wkappbot-code 0.3.3 → 0.3.7

package/bin/wkappbot-code.js

@@ -3,12 +3,12 @@
 //   wkappbot-code --version            package version and the pinned OpenCode release
 //   wkappbot-code install [opts]       ONE COMMAND lays down every part (idempotent):
 //       opencode   pinned opencode-ai (npm -g)                                   skip: --no-npm
-//       plugin     plugin/wisdom-kernel.js + the opencode.json plugin entry      (always)
+//       plugin     plugin/wisdom-kernel.js + lib/wk-hook.js + the opencode.json plugin entry      (always)
 //       bin        the wkappbot core for this platform, from the SDK latest release asset verified by
-//                  SHA256SUMS -- the SAME road as kih tools/wk-bin-acquire.sh, shipped byte-identical
-//                  in lib/ (the selftest pins the two copies equal)               skip: --no-bin
+//                  SHA256SUMS -- the SAME road as tools/wk-bin-acquire.sh of the harness repo, shipped
+//                  byte-identical in lib/ (the selftest pins the two copies equal)               skip: --no-bin
 //       harness    the scrubbed web harness to ~/.wk-harness through its own published install.sh,
-//                  only when no kih checkout is found (--web-harness forces it)  skip: --no-harness
+//                  only when no harness checkout is found (--web-harness forces it)  skip: --no-harness
 //       skills     the latest public skills from the same published tarball (sha256-checked) into the
 //                  core's HQ (<core dir>/wkappbot.hq/skills), so `wkappbot skill read on-load` prints;
 //                  a READ-ONLY copy with no git remote. A user's own skill edits go to the private
@@ -16,12 +16,16 @@
 //   wkappbot-code doctor  [opts]       one PASS/WARN/FAIL/SKIP row per part (exit 1 if a required part fails)
 //   wkappbot-code update  [opts]       newer version.json -> tgz sha256-checked -> npm i -g -> install --update (lib/update.js)
 //   wkappbot-code config  [opts]       detect provider/model/plugin/harness, edit at a TTY, merge into opencode.json (lib/config.js)
+//   wkappbot-code uninstall [opts]     undo install: the recorded pre-install global core.hooksPath comes back, the
+//                  harness hook arms leave ~/.claude/settings.json (your own entries stay), the recorded shims
+//                  leave the bin dirs, ~/.wk-harness and ~/.wk-harness-hooks go, the plugin entry leaves opencode.json
 // install/doctor/config check for a newer version at most once a day (WKAPPBOT_CODE_NO_UPDATE_CHECK=1 turns it off;
 // --auto-update or WKAPPBOT_CODE_AUTO_UPDATE=1 applies it). config opts: --yes, --project, --set key=value
-// opts: --config-dir DIR, --kih-dir DIR, --bin-dest FILE, --hq-dir DIR
+// opts: --config-dir DIR, --kih-dir DIR, --bin-dest FILE, --hq-dir DIR, --dev-seat (the full pwsh harness and its
+//   emergency-edit door on this seat; a user install never gets them)
 // env (mock and relocation): WK_BIN_BASE (SDK release base), WK_HARNESS_BASE (web harness base),
-//   WK_HARNESS_DIR (~/.wk-harness), WK_BIN_DEST, WK_APPBOT_HQ, WK_LINK_DIR, WK_PRIVATE_SKILLS,
-//   WK_KIH_DIR (a kih checkout; "none" = ignore every checkout on this machine)
+//   WK_HARNESS_DIR (~/.wk-harness), WK_BIN_DEST, WK_APPBOT_HQ, WK_LINK_DIR, WK_PRIVATE_SKILLS, WK_SETTINGS,
+//   WK_KIH_DIR (a harness checkout; "none" = ignore every checkout on this machine)
