz` (the scrub-gated tgz with `SHA256SUMS` and `version.json` beside it), or `npm pack ./wkappbot-code && npm i -g ./wkappbot-code-0.3.5.tgz` from a checkout (`bash wkappbot-code/install.sh` wraps the same `install`). The old command name `wk-appbot-code` (0.2.x) still works.
 
 | part | what `install` lays down | skip with |
 |---|---|---|
 | opencode | pinned `opencode-ai@1.19.5` (`npm -g`) | `--no-npm` |
-| plugin | `plugin/wisdom-kernel.js` plus the `opencode.json` plugin entry | -- |
-| bin | the `wkappbot` core for this platform from the SDK latest release asset `wkappbot-<platform>`, accepted only when it matches its `SHA256SUMS` line (`lib/wk-bin-acquire.sh`, byte-identical to kih `tools/wk-bin-acquire.sh`); placed at `~/.local/share/wkappbot/wkappbot` and linked as `wkappbot` beside `wkappbot-code` | `--no-bin` |
-| harness | when no kih checkout is found, the scrubbed web harness to `~/.wk-harness` through its own published `install.sh` (sha256-checked); `--web-harness` forces it | `--no-harness` |
+| plugin | `plugin/wisdom-kernel.js` + `lib/wk-hook.js` plus the `opencode.json` plugin entry | -- |
+| bin | the `wkappbot` core for this platform from the SDK latest release asset `wkappbot-<platform>`, accepted only when it matches its `SHA256SUMS` line (`lib/wk-bin-acquire.sh`); placed at `~/.local/share/wkappbot/wkappbot` and linked as `wkappbot` beside `wkappbot-code` | `--no-bin` |
+| harness | when no harness checkout is found, the scrubbed web harness to `~/.wk-harness` through its own published `install.sh` (sha256-checked); `--web-harness` forces it | `--no-harness` |
 | skills | the latest public skills from the same published tarball (sha256-checked) into the core's HQ `<core dir>/wkappbot.hq/skills`, so `wkappbot skill read on-load` prints | `--no-skills` |
 
-The skills are a **read-only copy**: the HQ has no git remote, and a skill you edit yourself lands in the private home `~/.wkappbot/private-skills`, a local git repo with no remote. Skill push belongs to the owner's GitHub account only; doctor's `skill-push = owner-only` row names the login a push would use (`gh api user`, else `none`) and WARNs unless it is the owner's.
+`install` prints whether `pwsh` was found and which harness will give the verdict. The harness install ends with an advisory line, `[wk-verify] WARN n/6 advisory, not a failure -- c2 ...; c5 ...; c6 ...`, naming each check that missed and why; in a good web install c2 (wkhippo), c5 (core skill read before the core is linked) and c6 (no harness git checkout) are expected to miss. The verdict file is `~/.wkappbot-code/verify.json`.
+
+The skills are a **read-only copy**: the HQ has no git remote, and a skill you edit yourself lands in the private home `~/.wkappbot/private-skills`, a local git repo with no remote. Doctor's `skill-push = owner-only` row names the GitHub login a push would use.
 
-`install.sh` and `wkappbot-code install` are the same code. An existing `~/.config/opencode/opencode.json` is backed up (`opencode.json.bak-<stamp>`), and only the plugin entry is merged in; every other key you set stays. A config that is not plain JSON is left untouched, and `wkappbot-code.json` is written beside it for you to merge by hand. Pass `--kih-dir` (or set `WK_KIH_DIR`) when the kih checkout is not auto-found; without a checkout or `~/.wk-harness` the plugin lets every call through. Relocation and mock overrides: `WK_BIN_BASE`, `WK_HARNESS_BASE`, `WK_HARNESS_DIR`, `WK_BIN_DEST`, `WK_APPBOT_HQ`, `WK_LINK_DIR`, `WK_PRIVATE_SKILLS` (`selftest.sh` part (i) mocks every network part with them).
+The generated `opencode.json` holds the minimum: `$schema` and the plugin entry (with `kihDir`, the harness the plugin calls). No provider and no permission block is added, because no refusal depends on one (every refusal comes from the plugin and the harness). An existing `opencode.json` is backed up (`opencode.json.bak-<stamp>`) and only the plugin entry is merged in; every other key you set stays. A config that is not plain JSON is left untouched, and `wkappbot-code.json` is written beside it for you to merge by hand. `wkappbot-code config` detects the provider and model from the API-key variables that are set (values are never read) and lets you edit them. Pass `--kih-dir` (or set `WK_KIH_DIR`) when a harness checkout is not auto-found (`~/wkappbot-kih` is searched). Relocation and mock overrides: `WK_BIN_BASE`, `WK_HARNESS_BASE`, `WK_HARNESS_DIR`, `WK_BIN_DEST`, `WK_APPBOT_HQ`, `WK_LINK_DIR`, `WK_PRIVATE_SKILLS`, `WK_SETTINGS`.
+
+## Uninstall
+
+`install` records, once, the machine state it changes: the global `core.hooksPath`, whether `~/.claude/settings.json`, `~/.wk-harness` and `~/.wk-harness-hooks` existed, and which shims it created (`wkappbot` beside the CLI, `wkskill` and `wk-verify` in `~/.local/bin`). `wkappbot-code uninstall` gives exactly that back: the recorded `core.hooksPath` (only when the current value is a hook folder the install wrote), the harness hook entries leave `settings.json` while yours stay (a file the install created is removed when nothing else is left), the recorded shims go, `~/.wk-harness` and `~/.wk-harness-hooks` go when the install created them, and the plugin entry leaves `opencode.json` (backed up first). It keeps `opencode-ai`, the core and its skills; `npm rm -g wkappbot-code` removes the CLI.
 
 ## Model swap
 
 - One headless turn: `opencode run -m provider/model "prompt"`
 - Inside the TUI: `/models`
-- In-house Qwen: `opencode.json` already declares the `qwen-inhouse` provider (`@ai-sdk/openai-compatible`). Set `QWEN_BASE_URL` and `QWEN_API_KEY` in the environment, then run `opencode run -m qwen-inhouse/qwen3-coder "hello"`. No key is stored in git.
+- Any OpenAI-compatible endpoint: declare a provider with `"npm": "@ai-sdk/openai-compatible"` and `"options": { "baseURL": "{env:MY_BASE_URL}", "apiKey": "{env:MY_API_KEY}" }` in your own `opencode.json`. No key is stored in a file.
 
 ## In the browser WebVM (no login needed)
 
-The x64 WebVM page (`webvm/x64/index.html`) types `wk-ai wkappbot-code` once the shell is ready, so the wkappbot-code prompt is up without typing. `?noappbot` turns this off, and an embedded page only autostarts with `?appbot`. Each question goes through the page bridge:
-
-1. A custom OpenAI-compatible provider in `localStorage` (`webvm.appbot.provider` = `{"baseURL","model","key"}`, with the key in `webvm.key.<key>`), for example the in-house Qwen.
-2. Otherwise the first family key the browser holds (claude, openai, gemini, xai).
-3. Otherwise the **dummy haiku**: an OpenAI-compatible mock inside the page. It never calls a model, and its first line reads `dummy haiku (로그인 전)`.
-
-The kih lite hooks stay live in the guest. Each question is a prompt event, and `!<command>` is a Bash tool call checked by `tools/wkharness-lite.sh` first, so the intent lock refuses a command until a `!wkskill search ...` has run. Proof: `node webvm/selftest/appbot-dummy-test.js` (no VM, no network), and `webvm/selftest/x64-appbot-test.js --page ... --install ...` against the published image. The guest's `wk-ai` gets the `!cmd`/hook support only after the SDK webvm-x64 bake; until then the page's dummy and provider path already works with the old image.
+The x64 WebVM page types `wk-ai wkappbot-code` once the shell is ready, so the wkappbot-code prompt is up without typing. `?noappbot` turns this off, and an embedded page only autostarts with `?appbot`. Each question goes through the page bridge: a custom OpenAI-compatible provider kept in the browser, else the first model key the browser holds, else the **dummy haiku**, an OpenAI-compatible mock inside the page that never calls a model. The lite hooks stay live in the guest: each question is a prompt event, and `!<command>` is a Bash tool call checked by `tools/wkharness-lite.sh` first.
 
 ## Floor
 
-
 Signing, submitting and paying stay human-only.