 // Installer owns all setup, surgically: an existing user opencode.json is BACKED UP and only the plugin entry is
 // merged in; every other key is kept. Spec: wkappbot skill read agent-harness-landscape-2026-howto
 // and wkappbot skill read harness-installer-owns-all-setup (step 9 ONE-COMMAND APPBOT CODE INSTALL)
@@ -43,10 +47,19 @@ const OPENCODE_VERSION = PKG.wkAppbotCode.opencodeVersion;
 const OWNER_LOGIN = "kiexpert";
 const HARNESS_BASE = () => (process.env.WK_HARNESS_BASE || "https://kiexpert.github.io/wkappbot-kih/webvm/x64/harness").replace(/\/+$/, "");
 const HARNESS_DIR = () => process.env.WK_HARNESS_DIR || join(homedir(), ".wk-harness");
+const HOOKS_DIR = () => join(homedir(), ".wk-harness-hooks");   // tools/wk-global-hooks.sh install default
+const SETTINGS = () => process.env.WK_SETTINGS || join(homedir(), ".claude", "settings.json");
+const HARNESS_LINKS = () => process.env.WK_LINK_DIR || join(homedir(), ".local", "bin");   // harness install.sh
+const STATE_HOME = () => join(homedir(), ".wkappbot-code");
+const USER_MARK = ".wk-user-install";
 const IS_WIN = process.platform === "win32";
 // Windows: the sh and tar this CLI starts are Git Bash's (MSYS). They read "D:\a\x" as host "D" plus a remote path
 // ("tar: Cannot connect to C: resolve failed", SDK all-OS QA 2026-11-06), so a path handed to them is the MSYS form /d/a/x.
 const shPath = (p) => (IS_WIN && /^[A-Za-z]:[\\/]/.test(p) ? "/" + p[0].toLowerCase() + p.slice(2).replace(/\\/g, "/") : p);
+// The env for an MSYS child: HOME in MSYS form too. Node hands HOME through as "D:\\a\\home", and every "$HOME/..." path
+// the harness scripts build then fails their "/*" absolute-path test, so wk-verify ran the hooks from a wrong
+// directory (windows-latest "hooks FAIL 1/6" in the installer, PASS 6/6 when the same verify ran from Git Bash).
+const shEnv = (extra = {}) => (IS_WIN ? { ...process.env, HOME: shPath(homedir()), ...extra } : { ...process.env, ...extra });
 let _gnuTar = null;
 const tarArgs = (tgz, dir) => {
   if (!IS_WIN) return ["-xzf", tgz, "-C", dir];
@@ -56,7 +69,7 @@ const tarArgs = (tgz, dir) => {
 };
 
 function parseArgs(argv) {
-  const o = { cmd: argv[0] || "help", npm: true, bin: true, harness: true, skills: true, webHarness: false,
+  const o = { cmd: argv[0] || "help", npm: true, bin: true, harness: true, skills: true, webHarness: false, devSeat: false,
     configDir: "", kihDir: "", binDest: "", hqDir: "", update: false, autoUpdate: false, yes: false, project: false, sets: [] };
   for (let i = 1; i < argv.length; i++) {
     const a = argv[i];
@@ -65,6 +78,7 @@ function parseArgs(argv) {
     else if (a === "--no-harness") o.harness = false;
     else if (a === "--no-skills") o.skills = false;
     else if (a === "--web-harness") o.webHarness = true;
+    else if (a === "--dev-seat") o.devSeat = true;
     else if (a === "--config-dir") o.configDir = argv[++i] || "";
     else if (a === "--kih-dir") o.kihDir = argv[++i] || "";
     else if (a === "--bin-dest") o.binDest = argv[++i] || "";
@@ -86,17 +100,19 @@ function configDir(o) {
 }
 
 const hasHook = (d) => !!d && existsSync(join(d, ".claude", "hooks", "wkharness-run.sh"));
-// A kih CHECKOUT (never the web harness): explicit dirs first, then the usual checkout places.
-// WK_KIH_DIR=none: act as on a machine with no checkout (the selftest's isolation from this VM's kih).