package/bin/wkappbot-code.js

@@ -3,12 +3,12 @@
 //   wkappbot-code --version            package version and the pinned OpenCode release
 //   wkappbot-code install [opts]       ONE COMMAND lays down every part (idempotent):
 //       opencode   pinned opencode-ai (npm -g)                                   skip: --no-npm
-//       plugin     plugin/wisdom-kernel.js + the opencode.json plugin entry      (always)
+//       plugin     plugin/wisdom-kernel.js + lib/wk-hook.js + the opencode.json plugin entry      (always)
 //       bin        the wkappbot core for this platform, from the SDK latest release asset verified by
-//                  SHA256SUMS -- the SAME road as kih tools/wk-bin-acquire.sh, shipped byte-identical
-//                  in lib/ (the selftest pins the two copies equal)               skip: --no-bin
+//                  SHA256SUMS -- the SAME road as tools/wk-bin-acquire.sh of the harness repo, shipped
+//                  byte-identical in lib/ (the selftest pins the two copies equal)               skip: --no-bin
 //       harness    the scrubbed web harness to ~/.wk-harness through its own published install.sh,
-//                  only when no kih checkout is found (--web-harness forces it)  skip: --no-harness
+//                  only when no harness checkout is found (--web-harness forces it)  skip: --no-harness
 //       skills     the latest public skills from the same published tarball (sha256-checked) into the
 //                  core's HQ (<core dir>/wkappbot.hq/skills), so `wkappbot skill read on-load` prints;
 //                  a READ-ONLY copy with no git remote. A user's own skill edits go to the private
@@ -16,12 +16,16 @@
 //   wkappbot-code doctor  [opts]       one PASS/WARN/FAIL/SKIP row per part (exit 1 if a required part fails)
 //   wkappbot-code update  [opts]       newer version.json -> tgz sha256-checked -> npm i -g -> install --update (lib/update.js)
 //   wkappbot-code config  [opts]       detect provider/model/plugin/harness, edit at a TTY, merge into opencode.json (lib/config.js)
+//   wkappbot-code uninstall [opts]     undo install: the recorded pre-install global core.hooksPath comes back, the
+//                  harness hook arms leave ~/.claude/settings.json (your own entries stay), the recorded shims
+//                  leave the bin dirs, ~/.wk-harness and ~/.wk-harness-hooks go, the plugin entry leaves opencode.json
 // install/doctor/config check for a newer version at most once a day (WKAPPBOT_CODE_NO_UPDATE_CHECK=1 turns it off;
 // --auto-update or WKAPPBOT_CODE_AUTO_UPDATE=1 applies it). config opts: --yes, --project, --set key=value
-// opts: --config-dir DIR, --kih-dir DIR, --bin-dest FILE, --hq-dir DIR
+// opts: --config-dir DIR, --kih-dir DIR, --bin-dest FILE, --hq-dir DIR, --dev-seat (the full pwsh harness and its
+//   emergency-edit door on this seat; a user install never gets them)
 // env (mock and relocation): WK_BIN_BASE (SDK release base), WK_HARNESS_BASE (web harness base),
-//   WK_HARNESS_DIR (~/.wk-harness), WK_BIN_DEST, WK_APPBOT_HQ, WK_LINK_DIR, WK_PRIVATE_SKILLS,
-//   WK_KIH_DIR (a kih checkout; "none" = ignore every checkout on this machine)
+//   WK_HARNESS_DIR (~/.wk-harness), WK_BIN_DEST, WK_APPBOT_HQ, WK_LINK_DIR, WK_PRIVATE_SKILLS, WK_SETTINGS,
+//   WK_KIH_DIR (a harness checkout; "none" = ignore every checkout on this machine)
 // Installer owns all setup, surgically: an existing user opencode.json is BACKED UP and only the plugin entry is
 // merged in; every other key is kept. Spec: wkappbot skill read agent-harness-landscape-2026-howto
 // and wkappbot skill read harness-installer-owns-all-setup (step 9 ONE-COMMAND APPBOT CODE INSTALL)
@@ -43,10 +47,19 @@ const OPENCODE_VERSION = PKG.wkAppbotCode.opencodeVersion;
 const OWNER_LOGIN = "kiexpert";
 const HARNESS_BASE = () => (process.env.WK_HARNESS_BASE || "https://kiexpert.github.io/wkappbot-kih/webvm/x64/harness").replace(/\/+$/, "");
 const HARNESS_DIR = () => process.env.WK_HARNESS_DIR || join(homedir(), ".wk-harness");
+const HOOKS_DIR = () => join(homedir(), ".wk-harness-hooks");   // tools/wk-global-hooks.sh install default
+const SETTINGS = () => process.env.WK_SETTINGS || join(homedir(), ".claude", "settings.json");
+const HARNESS_LINKS = () => process.env.WK_LINK_DIR || join(homedir(), ".local", "bin");   // harness install.sh
+const STATE_HOME = () => join(homedir(), ".wkappbot-code");
+const USER_MARK = ".wk-user-install";
 const IS_WIN = process.platform === "win32";
 // Windows: the sh and tar this CLI starts are Git Bash's (MSYS). They read "D:\a\x" as host "D" plus a remote path
 // ("tar: Cannot connect to C: resolve failed", SDK all-OS QA 2026-11-06), so a path handed to them is the MSYS form /d/a/x.
 const shPath = (p) => (IS_WIN && /^[A-Za-z]:[\\/]/.test(p) ? "/" + p[0].toLowerCase() + p.slice(2).replace(/\\/g, "/") : p);
+// The env for an MSYS child: HOME in MSYS form too. Node hands HOME through as "D:\\a\\home", and every "$HOME/..." path
+// the harness scripts build then fails their "/*" absolute-path test, so wk-verify ran the hooks from a wrong
+// directory (windows-latest "hooks FAIL 1/6" in the installer, PASS 6/6 when the same verify ran from Git Bash).
+const shEnv = (extra = {}) => (IS_WIN ? { ...process.env, HOME: shPath(homedir()), ...extra } : { ...process.env, ...extra });
 let _gnuTar = null;
 const tarArgs = (tgz, dir) => {
   if (!IS_WIN) return ["-xzf", tgz, "-C", dir];
@@ -56,7 +69,7 @@ const tarArgs = (tgz, dir) => {
 };
 
 function parseArgs(argv) {
-  const o = { cmd: argv[0] || "help", npm: true, bin: true, harness: true, skills: true, webHarness: false,
+  const o = { cmd: argv[0] || "help", npm: true, bin: true, harness: true, skills: true, webHarness: false, devSeat: false,
     configDir: "", kihDir: "", binDest: "", hqDir: "", update: false, autoUpdate: false, yes: false, project: false, sets: [] };
   for (let i = 1; i < argv.length; i++) {
     const a = argv[i];
@@ -65,6 +78,7 @@ function parseArgs(argv) {
     else if (a === "--no-harness") o.harness = false;
     else if (a === "--no-skills") o.skills = false;
     else if (a === "--web-harness") o.webHarness = true;
+    else if (a === "--dev-seat") o.devSeat = true;
     else if (a === "--config-dir") o.configDir = argv[++i] || "";
     else if (a === "--kih-dir") o.kihDir = argv[++i] || "";
     else if (a === "--bin-dest") o.binDest = argv[++i] || "";
@@ -86,17 +100,19 @@ function configDir(o) {
 }
 
 const hasHook = (d) => !!d && existsSync(join(d, ".claude", "hooks", "wkharness-run.sh"));
-// A kih CHECKOUT (never the web harness): explicit dirs first, then the usual checkout places.
-// WK_KIH_DIR=none: act as on a machine with no checkout (the selftest's isolation from this VM's kih).
+// A harness CHECKOUT (never the web harness): explicit dirs first, then this package's parent (a checkout's
+// wkappbot-code/ folder) and the HOME-relative clone. No machine-specific absolute path is ever searched.
+// WK_KIH_DIR=none: act as on a machine with no checkout (the selftest's isolation from this VM's checkout).
+export function checkoutCandidates(o = {}, env = process.env, home = homedir()) {
+  if (env.WK_KIH_DIR === "none") return o.kihDir ? [o.kihDir] : [];
+  return [o.kihDir, env.WK_KIH_DIR, resolve(PKG_DIR, ".."), join(home, "wkappbot-kih")].filter(Boolean);
+}
 function kihCheckout(o) {
-  if (process.env.WK_KIH_DIR === "none") return o.kihDir && hasHook(o.kihDir) ? resolve(o.kihDir) : "";
-  const tries = [o.kihDir, process.env.WK_KIH_DIR, resolve(PKG_DIR, ".."),
-    join(homedir(), "wkappbot-kih"), "/home/user/wkappbot-kih", "D:/GitHub/wkappbot-kih"];
-  for (const d of tries) if (hasHook(d)) return resolve(d);
+  for (const d of checkoutCandidates(o)) if (hasHook(d)) return resolve(d);
   return "";
 }
-// The kih root whose .claude/hooks/wkharness-run.sh the plugin calls: a checkout, else the web harness
-// (~/.wk-harness). Empty = plugin fails open.
+// The harness root whose .claude/hooks/wkharness-run.sh the plugin calls: a checkout, else the web harness
+// (~/.wk-harness). Empty = no hook: the plugin then refuses the risky classes and lets the rest through.
 function kihDir(o) {
   return kihCheckout(o) || (hasHook(HARNESS_DIR()) ? resolve(HARNESS_DIR()) : "");
 }
@@ -105,12 +121,16 @@ function opencodeVersion() {
   try { return execFileSync("opencode", ["--version"], { shell: process.platform === "win32",  encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim(); }
   catch { return ""; }
 }
+const which = (cmd) => { const r = spawnSync("sh", ["-c", "command -v " + cmd], { encoding: "utf8" }); return r.status === 0 ? r.stdout.trim() : ""; };
+const pwshPath = () => which("pwsh") || which("powershell");
 
 const stamp = () => new Date().toISOString().replace(/[-:]/g, "").replace(/\..*/, "");
 const log = (s) => console.log("[wkappbot-code] " + s);
 const sha256File = (f) => createHash("sha256").update(readFileSync(f)).digest("hex");
 const statePath = (o) => join(configDir(o), "wkappbot-code", "install-state.json");
 function readState(o) { try { return JSON.parse(readFileSync(statePath(o), "utf8")); } catch { return {}; } }
+const gitGlobal = (...a) => spawnSync("git", ["config", "--global", ...a], { encoding: "utf8" });
+const globalHooksPath = () => { const r = gitGlobal("--get", "core.hooksPath"); return r.status === 0 ? r.stdout.trim() : null; };
 
 // Same rule as wk-bin-acquire.sh platform_detect (linux-x64, osx-arm64, osx-x64, win-x64).
 export function platformId(platform = process.platform, arch = process.arch) {
@@ -125,6 +145,18 @@ export function mergeConfig(user, template, url, kih) {
   return buildConfig(user, { plugin: { value: url }, harness: { value: kih } }, template);
 }
 
+// The advisory verify line the harness install prints (scripts/wk-harness-verify.sh): a miss is NOT a broken install.
+const VERIFY_MEANING = { c1: "wkappbot not on PATH", c2: "wkhippo not on PATH (the memory tool ships with a harness checkout only)",
+  c3: "no PreToolUse hook names wkharness in settings.json", c4: "no Stop hook names wkharness in settings.json",
+  c5: "wkappbot skill read on-load did not exit 0 (no core yet, or --no-bin)", c6: "no harness git checkout (expected for the web harness)" };
+export function verifyLine(line) {
+  const m = /\[wk-verify\] FAIL (\d)\/6:\s*(.*)$/.exec(line);
+  if (!m) return line;
+  const ids = m[2].trim().split(/\s+/).filter(Boolean);
+  return line.slice(0, m.index) + "[wk-verify] WARN " + m[1] + "/6 advisory, not a failure -- " +
+    ids.map((c) => c + " " + (VERIFY_MEANING[c] || "missed")).join("; ") + " (verdict: " + join(STATE_HOME(), "verify.json") + ")";
+}
+
 // ---- part: bin ------------------------------------------------------------------------------------
 function binDest(o) {
   if (o.binDest) return resolve(o.binDest);
@@ -145,13 +177,13 @@ function installBin(o) {
   const dest = binDest(o);
   const plat = platformId();
   if (!plat) return { ok: false, dest, note: "no wkappbot build for " + process.platform + "-" + process.arch };
-  if (plat === "win-x64") return { ok: false, dest, note: "win-x64 has no single SDK asset; run install.cmd from a kih checkout" };
-  // A kih checkout runs its own copy (same bytes, plus the MANIFEST-verified repo bin/ fallback); the package
+  if (plat === "win-x64") return { ok: false, dest, note: "win-x64 has no single SDK asset; run install.cmd from a harness checkout" };
+  // A checkout runs its own copy (same bytes, plus the MANIFEST-verified repo bin/ fallback); the package
   // copy outside a checkout takes only the SDK release asset verified by SHA256SUMS.
   const co = kihCheckout(o);
   const script = co && existsSync(join(co, "tools", "wk-bin-acquire.sh")) ? join(co, "tools", "wk-bin-acquire.sh") : join(PKG_DIR, "lib", "wk-bin-acquire.sh");
   log("bin: bash " + script + " acquire --dest " + dest);
-  const r = spawnSync("bash", [shPath(script), "acquire", "--dest", shPath(dest)], { encoding: "utf8", env: process.env });
+  const r = spawnSync("bash", [shPath(script), "acquire", "--dest", shPath(dest)], { encoding: "utf8", env: shEnv() });
   for (const line of ((r.stdout || "") + (r.stderr || "")).split("\n").filter(Boolean)) log("  " + line);
   if (r.status !== 0) return { ok: false, dest, note: "wk-bin-acquire rc " + r.status };
   // Put `wkappbot` on PATH beside wkappbot-code itself, unless that name is already taken by someone else.
@@ -182,7 +214,7 @@ function curl(url, out) {
 function installHarness(o) {
   const found = kihCheckout(o);
   if (found && !o.webHarness) {
-    log("harness: kih checkout " + found + " found; the web harness is not needed (--web-harness forces it)");
+    log("harness: checkout " + found + " found; the web harness is not needed (--web-harness forces it)");
     return { ok: true, mode: "checkout", dir: found };
   }
   const tmp = mkdtempSync(join(tmpdir(), "wk-appbot-harness-"));
@@ -190,11 +222,17 @@ function installHarness(o) {
     const err = curl(HARNESS_BASE() + "/install.sh", join(tmp, "install.sh"));
     if (err) return { ok: false, mode: "web", dir: HARNESS_DIR(), note: err };
     log("harness: sh " + HARNESS_BASE() + "/install.sh  (to " + HARNESS_DIR() + ")");
+    mkdirSync(STATE_HOME(), { recursive: true });
     const r = spawnSync("sh", [shPath(join(tmp, "install.sh"))], { encoding: "utf8",
-      env: { ...process.env, WK_HARNESS_BASE: HARNESS_BASE(), WK_HARNESS_DIR: shPath(HARNESS_DIR()) } });
-    for (const line of ((r.stdout || "") + (r.stderr || "")).split("\n").filter(Boolean)) log("  " + line);
+      env: shEnv({ WK_HARNESS_BASE: HARNESS_BASE(), WK_HARNESS_DIR: shPath(HARNESS_DIR()), WK_VERIFY_OUT: shPath(join(STATE_HOME(), "verify.json")) }) });
+    for (const line of ((r.stdout || "") + (r.stderr || "")).split("\n").filter(Boolean)) log("  " + verifyLine(line));
     const ok = r.status === 0 && hasHook(HARNESS_DIR());
-    return { ok, mode: "web", dir: HARNESS_DIR(), note: ok ? "" : "harness install rc " + r.status };
+    // USER INSTALL MARK: the launcher then takes the sh lite harness as the whole verdict and the emergency-edit door
+    // never grants or prints (wkharness-run.sh FULL, Test-WkEmergencyEditAllow.ps1). --dev-seat keeps the full harness.
+    const mark = join(HARNESS_DIR(), USER_MARK);
+    if (ok && !o.devSeat) writeFileSync(mark, "user install by wkappbot-code " + PKG.version + "\n");
+    else if (ok && o.devSeat) rmSync(mark, { force: true });
+    return { ok, mode: "web", dir: HARNESS_DIR(), userInstall: ok && !o.devSeat, note: ok ? "" : "harness install rc " + r.status };
   } finally { rmSync(tmp, { recursive: true, force: true }); }
 }
 
@@ -284,7 +322,8 @@ function installPlugin(o, kih, kihSource) {
   mkdirSync(join(cfg, "wkappbot-code"), { recursive: true });
   const dest = join(cfg, "wkappbot-code", "wisdom-kernel.js");
   copyFileSync(join(PKG_DIR, "plugin", "wisdom-kernel.js"), dest);
-  // The copy imports nothing from the package, but mark its folder ESM so Node never re-parses it.
+  // The plugin file exports ONLY the plugin (OpenCode calls every named export as one); its helpers ride beside it.
+  copyFileSync(join(PKG_DIR, "lib", "wk-hook.js"), join(cfg, "wkappbot-code", "wk-hook.js"));
   writeFileSync(join(cfg, "wkappbot-code", "package.json"), '{ "type": "module" }\n');
   const url = pathToFileURL(dest).href;
   const tmpl = JSON.parse(readFileSync(join(PKG_DIR, "opencode.json"), "utf8"));
@@ -294,7 +333,7 @@ function installPlugin(o, kih, kihSource) {
     raw = readFileSync(target, "utf8");
     try { user = JSON.parse(raw); } catch { user = null; }
   }
-  const it = detect({ user: user || {}, pluginUrl: url, kih, kihSource: kihSource || "kih checkout" });
+  const it = detect({ user: user || {}, pluginUrl: url, kih, kihSource: kihSource || "harness checkout" });
   for (const k of applySets(it, o.sets)) log("config: unknown --set key " + k + " (provider|model|plugin|harness)");
   printDetected(it, log);
   if (process.stdin.isTTY && process.stdout.isTTY && !o.yes) askEach(it);
@@ -322,10 +361,29 @@ function installPlugin(o, kih, kihSource) {
   log("config: " + target + note);
 }
 
+// The machine state an uninstall must give back, recorded ONCE (a re-install never overwrites the first record, or
+// it would record our own dispatcher as the "prior" hooksPath). Shim paths are those install may create.
+function shimCandidates() {
+  return [join(linkDir(), "wkappbot"), join(HARNESS_LINKS(), "wkskill"), join(HARNESS_LINKS(), "wk-verify")];
+}
+const PRE_SETTINGS = () => join(STATE_HOME(), "settings.pre-install.json");
+function recordPrior(prev) {
+  if (prev && prev.prior) return prev.prior;
+  // The user's settings.json as it was, byte for byte: uninstall gives these bytes back when nothing else changed.
+  if (existsSync(SETTINGS()) && !existsSync(PRE_SETTINGS())) { mkdirSync(STATE_HOME(), { recursive: true }); copyFileSync(SETTINGS(), PRE_SETTINGS()); }
+  return { hooksPath: globalHooksPath(), settingsExisted: existsSync(SETTINGS()), harnessDirExisted: existsSync(HARNESS_DIR()),
+    hooksDirExisted: existsSync(HOOKS_DIR()), shimsExisting: shimCandidates().filter((p) => existsSync(p) || isSymlink(p)) };
+}
+
 function install(o) {
-  const st = { version: PKG.version, at: new Date().toISOString() };
+  const prev = readState(o);
+  const st = { version: PKG.version, at: new Date().toISOString(), prior: recordPrior(prev) };
   let bad = 0;
   if (o.update) log("install --update: refreshing the core, the harness and the public skills");
+  const ps = pwshPath();
+  log("pwsh: " + (ps || "not found") + " -- the FULL harness (PowerShell 7) runs only on a dev seat (a harness checkout, or --dev-seat);" +
+    " a user install and every seat without pwsh take the sh lite harness, which still refuses git --no-verify/--force/core.hooksPath," +
+    " rm -rf of HOME or the project, and writes under .git");
   if (o.npm) {
     const have = opencodeVersion();
     if (have === OPENCODE_VERSION) log("opencode " + have + " already installed");
@@ -345,20 +403,107 @@ function install(o) {
   // A user's own absolute global core.hooksPath is kept (the script WARNs). Skipped with --no-harness.
   st.pushGate = { skipped: true };
   if (o.harness && kih && existsSync(join(kih, "tools", "wk-global-hooks.sh"))) {
-    const r = spawnSync("bash", [shPath(join(kih, "tools", "wk-global-hooks.sh")), "install", "--gate-dir", shPath(join(kih, ".githooks", "lib"))], { encoding: "utf8" });
+    const r = spawnSync("bash", [shPath(join(kih, "tools", "wk-global-hooks.sh")), "install", "--gate-dir", shPath(join(kih, ".githooks", "lib"))], { encoding: "utf8", env: shEnv() });
     for (const line of ((r.stdout || "") + (r.stderr || "")).split("\n").filter(Boolean)) log("push-gate: " + line);
     st.pushGate = { ok: r.status === 0, kih };
   }
   st.skills = o.skills ? installSkills(o, dest) : { skipped: true };
   if (o.skills && !st.skills.ok) { bad++; log("skills: FAILED -- " + (st.skills.note || "on-load missing from the HQ")); }
-  installPlugin(o, kih, (st.harness.mode === "web" && st.harness.ok) ? "web harness" : "kih checkout");
+  installPlugin(o, kih, (st.harness.mode === "web" && st.harness.ok) ? "web harness" : "harness checkout");
   st.kihDir = kih;
+  // The shims this install created (absent before, present now): uninstall removes exactly these.
+  st.shims = [...new Set([...(prev.shims || []), ...shimCandidates().filter((p) => (existsSync(p) || isSymlink(p)) && !st.prior.shimsExisting.includes(p))])];
   writeFileSync(statePath(o), JSON.stringify(st, null, 2) + "\n");
-  log("kih:    " + (kih || "NOT FOUND -- plugin fails open until --kih-dir or WK_KIH_DIR points at a kih checkout"));
+  log("kih:    " + (kih || "NOT FOUND -- no hook runs; the plugin still refuses the risky classes. Use --kih-dir or WK_KIH_DIR"));
   log((bad ? "done with " + bad + " failed part(s)" : "done") + " -- check: wkappbot-code doctor   then run: opencode");
   return bad ? 1 : 0;
 }
 