+// A harness CHECKOUT (never the web harness): explicit dirs first, then this package's parent (a checkout's
+// wkappbot-code/ folder) and the HOME-relative clone. No machine-specific absolute path is ever searched.
+// WK_KIH_DIR=none: act as on a machine with no checkout (the selftest's isolation from this VM's checkout).
+export function checkoutCandidates(o = {}, env = process.env, home = homedir()) {
+  if (env.WK_KIH_DIR === "none") return o.kihDir ? [o.kihDir] : [];
+  return [o.kihDir, env.WK_KIH_DIR, resolve(PKG_DIR, ".."), join(home, "wkappbot-kih")].filter(Boolean);
+}
 function kihCheckout(o) {
-  if (process.env.WK_KIH_DIR === "none") return o.kihDir && hasHook(o.kihDir) ? resolve(o.kihDir) : "";
-  const tries = [o.kihDir, process.env.WK_KIH_DIR, resolve(PKG_DIR, ".."),
-    join(homedir(), "wkappbot-kih"), "/home/user/wkappbot-kih", "D:/GitHub/wkappbot-kih"];
-  for (const d of tries) if (hasHook(d)) return resolve(d);
+  for (const d of checkoutCandidates(o)) if (hasHook(d)) return resolve(d);
   return "";
 }
-// The kih root whose .claude/hooks/wkharness-run.sh the plugin calls: a checkout, else the web harness
-// (~/.wk-harness). Empty = plugin fails open.
+// The harness root whose .claude/hooks/wkharness-run.sh the plugin calls: a checkout, else the web harness
+// (~/.wk-harness). Empty = no hook: the plugin then refuses the risky classes and lets the rest through.
 function kihDir(o) {
   return kihCheckout(o) || (hasHook(HARNESS_DIR()) ? resolve(HARNESS_DIR()) : "");
 }
@@ -105,12 +121,16 @@ function opencodeVersion() {
   try { return execFileSync("opencode", ["--version"], { shell: process.platform === "win32",  encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim(); }
   catch { return ""; }
 }
+const which = (cmd) => { const r = spawnSync("sh", ["-c", "command -v " + cmd], { encoding: "utf8" }); return r.status === 0 ? r.stdout.trim() : ""; };
+const pwshPath = () => which("pwsh") || which("powershell");
 
 const stamp = () => new Date().toISOString().replace(/[-:]/g, "").replace(/\..*/, "");
 const log = (s) => console.log("[wkappbot-code] " + s);
 const sha256File = (f) => createHash("sha256").update(readFileSync(f)).digest("hex");
 const statePath = (o) => join(configDir(o), "wkappbot-code", "install-state.json");
 function readState(o) { try { return JSON.parse(readFileSync(statePath(o), "utf8")); } catch { return {}; } }
+const gitGlobal = (...a) => spawnSync("git", ["config", "--global", ...a], { encoding: "utf8" });
+const globalHooksPath = () => { const r = gitGlobal("--get", "core.hooksPath"); return r.status === 0 ? r.stdout.trim() : null; };
 
 // Same rule as wk-bin-acquire.sh platform_detect (linux-x64, osx-arm64, osx-x64, win-x64).
 export function platformId(platform = process.platform, arch = process.arch) {
@@ -125,6 +145,18 @@ export function mergeConfig(user, template, url, kih) {
   return buildConfig(user, { plugin: { value: url }, harness: { value: kih } }, template);
 }
 
+// The advisory verify line the harness install prints (scripts/wk-harness-verify.sh): a miss is NOT a broken install.