+// ---- uninstall ------------------------------------------------------------------------------------
+// Surgical: our hook arms leave settings.json, every other entry stays. A hook is ours when its command names the
+// lite harness or a file under the harness dir; a settings.json that did not exist before and is left empty goes.
+export function stripOurHooks(d, harnessDir) {
+  const ours = (c) => /wkharness-lite\.sh|wkharness-run\.sh/.test(c) || (!!harnessDir && c.includes(harnessDir));
+  let removed = 0;
+  const hooks = d && d.hooks;
+  if (!hooks || typeof hooks !== "object") return { d, removed };
+  for (const ev of Object.keys(hooks)) {
+    const groups = (hooks[ev] || []).map((g) => {
+      const hs = (g.hooks || []).filter((h) => { const o = ours(String(h.command || "")); if (o) removed++; return !o; });
+      return { ...g, hooks: hs };
+    }).filter((g) => g.hooks.length);
+    if (groups.length) hooks[ev] = groups; else delete hooks[ev];
+  }
+  if (!Object.keys(hooks).length) delete d.hooks;
+  return { d, removed };
+}
+const sortKeys = (v) => Array.isArray(v) ? v.map(sortKeys) : v && typeof v === "object" ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, sortKeys(v[k])])) : v;
+function uninstall(o) {
+  const st = readState(o);
+  const pr = st.prior || {};
+  let rc = 0;
+  if (!st.version) log("no install record at " + statePath(o) + "; removing only what is ours by name");
+  // 1. global core.hooksPath back to its recorded value (only when it still points at a dir we wrote)
+  const cur = globalHooksPath();
+  const oursHp = (p) => !!p && [HOOKS_DIR(), join(HARNESS_DIR(), ".githooks"), st.kihDir && join(st.kihDir, ".githooks")]
+    .filter(Boolean).some((x) => resolve(p.replace(/^~(?=\/|$)/, homedir())) === resolve(x));
+  if (cur !== (pr.hooksPath ?? null) && (cur === null || oursHp(cur))) {
+    const r = pr.hooksPath ? gitGlobal("core.hooksPath", pr.hooksPath) : gitGlobal("--unset", "core.hooksPath");
+    log("hooksPath: " + (cur || "unset") + " -> " + (pr.hooksPath || "unset") + (r.status === 0 ? "" : " (git rc " + r.status + ")"));
+  } else log("hooksPath: " + (cur || "unset") + (cur === (pr.hooksPath ?? null) ? " (as before install)" : " (set by you, kept)"));
+  // 2. settings.json: our arms out, yours kept
+  const sp = SETTINGS();
+  if (existsSync(sp)) {
+    try {
+      const raw = readFileSync(sp, "utf8");
+      const { d, removed } = stripOurHooks(JSON.parse(raw), HARNESS_DIR());
+      // A hook of yours that an older harness --wire dropped comes back from the pre-install snapshot; when the result is
+      // then the same JSON as before install, the snapshot's own bytes are written (formatting kept).
+      let preRaw = "", pre = null, restored = 0;
+      try { preRaw = readFileSync(PRE_SETTINGS(), "utf8"); pre = JSON.parse(preRaw); } catch {}
+      if (pre && pre.hooks) {
+        d.hooks = d.hooks || {};
+        for (const [ev, groups] of Object.entries(pre.hooks)) for (const g of groups || []) {
+          const have = JSON.stringify(d.hooks[ev] || []);
+          if (!have.includes(JSON.stringify(g))) { (d.hooks[ev] = d.hooks[ev] || []).push(g); restored++; }
+        }
+      }
+      if (removed || restored) {
+        copyFileSync(sp, sp + ".bak-" + stamp());
+        if (pr.settingsExisted === false && !Object.keys(d).length) { rmSync(sp); log("settings: removed " + sp + " (it did not exist before install)"); }
+        else {
+          const same = pre && JSON.stringify(sortKeys(pre)) === JSON.stringify(sortKeys(d));
+          writeFileSync(sp, same ? preRaw : JSON.stringify(d, null, 2) + "\n");
+          log("settings: removed " + removed + " harness hook entr" + (removed === 1 ? "y" : "ies") + (restored ? ", restored " + restored + " of yours" : "") +
+            " in " + sp + (same ? " (now byte-identical to before install)" : "; your other entries stay"));
+        }
+      } else log("settings: no harness hook in " + sp);
+    } catch (e) { rc = 1; log("settings: " + sp + " is not plain JSON, left untouched (" + e.message + ")"); }
+  }
+  // 3. the shims install created
+  for (const p of st.shims || []) {
+    if (isSymlink(p) || existsSync(p)) { rmSync(p, { force: true }); log("shim: removed " + p); }
+  }
+  // 4. the harness dirs we created, the plugin entry and our config folder
+  if (st.harness && st.harness.mode === "web" && pr.harnessDirExisted !== true && existsSync(HARNESS_DIR())) { rmSync(HARNESS_DIR(), { recursive: true, force: true }); log("harness: removed " + HARNESS_DIR()); }
+  if (pr.hooksDirExisted !== true && existsSync(HOOKS_DIR())) { rmSync(HOOKS_DIR(), { recursive: true, force: true }); log("push-gate: removed " + HOOKS_DIR()); }
+  const cfgFile = join(configDir(o), "opencode.json");
+  try {
+    const c = JSON.parse(readFileSync(cfgFile, "utf8"));
+    const keep = (c.plugin || []).filter((p) => !String(Array.isArray(p) ? p[0] : p).includes("wisdom-kernel"));
+    if (keep.length !== (c.plugin || []).length) {
+      copyFileSync(cfgFile, cfgFile + ".bak-" + stamp());
+      if (keep.length) c.plugin = keep; else delete c.plugin;
+      writeFileSync(cfgFile, JSON.stringify(c, null, 2) + "\n");
+      log("config: plugin entry removed from " + cfgFile);
+    }
+  } catch {}
+  rmSync(STATE_HOME(), { recursive: true, force: true });
+  rmSync(join(configDir(o), "wkappbot-code"), { recursive: true, force: true });
+  log("uninstall done. Kept: opencode-ai, the wkappbot core (" + ((st.bin && st.bin.dest) || binDest(o)) + ") and its skills, and this CLI (npm rm -g wkappbot-code)");
+  return rc;
+}
+
 // ---- doctor ---------------------------------------------------------------------------------------
 // The GitHub login a skill push would use: gh when present, else "none". Push is the owner's alone.
 export function pushLogin() {
@@ -367,6 +512,15 @@ export function pushLogin() {
   return r.status === 0 && r.stdout.trim() ? r.stdout.trim() : "none";
 }
 
+// The verdict road a pre call takes in harness dir k: "full" (pwsh hub, lite first for OpenCode), "lite", or "" (none).
+export function harnessMode(k, ps = pwshPath()) {
+  if (!hasHook(k)) return "";
+  const lite = existsSync(join(k, "tools", "wkharness-lite.sh"));
+  const user = existsSync(join(k, USER_MARK));
+  if (ps && !user) return "full";
+  return lite ? "lite" : "";
+}
+
 function doctor(o) {
   const cfg = configDir(o);
   const st = readState(o);
@@ -375,7 +529,7 @@ function doctor(o) {
   const v = opencodeVersion();
   add("opencode", v === OPENCODE_VERSION, v ? v + (v === OPENCODE_VERSION ? "" : " (pinned " + OPENCODE_VERSION + ")") : "not on PATH", false);
   const pdest = join(cfg, "wkappbot-code", "wisdom-kernel.js");
-  add("plugin", existsSync(pdest), pdest, true);
+  add("plugin", existsSync(pdest) && existsSync(join(cfg, "wkappbot-code", "wk-hook.js")), pdest + " + wk-hook.js", true);
   let entry = null;
   try { entry = (JSON.parse(readFileSync(join(cfg, "opencode.json"), "utf8")).plugin || []).find((p) => String(Array.isArray(p) ? p[0] : p).includes("wisdom-kernel")); } catch {}
   add("config", !!entry, join(cfg, "opencode.json"), true);
@@ -390,19 +544,15 @@ function doctor(o) {
     core = r.status === 0 ? (r.stdout || "").trim().split("\n")[0] : "";
     add("bin", !!core, core ? dest + "  " + core + (st.bin && st.bin.link ? "  (PATH link " + st.bin.link + ")" : "") : dest + " does not run", !!(st.bin && !st.bin.skipped));
   }
-  // kih-hook: the harness the plugin calls
+  // kih-hook: the harness the plugin calls, and the verdict road it takes. No pwsh and no lite = NO verdict at all:
+  // that is a FAIL whatever the install mode, since the plugin then only refuses its own risky classes.
   const k = (entry && Array.isArray(entry) && entry[1] && entry[1].kihDir) || kihDir(o);
   const hk = hasHook(k);
+  const ps = pwshPath();
+  const mode = harnessMode(k, ps);
   if (st.harness && st.harness.skipped && !hk) add("kih-hook", false, "skipped (--no-harness)", false, true);
-  else add("kih-hook", hk, k ? k + (st.harness && st.harness.mode ? "  (" + st.harness.mode + ")" : "") : "not found", !!(st.harness && st.harness.mode === "web"));
-  // guards: which guard set the plugin can run. The full set needs PowerShell; without it the plugin falls back to
-  // the bash lite harness (intent lock, study lock), so this row WARNs instead of passing silently (QA 2026-11-06).
-  if (hk) {
-    const psDirs = String(process.env.PATH || "").split(IS_WIN ? ";" : ":");
-    const ps = ["pwsh", "pwsh.exe", "powershell.exe", "powershell"].find((n) => psDirs.some((d) => d && existsSync(join(d, n))));
-    const lite = existsSync(join(k, "tools", "wkharness-lite.sh"));
-    add("guards", !!ps, ps ? "full guard set (" + ps + ")" : lite ? "no PowerShell on PATH: lite guards only (intent lock, study lock); install pwsh 7 for the full set" : "no PowerShell and no lite harness: every tool call is let through", !ps && !lite);
-  }
+  else if (hk && !mode) add("kih-hook", false, k + ": pwsh is missing and the lite harness (tools/wkharness-lite.sh) is not there -- no hook verdict; reinstall the harness", true);
+  else add("kih-hook", hk, k ? k + (st.harness && st.harness.mode ? "  (" + st.harness.mode + ")" : "") + (mode ? "  verdict: " + (mode === "full" ? "full pwsh hub (" + ps + ") after lite" : "lite sh harness" + (ps ? " (user install)" : " (no pwsh)")) : "") : "not found", !!(st.harness && st.harness.mode === "web"));
   // skills: the HQ holds on-load and the core prints it
   const hq = (st.skills && st.skills.hq) || hqDir(o, dest);
   if (st.skills && st.skills.skipped) add("skills", false, "skipped (--no-skills)", false, true);
@@ -420,7 +570,7 @@ function doctor(o) {
     add("skills", n > 0 && printed, n + " skills in " + hq + (printed ? "; wkappbot skill read on-load prints" : why), !!(st.skills && !st.skills.skipped));
   }
   // push-gate: the global core.hooksPath runs the push-owner gate (directly, or through the global dispatcher).
-  const ghp = (() => { try { return execFileSync("git", ["config", "--global", "--get", "core.hooksPath"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim(); } catch { return ""; } })();
+  const ghp = globalHooksPath() || "";
   let gated = false;
   try { gated = /push-owner-gate|wk-global-hooks\.sh/.test(readFileSync(join(ghp.replace(/^~(?=\/|$)/, homedir()), "pre-push"), "utf8")); } catch {}
   add("push-gate", gated, "global core.hooksPath " + (ghp || "unset") + (gated ? " runs the push-owner gate" : " does not run the push-owner gate"), false);
@@ -452,12 +602,13 @@ switch (o.cmd) {
   case "--version": case "-v": case "version":
     console.log("wkappbot-code " + PKG.version + " (opencode-ai " + OPENCODE_VERSION + ")"); process.exit(0);
   case "install": process.exit(install(o));
+  case "uninstall": process.exit(uninstall(o));
   case "doctor": process.exit(doctor(o));
   case "update": process.exit(upd());
-  case "config": installPlugin(o, kihDir(o), kihCheckout(o) ? "kih checkout" : "web harness"); process.exit(0);
+  case "config": installPlugin(o, kihDir(o), kihCheckout(o) ? "harness checkout" : "web harness"); process.exit(0);
   default:
-    console.log("usage: wkappbot-code --version | install [--no-npm] [--no-bin] [--no-harness] [--no-skills] [--web-harness]\n" +
+    console.log("usage: wkappbot-code --version | install [--no-npm] [--no-bin] [--no-harness] [--no-skills] [--web-harness] [--dev-seat]\n" +
       "         [--config-dir DIR] [--kih-dir DIR] [--bin-dest FILE] [--hq-dir DIR] [--update] [--auto-update] | doctor [--config-dir DIR]\n" +
-      "       | update [install opts] | config [--yes] [--project] [--set key=value] [--config-dir DIR]");
+      "       | uninstall [--config-dir DIR] | update [install opts] | config [--yes] [--project] [--set key=value] [--config-dir DIR]");
     process.exit(o.cmd === "help" || o.cmd === "--help" ? 0 : 64);
 }

package/lib/config.js

@@ -97,9 +97,13 @@ export function buildConfig(user, it, template) {
   const ours = [it.plugin ? it.plugin.value : "", { kihDir: it.harness ? it.harness.value : "" }];
   const keep = (Array.isArray(user.plugin) ? user.plugin : []).filter((p) => !String(Array.isArray(p) ? p[0] : p).includes("wisdom-kernel"));
   out.plugin = [...keep, ours];
-  if (!out.provider) out.provider = template.provider;
-  else if (template.provider) for (const [k, v] of Object.entries(template.provider)) if (!(k in out.provider)) out.provider[k] = v;
-  if (!out.permission) out.permission = template.permission;
+  // 0.3.1 (owner: minimum items only): the shipped template carries no provider and no permission, so nothing is
+  // added for them; a template that does carry one still only fills what the user has not set.
+  if (template.provider) {
+    if (!out.provider) out.provider = template.provider;
+    else for (const [k, v] of Object.entries(template.provider)) if (!(k in out.provider)) out.provider[k] = v;
+  }
+  if (template.permission && !out.permission) out.permission = template.permission;
   if (it.model && (it.model.forced || !user.model)) out.model = it.model.value;
   return out;
 }