+const VERIFY_MEANING = { c1: "wkappbot not on PATH", c2: "wkhippo not on PATH (the memory tool ships with a harness checkout only)",
+  c3: "no PreToolUse hook names wkharness in settings.json", c4: "no Stop hook names wkharness in settings.json",
+  c5: "wkappbot skill read on-load did not exit 0 (no core yet, or --no-bin)", c6: "no harness git checkout (expected for the web harness)" };
+export function verifyLine(line) {
+  const m = /\[wk-verify\] FAIL (\d)\/6:\s*(.*)$/.exec(line);
+  if (!m) return line;
+  const ids = m[2].trim().split(/\s+/).filter(Boolean);
+  return line.slice(0, m.index) + "[wk-verify] WARN " + m[1] + "/6 advisory, not a failure -- " +
+    ids.map((c) => c + " " + (VERIFY_MEANING[c] || "missed")).join("; ") + " (verdict: " + join(STATE_HOME(), "verify.json") + ")";
+}
+
 // ---- part: bin ------------------------------------------------------------------------------------
 function binDest(o) {
   if (o.binDest) return resolve(o.binDest);
@@ -145,13 +177,13 @@ function installBin(o) {
   const dest = binDest(o);
   const plat = platformId();
   if (!plat) return { ok: false, dest, note: "no wkappbot build for " + process.platform + "-" + process.arch };
-  if (plat === "win-x64") return { ok: false, dest, note: "win-x64 has no single SDK asset; run install.cmd from a kih checkout" };
-  // A kih checkout runs its own copy (same bytes, plus the MANIFEST-verified repo bin/ fallback); the package
+  if (plat === "win-x64") return { ok: false, dest, note: "win-x64 has no single SDK asset; run install.cmd from a harness checkout" };
+  // A checkout runs its own copy (same bytes, plus the MANIFEST-verified repo bin/ fallback); the package
   // copy outside a checkout takes only the SDK release asset verified by SHA256SUMS.
   const co = kihCheckout(o);
   const script = co && existsSync(join(co, "tools", "wk-bin-acquire.sh")) ? join(co, "tools", "wk-bin-acquire.sh") : join(PKG_DIR, "lib", "wk-bin-acquire.sh");
   log("bin: bash " + script + " acquire --dest " + dest);
-  const r = spawnSync("bash", [shPath(script), "acquire", "--dest", shPath(dest)], { encoding: "utf8", env: process.env });
+  const r = spawnSync("bash", [shPath(script), "acquire", "--dest", shPath(dest)], { encoding: "utf8", env: shEnv() });
   for (const line of ((r.stdout || "") + (r.stderr || "")).split("\n").filter(Boolean)) log("  " + line);
   if (r.status !== 0) return { ok: false, dest, note: "wk-bin-acquire rc " + r.status };
   // Put `wkappbot` on PATH beside wkappbot-code itself, unless that name is already taken by someone else.
@@ -182,7 +214,7 @@ function curl(url, out) {
 function installHarness(o) {
   const found = kihCheckout(o);
   if (found && !o.webHarness) {
-    log("harness: kih checkout " + found + " found; the web harness is not needed (--web-harness forces it)");
+    log("harness: checkout " + found + " found; the web harness is not needed (--web-harness forces it)");
     return { ok: true, mode: "checkout", dir: found };
   }
   const tmp = mkdtempSync(join(tmpdir(), "wk-appbot-harness-"));
@@ -190,11 +222,17 @@ function installHarness(o) {
     const err = curl(HARNESS_BASE() + "/install.sh", join(tmp, "install.sh"));
     if (err) return { ok: false, mode: "web", dir: HARNESS_DIR(), note: err };
     log("harness: sh " + HARNESS_BASE() + "/install.sh  (to " + HARNESS_DIR() + ")");
+    mkdirSync(STATE_HOME(), { recursive: true });
     const r = spawnSync("sh", [shPath(join(tmp, "install.sh"))], { encoding: "utf8",
-      env: { ...process.env, WK_HARNESS_BASE: HARNESS_BASE(), WK_HARNESS_DIR: shPath(HARNESS_DIR()) } });
-    for (const line of ((r.stdout || "") + (r.stderr || "")).split("\n").filter(Boolean)) log("  " + line);
+      env: shEnv({ WK_HARNESS_BASE: HARNESS_BASE(), WK_HARNESS_DIR: shPath(HARNESS_DIR()), WK_VERIFY_OUT: shPath(join(STATE_HOME(), "verify.json")) }) });
+    for (const line of ((r.stdout || "") + (r.stderr || "")).split("\n").filter(Boolean)) log("  " + verifyLine(line));
     const ok = r.status === 0 && hasHook(HARNESS_DIR());
-    return { ok, mode: "web", dir: HARNESS_DIR(), note: ok ? "" : "harness install rc " + r.status };
+    // USER INSTALL MARK: the launcher then takes the sh lite harness as the whole verdict and the emergency-edit door
+    // never grants or prints (wkharness-run.sh FULL, Test-WkEmergencyEditAllow.ps1). --dev-seat keeps the full harness.