package/lib/wk-hook.js

@@ -0,0 +1,278 @@
+// wk-hook.js -- the helpers of the wisdom-kernel OpenCode plugin (wkappbot-code 0.3.1).
+// WHY A SEPARATE MODULE: OpenCode 1.19.5 calls EVERY named export of a plugin file as a plugin, so a helper or a
+// constant exported from plugin/wisdom-kernel.js made it fail with "Plugin export is not a function" and no hook
+// ever fired. The plugin file now exports only the plugin function; everything here is imported by it and by the
+// selftest. install copies this file beside the installed plugin.
+// Spec: wkappbot skill read agent-harness-landscape-2026-howto
+import { spawn } from "node:child_process";
+import { appendFileSync, existsSync, mkdirSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// OpenCode tool id -> Claude tool name the kih guards already know.
+export const TOOL_MAP = {
+  bash: "Bash", edit: "Edit", write: "Write", read: "Read",
+  glob: "Glob", grep: "Grep", list: "LS", patch: "Edit", multiedit: "MultiEdit",
+  webfetch: "WebFetch", websearch: "WebSearch", task: "Agent", todowrite: "TodoWrite",
+};
+
+// pre arm budget: a hung hook is killed. A timeout is NO verdict: allowed, unless the call is in a risky class.
+export const PRE_TIMEOUT_MS = Number(process.env.WK_APPBOT_PRE_TIMEOUT_MS || 60000);
+
+// OpenCode args (camelCase) -> Claude tool_input (snake_case) for the tools the guards inspect.
+export function toClaudeInput(tool, args) {
+  const a = args || {};
+  switch (tool) {
+    case "bash": {
+      const o = { command: a.command ?? "" };
+      if (a.description !== undefined) o.description = a.description;
+      if (a.timeout !== undefined) o.timeout = a.timeout;
+      return o;
+    }
+    case "edit":
+      return { file_path: a.filePath ?? a.file_path, old_string: a.oldString ?? a.old_string,
+               new_string: a.newString ?? a.new_string, replace_all: a.replaceAll ?? a.replace_all ?? false };
+    case "write":
+      return { file_path: a.filePath ?? a.file_path, content: a.content ?? "" };
+    case "read": {
+      const o = { file_path: a.filePath ?? a.file_path };
+      if (a.offset !== undefined) o.offset = a.offset;
+      if (a.limit !== undefined) o.limit = a.limit;
+      return o;
+    }
+    default: {
+      const o = { ...a };
+      if (o.filePath !== undefined && o.file_path === undefined) o.file_path = o.filePath;
+      return o;
+    }
+  }
+}
+
+export function claudeToolName(tool) {
+  return TOOL_MAP[tool] || tool;
+}
+
+// The Claude-shaped hook payload for one OpenCode tool call.
+export function buildPreToolUsePayload(input, args, cwd) {
+  return {
+    hook_event_name: "PreToolUse",
+    session_id: input.sessionID,
+    cwd: (args && args.workdir) || cwd,
+    tool_name: claudeToolName(input.tool),
+    tool_input: toClaudeInput(input.tool, args),
+    tool_use_id: input.callID,
+    agent_family: "opencode",
+  };
+}
+
+export function buildPostToolUsePayload(input, output, cwd) {
+  const p = buildPreToolUsePayload(input, input.args, cwd);
+  p.hook_event_name = "PostToolUse";
+  p.tool_response = { output: output && output.output, title: output && output.title };
+  return p;
+}
+
+// chat.message -> UserPromptSubmit (the intent lock arm). The prompt is the text parts of the user message.
+export function buildPromptPayload(input, output, cwd) {
+  const parts = (output && output.parts) || [];
+  const prompt = parts.filter((p) => p && p.type === "text" && typeof p.text === "string").map((p) => p.text).join("\n");
+  const sid = (input && input.sessionID) || (output && output.message && output.message.sessionID);
+  return { hook_event_name: "UserPromptSubmit", session_id: sid, cwd, prompt, agent_family: "opencode" };
+}
+
+// kih root: WK_KIH_DIR, else the checkout this file sits in (wkappbot-code/lib -> ../..).
+export function resolveKihDir() {
+  if (process.env.WK_KIH_DIR && process.env.WK_KIH_DIR !== "none") return process.env.WK_KIH_DIR;
+  try {
+    const up = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+    if (existsSync(join(up, ".claude", "hooks", "wkharness-run.sh"))) return up;
+  } catch {}
+  return "";
+}
+
+// Pipe JSON into "wkharness-run.sh <arm>"; resolves {code, stdout, stderr}. Never rejects.
+// No hook found = {skipped}: no verdict (allowed unless the call is in a risky class).
+export function runHook(arm, payload, opts = {}) {
+  const kih = opts.kihDir ?? resolveKihDir();
+  const hook = opts.hook || process.env.WK_APPBOT_HOOK || (kih && join(kih, ".claude", "hooks", "wkharness-run.sh"));
+  return new Promise((done) => {
+    let settled = false;
+    const finish = (r) => { if (!settled) { settled = true; if (timer) clearTimeout(timer); done(r); } };
+    let timer = null, out = "", err = "", child;
+    if (!hook || !existsSync(hook)) return finish({ code: 0, stdout: "", stderr: "", skipped: true });
+    let body;
+    try { body = JSON.stringify(payload); } catch (e) { return finish({ code: 0, stdout: "", stderr: String(e), skipped: true }); }
+    try {
+      // Windows: Git Bash runs the hook, so every path it gets (the script, CLAUDE_PROJECT_DIR, HOME) is the MSYS
+      // form /d/a/x; a "D:\\a\\x" path fails the harness's absolute-path tests (SDK all-OS QA 2026-11-06).
+      const W = process.platform === "win32";
+      const sp = (p) => (W && /^[A-Za-z]:[\\/]/.test(p) ? "/" + p[0].toLowerCase() + p.slice(2).replace(/\\/g, "/") : p);
+      child = spawn("bash", [sp(hook), arm], {
+        env: { ...process.env, ...(W ? { HOME: sp(homedir()) } : {}), ...(kih ? { CLAUDE_PROJECT_DIR: sp(kih) } : {}) },
+        stdio: ["pipe", "pipe", "pipe"],
+      });
+    } catch (e) {
+      return finish({ code: 0, stdout: "", stderr: String(e), skipped: true });
+    }
+    if (opts.timeoutMs) {
+      timer = setTimeout(() => {
+        try { child.kill("SIGKILL"); } catch {}
+        finish({ code: 0, stdout: out, stderr: err, timedOut: true });
+      }, opts.timeoutMs);
+    }
+    child.stdout.on("data", (d) => (out += d));
+    child.stderr.on("data", (d) => (err += d));
+    child.on("error", (e) => finish({ code: 0, stdout: out, stderr: err + String(e), skipped: true }));
+    child.on("close", (code) => finish({ code: code ?? 0, stdout: out, stderr: err }));
+    child.stdin.on("error", () => {});
+    child.stdin.end(body);
+  });
+}
+
+// Claude contract: exit 2 refuses; so does a stdout JSON deny/block verdict.
+export function isRefusal(r) {
+  if (r.timedOut || r.skipped) return false;
+  if (r.code === 2) return true;
+  try {
+    const j = JSON.parse(r.stdout);
+    return (j.hookSpecificOutput && j.hookSpecificOutput.permissionDecision === "deny") || j.decision === "block";
+  } catch { return false; }
+}
+
+// A VERDICT is rc 0 or rc 2 from a hook that ran to the end. Anything else (pwsh missing = 127, a crash, a kill at
+// the budget, no hook at all) is NO verdict.
+export function hasVerdict(r) {
+  return !r.timedOut && !r.skipped && (r.code === 0 || r.code === 2);
+}
+
+// A stdout deny JSON names its own reason; stderr then may hold only warn lines (wkharness-run.sh wk_pre_emit).
+export function refusalReason(r) {
+  try {
+    const j = JSON.parse(r.stdout);
+    const why = (j.hookSpecificOutput && j.hookSpecificOutput.permissionDecisionReason) || j.reason;
+    if (why) return why;
+  } catch {}
+  return (r.stderr || "").trim() || (r.stdout || "").trim() || "refused by the kih harness";
+}
+
+// ---- fail-closed risk classes ----------------------------------------------------------------------------
+// The SAME classes tools/wkharness-lite.sh refuses by itself (wk_lite_risk there). With NO verdict from the harness,
+// a call in one of these classes is REFUSED instead of allowed: a public package must never let rm -rf HOME through
+// because pwsh happened to be missing. Returns the class label, or "".
+const HOME_T = /^(~|\$HOME|\$\{HOME\}|\/root|\/home\/[^/]+|\/Users\/[^/]+)\/?(\*|\.\*)?$/;
+export function riskClass(tool, input, cwd) {
+  const t = claudeToolName(tool);
+  const i = input || {};
+  if (t === "Bash") {
+    const c = String(i.command || "");
+    for (const seg of c.split(/&&|\|\||[;|\n]/)) {
+      const w = seg.trim().split(/\s+/).map((x) => x.replace(/^['"]|['"]$/g, ""));
+      const gi = w.indexOf("git");
+      if (gi >= 0) {
+        const g = w.slice(gi + 1);
+        const sub = g.find((x) => !x.startsWith("-") && !/^[\w.]+=/.test(x) && g[g.indexOf(x) - 1] !== "-C" && g[g.indexOf(x) - 1] !== "-c");
+        if (g.includes("--no-verify") || (sub === "commit" && g.some((x) => /^-[A-Za-z]*n[A-Za-z]*$/.test(x)))) return "git --no-verify";
+        if (sub === "push" && g.some((x) => /^--force(-with-lease)?(=.*)?$|^--force-if-includes$/.test(x) || /^-[A-Za-z]*f[A-Za-z]*$/.test(x) || /^\+\S/.test(x))) return "git push --force";
+        if (g.some((x) => /^core\.hookspath(=.*)?$/i.test(x)) && (sub === "config" || g.includes("-c")) && !g.some((x) => /^--(get|get-all|get-regexp|list|show-origin)$/.test(x))) return "git core.hooksPath change";
+      }
+      const ri = w.indexOf("rm");
+      if (ri >= 0) {
+        const a = w.slice(ri + 1);
+        if (a.some((x) => /^-[A-Za-z]*[rR][A-Za-z]*$|^--recursive$/.test(x))) {
+          const tg = a.filter((x) => !x.startsWith("-"));
+          const proj = cwd ? String(cwd).replace(/\/+$/, "") : "";
+          if (tg.some((x) => HOME_T.test(x) || x === "/" || x === "/*")) return "rm -r of HOME or /";
+          if (tg.some((x) => [".", "./", "./*", "*", "..", "../"].includes(x) || (proj && x.replace(/\/+$/, "") === proj))) return "rm -r of the project source";
+          if (tg.some((x) => /(^|\/)\.git(\/|$)/.test(x))) return "write under .git";
+        }
+      }
+      if (/(^|[\s/'"=>])\.git(\/|\s|$)/.test(seg) && (/>/.test(seg) || /^(rm|mv|cp|tee|truncate|dd|ln|chmod|sed)\b/.test(seg.trim()))) return "write under .git";
+    }
+    return "";
+  }
+  if (["Edit", "Write", "MultiEdit", "NotebookEdit"].includes(t)) {
+    const f = String(i.file_path || i.notebook_path || "");
+    if (/(^|[\\/])\.git[\\/]/.test(f)) return "write under .git";
+  }
+  return "";
+}
+
+// ---- read-only fast path ---------------------------------------------------------------------------------
+// These calls never start pwsh (5.3 s measured for echo hello): read tools, and ONE plain read-only shell command
+// with no chain, pipe, redirect or substitution. A path that looks like a secret is never fast (the full harness
+// keeps its say on it).
+const SECRET_RE = /(^|[\s/'"=])(\.ssh|\.aws|\.gnupg|\.netrc|\.env(\.[\w-]+)?|id_rsa\w*|id_ed25519\w*|credentials?(\.\w+)?|\.npmrc|\.pypirc|auth\.json|[\w.-]*(token|secret|passw)[\w.-]*)(?=$|[\s/'"])/i;
+const RO_CMD = /^\s*(ls|cat|grep|rg|head|tail|wc|pwd|echo|which|stat|git\s+(status|log|diff|show|branch|rev-parse))(\s|$)/;
+export function isFastRead(tool, input) {
+  const t = claudeToolName(tool);
+  const i = input || {};
+  if (t === "Read" || t === "Glob" || t === "Grep" || t === "LS") return !SECRET_RE.test(" " + String(i.file_path || i.path || "") + " " + String(i.pattern || ""));
+  if (t !== "Bash") return false;
+  const c = String(i.command || "");
+  if (!c.trim() || c.length > 400 || /[;&|<>`$\n\r\\(){}]/.test(c)) return false;
+  if (!RO_CMD.test(c) || SECRET_RE.test(c)) return false;
+  if (/^\s*git\b/.test(c) && /\s(--output\S*|--ext-diff|--exec\S*|-o)(\s|$)/.test(c)) return false;
+  return true;
+}
+
+// PER-CALL INJECTION (owner 2026-11-06: "so we must force our settings onto every model call OpenCode makes").
+// experimental.chat.system.transform appends RULES to the system array of EVERY model request, so a model that never
+// saw kih (Qwen, a fresh provider) still gets the reflex body. Short, fixed, no secrets. RULES_MARK makes the append
+// idempotent when OpenCode hands the same array back. Spec: agent-harness-landscape-2026 step PER-CALL INJECTION.
+export const RULES_MARK = "[wisdom-kernel rules]";
+export const RULES = [
+  RULES_MARK + " You run under the Wisdom Kernel harness (wkappbot-code). On every turn:",
+  "1. One command per shell call; never chain a write with anything else.",
+  "2. A refusal names a skill: run wkskill read <id> (or wkappbot skill read <id>) and apply its remedy; never route around it.",
+  "3. Never use git --no-verify or git push --force, never change core.hooksPath, never rm -r a home directory, / or the project source.",
+  "4. Never edit or delete files under .git.",
+  "5. After a new user prompt, run wkskill search <three or more words> before the first write; read-only tools stay open.",
+].join("\n");
+
+// The top step lines of the on-load skill, fetched ONCE per process (one OpenCode server = its sessions) in the
+// background; the transform waits at most ONLOAD_WAIT_MS for it and otherwise sends the fixed rules alone.
+const ONLOAD_WAIT_MS = Number(process.env.WK_APPBOT_ONLOAD_WAIT_MS || 1500);
+let _onload = null;
+export function onLoadLines(kihDir) {
+  if (_onload) return _onload;
+  _onload = new Promise((res) => {
+    const k = kihDir || resolveKihDir();
+    const cands = [process.env.WK_APPBOT_SKILL_CMD, k && join(k, "bin", "wkskill"), "wkskill"].filter(Boolean);
+    let out = "", done = false;
+    const finish = () => {
+      if (done) return; done = true;
+      // no secrets reach the model: a secret-file name (SECRET_RE), a key=value or key: value pair, or a URL drops the line
+      const lines = out.split("\n").map((l) => l.trim()).filter((l) => /^\d+\.\s/.test(l) && !SECRET_RE.test(l) &&
+        !/(token|secret|passw\w*|api[_-]?key|auth)\s*[=:]/i.test(l) && !/https?:\/\//.test(l));
+      res(lines.slice(0, 3).map((l) => l.slice(0, 240)));
+    };
+    try {
+      const c = spawn(cands.find((p) => p === "wkskill" || existsSync(p)), ["read", "on-load"], { stdio: ["ignore", "pipe", "ignore"] });
+      c.stdout.on("data", (d) => { out += d; if (out.length > 65536) c.kill("SIGKILL"); });
+      c.on("error", finish); c.on("close", finish);
+      setTimeout(() => { try { c.kill("SIGKILL"); } catch {} finish(); }, 8000).unref();
+    } catch { finish(); }
+  });
+  return _onload;
+}
+export async function rulesBlock(kihDir) {
+  let top = [];
+  try { top = await Promise.race([onLoadLines(kihDir), new Promise((r) => setTimeout(() => r([]), ONLOAD_WAIT_MS))]); } catch {}
+  return top.length ? RULES + "\nFrom the on-load skill:\n" + top.join("\n") : RULES;
+}
+export function injectRules(system, block) {
+  if (!Array.isArray(system) || system.some((s) => String(s).includes(RULES_MARK))) return false;
+  system.push(block);
+  return true;
+}
+
+// One line per model-call hook into ~/.wkappbot-code/plugin.log (chat.params is logged, never changed). Capped at 1 MB.
+export function hookLog(hook, fields) {
+  try {
+    const f = process.env.WK_APPBOT_LOG || join(homedir(), ".wkappbot-code", "plugin.log");
+    mkdirSync(dirname(f), { recursive: true });
+    try { if (statSync(f).size > 1048576) writeFileSync(f, ""); } catch {}
+    appendFileSync(f, new Date().toISOString() + " " + hook + " " + JSON.stringify(fields || {}) + "\n");
+  } catch {}
+}

package/opencode.json

@@ -2,30 +2,5 @@
   "$schema": "https://opencode.ai/config.json",
   "plugin": [
     ["__WK_PLUGIN_URL__", { "kihDir": "__WK_KIH_DIR__" }]
-  ],
-  "permission": {
-    "edit": "ask",
-    "webfetch": "ask",
-    "bash": {
-      "*": "ask",
-      "ls*": "allow",
-      "pwd": "allow",
-      "git status*": "allow",
-      "git diff*": "allow",
-      "git log*": "allow"
-    }
-  },
-  "provider": {
-    "qwen-inhouse": {
-      "npm": "@ai-sdk/openai-compatible",
-      "name": "In-house Qwen (OpenAI-compatible)",
-      "options": {
-        "baseURL": "{env:QWEN_BASE_URL}",
-        "apiKey": "{env:QWEN_API_KEY}"
-      },
-      "models": {
-        "qwen3-coder": { "name": "Qwen3 Coder (in-house)" }
-      }
-    }
-  }
+  ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wkappbot-code",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "wkappbot-code -- Wisdom Kernel: the pinned OpenCode bridge plus the reflex harness plugin, the wkappbot core, the web harness and the latest public skills in one install",
   "type": "module",
   "bin": {
@@ -8,9 +8,10 @@
     "wk-appbot-code": "bin/wkappbot-code.js"
   },
   "files": [
-    "bin/",
-    "lib/",
-    "plugin/",
+    "bin/*.js",
+    "lib/*.js",
+    "lib/*.sh",
+    "plugin/*.js",
     "opencode.json",
     "install.sh",
     "README.md"

package/plugin/wisdom-kernel.js

@@ -1,217 +1,95 @@
 // wkappbot-code -- Wisdom Kernel: the one kih plugin for OpenCode (pinned: opencode-ai 1.19.5).
 // OpenCode is the BRIDGE (model <-> tools); kih is the HARNESS riding on it. This file only maps
-// OpenCode plugin events onto the existing kih hook launcher, .claude/hooks/wkharness-run.sh:
-//   tool.execute.before -> "pre"           (exit 2 = refuse: throw with the hook stderr as the reason)
-//   tool.execute.after  -> "post"          (fail-open, never changes the tool result)
-//   event session.idle  -> "stop-archive"  (archive only, fail-open, no verdict)
-// Fail direction matches Claude Code: only a hook VERDICT refuses; a plugin error, a missing hook or a
-// hung hook (killed at PRE_TIMEOUT_MS) lets the call through.
-// API verified 2026-11-05 from @opencode-ai/plugin 1.19.5 dist/index.d.ts (interface Hooks) and
-// @opencode-ai/sdk 1.19.5 dist/gen/types.gen.d.ts:413 (EventSessionIdle). Spec:
-// wkappbot skill read agent-harness-landscape-2026-howto
+// OpenCode plugin events onto the kih hook launcher, .claude/hooks/wkharness-run.sh:
+//   tool.execute.before   -> "pre"           (exit 2 = refuse: throw with the hook's own message as the reason)
+//   tool.execute.after    -> "post"          (fail-open, never changes the tool result)
+//   chat.message          -> "prompt"        (UserPromptSubmit: the intent lock owes a skill search for the prompt)
+//   event session.created -> "session"       (SessionStart)
+//   event session.idle    -> "stop-archive"  (archive only, fail-open, no verdict)
+//   experimental.chat.system.transform -> the reflex RULES appended to EVERY model request (lib/wk-hook.js injectRules)
+//   chat.params           -> logged only (~/.wkappbot-code/plugin.log); the user's model settings are never changed
+// FAST PATH: a read tool, or one plain read-only shell command (ls, cat, grep, git status/log/diff ...), runs no hook
+// at all, so it never starts pwsh (measured 5.3 s for echo hello). lib/wk-hook.js isFastRead.
+// FAIL DIRECTION: a hook VERDICT (rc 0 allow, rc 2 refuse) decides. NO verdict (pwsh missing = 127, a crash, a hook
+// killed at PRE_TIMEOUT_MS, no harness found) allows the call -- EXCEPT a call in a risky class (git --no-verify,
+// git push --force, a core.hooksPath change, rm -r of HOME, / or the project, a write under .git), which is REFUSED
+// (fail-closed). lib/wk-hook.js riskClass.
+// EXPORTS: OpenCode 1.19.5 calls EVERY named export of this file as a plugin ("Plugin export is not a function"
+// otherwise), so this file exports ONLY the plugin function, as WisdomKernel and as default. Every helper lives in
+// lib/wk-hook.js (installed beside this file as wk-hook.js).
+// API verified 2026-11-06 from @opencode-ai/plugin 1.19.5 dist/index.d.ts (interface Hooks: chat.message, event,
+// tool.execute.before/after). Spec: wkappbot skill read agent-harness-landscape-2026-howto
 // KNOWN GAP: no transcript_path is sent (OpenCode keeps sessions in its own store), so kih gates that
 // resolve the model or read the transcript see an unknown model and fall back to their defaults.
-import { spawn } from "node:child_process";
-import { existsSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-// OpenCode tool id -> Claude tool name the kih guards already know.
-const TOOL_MAP = {
-  bash: "Bash", edit: "Edit", write: "Write", read: "Read",
-  glob: "Glob", grep: "Grep", list: "LS", patch: "Edit", multiedit: "MultiEdit",
-  webfetch: "WebFetch", websearch: "WebSearch", task: "Agent", todowrite: "TodoWrite",
-};
-
-// pre arm budget: a hung hook is killed and the call fails OPEN, like a Claude hook timeout.
-const PRE_TIMEOUT_MS = Number(process.env.WK_APPBOT_PRE_TIMEOUT_MS || 60000);
-
-// OpenCode args (camelCase) -> Claude tool_input (snake_case) for the tools the guards inspect.
-function toClaudeInput(tool, args) {
-  const a = args || {};
-  switch (tool) {
-    case "bash": {
-      const o = { command: a.command ?? "" };
-      if (a.description !== undefined) o.description = a.description;
-      if (a.timeout !== undefined) o.timeout = a.timeout;
-      return o;
-    }
-    case "edit":
-      return { file_path: a.filePath ?? a.file_path, old_string: a.oldString ?? a.old_string,
-               new_string: a.newString ?? a.new_string, replace_all: a.replaceAll ?? a.replace_all ?? false };
-    case "write":
-      return { file_path: a.filePath ?? a.file_path, content: a.content ?? "" };
-    case "read": {
-      const o = { file_path: a.filePath ?? a.file_path };
-      if (a.offset !== undefined) o.offset = a.offset;
-      if (a.limit !== undefined) o.limit = a.limit;
-      return o;
-    }
-    default: {
-      const o = { ...a };
-      if (o.filePath !== undefined && o.file_path === undefined) o.file_path = o.filePath;
-      return o;
-    }
-  }
-}
-
-function claudeToolName(tool) {
-  return TOOL_MAP[tool] || tool;
-}
-
-// The Claude-shaped hook payload for one OpenCode tool call.
-function buildPreToolUsePayload(input, args, cwd) {
-  return {
-    hook_event_name: "PreToolUse",
-    session_id: input.sessionID,
-    cwd: (args && args.workdir) || cwd,
-    tool_name: claudeToolName(input.tool),
-    tool_input: toClaudeInput(input.tool, args),
-    tool_use_id: input.callID,
-    agent_family: "opencode",
-  };
-}
-
-function buildPostToolUsePayload(input, output, cwd) {
-  const p = buildPreToolUsePayload(input, input.args, cwd);
-  p.hook_event_name = "PostToolUse";
-  p.tool_response = { output: output && output.output, title: output && output.title };
-  return p;
-}
-
-// kih root: WK_KIH_DIR, else the checkout this file sits in (wkappbot-code/plugin -> ../..).
-function resolveKihDir() {
-  if (process.env.WK_KIH_DIR) return process.env.WK_KIH_DIR;
-  try {
-    const up = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
-    if (existsSync(join(up, ".claude", "hooks", "wkharness-run.sh"))) return up;
-  } catch {}
-  return "";
-}
-
-// Pipe JSON into "<hook> <arm>" (wkharness-run.sh, or wkharness-lite.sh without PowerShell); resolves {code, stdout, stderr}. Never rejects.
-// No hook found = fail-open (code 0, skipped) so a missing kih never bricks OpenCode.
-// PowerShell on PATH? The full harness (wkharness-run.sh) runs its guards in PowerShell; without one it exits 127,
-// which used to read as "no verdict" and let EVERY call through (QA 2026-11-06, fresh Linux HOME).
-function onPath(names) {
-  const dirs = String(process.env.PATH || "").split(process.platform === "win32" ? ";" : ":");
-  for (const d of dirs) for (const n of names) { try { if (d && existsSync(join(d, n))) return true; } catch {} }
-  return false;
-}
-let _ps = null;
-function hasPowerShell() {
-  if (process.env.WK_APPBOT_FORCE_LITE === "1") return false;
-  if (_ps === null) _ps = onPath(["pwsh", "pwsh.exe", "powershell.exe", "powershell"]);
-  return _ps;
-}
-
-// Which hook script serves an arm: the full harness when PowerShell is there, else the bash lite harness
-// (tools/wkharness-lite.sh: study lock, intent lock, stop lint). The prompt and session arms exist only in lite.
-function pickHook(arm, kih) {
-  if (!kih) return "";
-  const full = join(kih, ".claude", "hooks", "wkharness-run.sh"), lite = join(kih, "tools", "wkharness-lite.sh");
-  const liteArm = arm === "prompt" || arm === "session";
-  if (!liteArm && hasPowerShell() && existsSync(full)) return full;
-  if (existsSync(lite)) return lite;
-  return liteArm ? "" : full;
-}
-
-function runHook(arm, payload, opts = {}) {
-  const kih = opts.kihDir ?? resolveKihDir();
-  const hook = opts.hook || process.env.WK_APPBOT_HOOK || pickHook(arm, kih);
-  return new Promise((done) => {
-    let settled = false;
-    const finish = (r) => { if (!settled) { settled = true; if (timer) clearTimeout(timer); done(r); } };
-    let timer = null, out = "", err = "", child;
-    if (!hook || !existsSync(hook)) return finish({ code: 0, stdout: "", stderr: "", skipped: true });
-    let body;
-    try { body = JSON.stringify(payload); } catch (e) { return finish({ code: 0, stdout: "", stderr: String(e), skipped: true }); }
-    try {
-      child = spawn("bash", [hook, arm], {
-        env: { ...process.env, ...(kih ? { CLAUDE_PROJECT_DIR: kih } : {}) },
-        stdio: ["pipe", "pipe", "pipe"],
-      });
-    } catch (e) {
-      return finish({ code: 0, stdout: "", stderr: String(e), skipped: true });
-    }
-    if (opts.timeoutMs) {
-      timer = setTimeout(() => {
-        try { child.kill("SIGKILL"); } catch {}
-        finish({ code: 0, stdout: out, stderr: err, timedOut: true });
-      }, opts.timeoutMs);
-    }
-    child.stdout.on("data", (d) => (out += d));
-    child.stderr.on("data", (d) => (err += d));
-    child.on("error", (e) => finish({ code: 0, stdout: out, stderr: err + String(e), skipped: true }));
-    child.on("close", (code) => finish({ code: code ?? 0, stdout: out, stderr: err }));
-    child.stdin.on("error", () => {});
-    child.stdin.end(body);
-  });
-}
-
-// Claude contract: exit 2 refuses; so does a stdout JSON deny/block verdict.
-function isRefusal(r) {
-  if (r.timedOut || r.skipped) return false;
-  if (r.code === 2) return true;
-  try {
-    const j = JSON.parse(r.stdout);
-    return (j.hookSpecificOutput && j.hookSpecificOutput.permissionDecision === "deny") || j.decision === "block";
-  } catch { return false; }
-}
-
-// A stdout deny JSON names its own reason; stderr then may hold only warn lines (wkharness-run.sh wk_pre_emit).
-function refusalReason(r) {
-  try {
-    const j = JSON.parse(r.stdout);
-    const why = (j.hookSpecificOutput && j.hookSpecificOutput.permissionDecisionReason) || j.reason;
-    if (why) return why;
-  } catch {}
-  return (r.stderr || "").trim() || (r.stdout || "").trim() || "refused by the kih harness";
-}
+let H;
+try { H = await import("./wk-hook.js"); } catch { H = await import("../lib/wk-hook.js"); }
 