+    const mark = join(HARNESS_DIR(), USER_MARK);
+    if (ok && !o.devSeat) writeFileSync(mark, "user install by wkappbot-code " + PKG.version + "\n");
+    else if (ok && o.devSeat) rmSync(mark, { force: true });
+    return { ok, mode: "web", dir: HARNESS_DIR(), userInstall: ok && !o.devSeat, note: ok ? "" : "harness install rc " + r.status };
   } finally { rmSync(tmp, { recursive: true, force: true }); }
 }
 
@@ -284,7 +322,8 @@ function installPlugin(o, kih, kihSource) {
   mkdirSync(join(cfg, "wkappbot-code"), { recursive: true });
   const dest = join(cfg, "wkappbot-code", "wisdom-kernel.js");
   copyFileSync(join(PKG_DIR, "plugin", "wisdom-kernel.js"), dest);
-  // The copy imports nothing from the package, but mark its folder ESM so Node never re-parses it.
+  // The plugin file exports ONLY the plugin (OpenCode calls every named export as one); its helpers ride beside it.
+  copyFileSync(join(PKG_DIR, "lib", "wk-hook.js"), join(cfg, "wkappbot-code", "wk-hook.js"));
   writeFileSync(join(cfg, "wkappbot-code", "package.json"), '{ "type": "module" }\n');
   const url = pathToFileURL(dest).href;
   const tmpl = JSON.parse(readFileSync(join(PKG_DIR, "opencode.json"), "utf8"));
@@ -294,7 +333,7 @@ function installPlugin(o, kih, kihSource) {
     raw = readFileSync(target, "utf8");
     try { user = JSON.parse(raw); } catch { user = null; }
   }
-  const it = detect({ user: user || {}, pluginUrl: url, kih, kihSource: kihSource || "kih checkout" });
+  const it = detect({ user: user || {}, pluginUrl: url, kih, kihSource: kihSource || "harness checkout" });
   for (const k of applySets(it, o.sets)) log("config: unknown --set key " + k + " (provider|model|plugin|harness)");
   printDetected(it, log);
   if (process.stdin.isTTY && process.stdout.isTTY && !o.yes) askEach(it);
@@ -322,10 +361,29 @@ function installPlugin(o, kih, kihSource) {
   log("config: " + target + note);
 }
 
+// The machine state an uninstall must give back, recorded ONCE (a re-install never overwrites the first record, or
+// it would record our own dispatcher as the "prior" hooksPath). Shim paths are those install may create.
+function shimCandidates() {
+  return [join(linkDir(), "wkappbot"), join(HARNESS_LINKS(), "wkskill"), join(HARNESS_LINKS(), "wk-verify")];
+}
+const PRE_SETTINGS = () => join(STATE_HOME(), "settings.pre-install.json");
+function recordPrior(prev) {
+  if (prev && prev.prior) return prev.prior;
+  // The user's settings.json as it was, byte for byte: uninstall gives these bytes back when nothing else changed.