 // options = the second slot of the opencode.json plugin entry: ["file://.../wisdom-kernel.js", { "kihDir": "..." }].
-// install.sh fills kihDir, because the installed copy no longer sits inside the kih checkout.
+// install fills kihDir, because the installed copy no longer sits inside the kih checkout.
 export const WisdomKernel = async (ctx = {}, options = {}) => {
   const cwd = ctx.directory || ctx.worktree || process.cwd();
   const k = (options && options.kihDir) || undefined;
+  const fast = new Set();
   return {
     "tool.execute.before": async (input, output) => {
-      let r;
+      const inp = input || {};
+      const args = output && output.args;
+      let p, r;
       try {
-        r = await runHook("pre", buildPreToolUsePayload(input || {}, output && output.args, cwd), { kihDir: k, timeoutMs: PRE_TIMEOUT_MS });
-      } catch { return; } // a plugin bug never refuses a call
-      if (isRefusal(r)) throw new Error("[wisdom-kernel] " + refusalReason(r));
+        p = H.buildPreToolUsePayload(inp, args, cwd);
+        if (H.isFastRead(inp.tool, p.tool_input)) { if (inp.callID) fast.add(inp.callID); return; }
+        r = await H.runHook("pre", p, { kihDir: k, timeoutMs: H.PRE_TIMEOUT_MS });
+      } catch (e) { r = { code: -1, stdout: "", stderr: String(e), skipped: true }; }
+      if (H.isRefusal(r)) throw new Error("[wisdom-kernel] " + H.refusalReason(r));
+      if (!H.hasVerdict(r)) {
+        let cls = "";
+        try { cls = H.riskClass(inp.tool, p && p.tool_input, p && p.cwd); } catch { cls = "unclassifiable call"; }
+        if (cls) {
+          const why = r.timedOut ? "the hook was killed at " + H.PRE_TIMEOUT_MS + " ms" : r.skipped ? "no kih hook ran" : "the hook exited " + r.code;
+          const tail = String(r.stderr || "").trim().split("\n").slice(-2).join(" | ");
+          throw new Error("[wisdom-kernel] fail-closed: " + cls + " is refused because the harness gave no verdict (" + why + ")" +
+            (tail ? ": " + tail : "") + ". Fix the harness (wkappbot-code doctor) and retry.");
+        }
+      }
     },
     "tool.execute.after": async (input, output) => {
-      try { await runHook("post", buildPostToolUsePayload(input || {}, output, cwd), { kihDir: k, timeoutMs: 30000 }); } catch {}
+      try {
+        const id = input && input.callID;
+        if (id && fast.has(id)) { fast.delete(id); return; }
+        await H.runHook("post", H.buildPostToolUsePayload(input || {}, output, cwd), { kihDir: k, timeoutMs: 30000 });
+      } catch {}
     },
-    // UserPromptSubmit: arms the intent lock for the next real tool call (fail-open, never blocks the message).
     "chat.message": async (input, output) => {
+      try { await H.runHook("prompt", H.buildPromptPayload(input, output, cwd), { kihDir: k, timeoutMs: 30000 }); } catch {}
+    },
+    // PER-CALL INJECTION: every model request carries the reflex rules (lib/wk-hook.js RULES), whatever the model.
+    // Experimental in OpenCode 1.19.5, so the package pins that version and the e2e asserts the rules reach the model.
+    "experimental.chat.system.transform": async (input, output) => {
       try {
-        const parts = (output && output.parts) || [];
-        const prompt = parts.filter((p) => p && p.type === "text" && !p.synthetic).map((p) => p.text || "").join("\n");
-        if (!prompt) return;
-        await runHook("prompt", { hook_event_name: "UserPromptSubmit", session_id: input && input.sessionID, cwd, prompt, agent_family: "opencode" }, { kihDir: k, timeoutMs: 30000 });
+        const added = H.injectRules(output && output.system, await H.rulesBlock(k));
+        H.hookLog("system.transform", { sid: input && input.sessionID, model: input && input.model && input.model.id, added });
       } catch {}
     },
+    // chat.params: the model settings stay exactly as the user configured them; the hook only logs that it ran.
+    "chat.params": async (input) => {
+      try { H.hookLog("chat.params", { sid: input && input.sessionID, agent: input && input.agent, model: input && input.model && input.model.id }); } catch {}
+    },
     event: async (arg) => {
       try {
         const event = arg && arg.event;
-        if (event && event.type === "session.created") {
-          const info = (event.properties && event.properties.info) || {};
-          await runHook("session", { hook_event_name: "SessionStart", session_id: info.id, cwd, source: "startup", agent_family: "opencode" }, { kihDir: k, timeoutMs: 30000 });
-          return;
+        if (!event) return;
+        if (event.type === "session.created") {
+          const sid = event.properties && event.properties.info && event.properties.info.id;
+          await H.runHook("session", { hook_event_name: "SessionStart", session_id: sid, cwd, source: "startup", agent_family: "opencode" }, { kihDir: k, timeoutMs: 30000 });
+        } else if (event.type === "session.idle") {
+          const sid = event.properties && event.properties.sessionID;
+          await H.runHook("stop-archive", { hook_event_name: "Stop", session_id: sid, cwd, agent_family: "opencode" }, { kihDir: k, timeoutMs: 30000 });
         }
-        if (!event || event.type !== "session.idle") return;
-        const sid = event.properties && event.properties.sessionID;
-        await runHook("stop-archive", { hook_event_name: "Stop", session_id: sid, cwd, agent_family: "opencode" }, { kihDir: k, timeoutMs: 30000 });
       } catch {}
     },
   };
 };
 
-// Helpers for the selftest ride on the plugin function, never as module exports (OpenCode calls every export).
-WisdomKernel.internals = { TOOL_MAP, PRE_TIMEOUT_MS, toClaudeInput, claudeToolName, buildPreToolUsePayload,
-  buildPostToolUsePayload, resolveKihDir, runHook, isRefusal, refusalReason, hasPowerShell, pickHook };
+// Helpers live in ./wk-hook.js (lib/wk-hook.js in the package); OpenCode calls every export, so only the plugin is exported.
 
 export default WisdomKernel;