+  if (existsSync(SETTINGS()) && !existsSync(PRE_SETTINGS())) { mkdirSync(STATE_HOME(), { recursive: true }); copyFileSync(SETTINGS(), PRE_SETTINGS()); }
+  return { hooksPath: globalHooksPath(), settingsExisted: existsSync(SETTINGS()), harnessDirExisted: existsSync(HARNESS_DIR()),
+    hooksDirExisted: existsSync(HOOKS_DIR()), shimsExisting: shimCandidates().filter((p) => existsSync(p) || isSymlink(p)) };
+}
+
 function install(o) {
-  const st = { version: PKG.version, at: new Date().toISOString() };
+  const prev = readState(o);
+  const st = { version: PKG.version, at: new Date().toISOString(), prior: recordPrior(prev) };
   let bad = 0;
   if (o.update) log("install --update: refreshing the core, the harness and the public skills");
+  const ps = pwshPath();
+  log("pwsh: " + (ps || "not found") + " -- the FULL harness (PowerShell 7) runs only on a dev seat (a harness checkout, or --dev-seat);" +
+    " a user install and every seat without pwsh take the sh lite harness, which still refuses git --no-verify/--force/core.hooksPath," +
+    " rm -rf of HOME or the project, and writes under .git");
   if (o.npm) {
     const have = opencodeVersion();
     if (have === OPENCODE_VERSION) log("opencode " + have + " already installed");
@@ -345,20 +403,107 @@ function install(o) {
   // A user's own absolute global core.hooksPath is kept (the script WARNs). Skipped with --no-harness.
   st.pushGate = { skipped: true };
   if (o.harness && kih && existsSync(join(kih, "tools", "wk-global-hooks.sh"))) {
-    const r = spawnSync("bash", [shPath(join(kih, "tools", "wk-global-hooks.sh")), "install", "--gate-dir", shPath(join(kih, ".githooks", "lib"))], { encoding: "utf8" });
+    const r = spawnSync("bash", [shPath(join(kih, "tools", "wk-global-hooks.sh")), "install", "--gate-dir", shPath(join(kih, ".githooks", "lib"))], { encoding: "utf8", env: shEnv() });
     for (const line of ((r.stdout || "") + (r.stderr || "")).split("\n").filter(Boolean)) log("push-gate: " + line);
     st.pushGate = { ok: r.status === 0, kih };
   }
   st.skills = o.skills ? installSkills(o, dest) : { skipped: true };
   if (o.skills && !st.skills.ok) { bad++; log("skills: FAILED -- " + (st.skills.note || "on-load missing from the HQ")); }
-  installPlugin(o, kih, (st.harness.mode === "web" && st.harness.ok) ? "web harness" : "kih checkout");
+  installPlugin(o, kih, (st.harness.mode === "web" && st.harness.ok) ? "web harness" : "harness checkout");
   st.kihDir = kih;
+  // The shims this install created (absent before, present now): uninstall removes exactly these.
+  st.shims = [...new Set([...(prev.shims || []), ...shimCandidates().filter((p) => (existsSync(p) || isSymlink(p)) && !st.prior.shimsExisting.includes(p))])];
   writeFileSync(statePath(o), JSON.stringify(st, null, 2) + "\n");
-  log("kih:    " + (kih || "NOT FOUND -- plugin fails open until --kih-dir or WK_KIH_DIR points at a kih checkout"));
+  log("kih:    " + (kih || "NOT FOUND -- no hook runs; the plugin still refuses the risky classes. Use --kih-dir or WK_KIH_DIR"));
   log((bad ? "done with " + bad + " failed part(s)" : "done") + " -- check: wkappbot-code doctor   then run: opencode");
   return bad ? 1 : 0;
 }
 
+// ---- uninstall ------------------------------------------------------------------------------------
+// Surgical: our hook arms leave settings.json, every other entry stays. A hook is ours when its command names the
+// lite harness or a file under the harness dir; a settings.json that did not exist before and is left empty goes.
+export function stripOurHooks(d, harnessDir) {
+  const ours = (c) => /wkharness-lite\.sh|wkharness-run\.sh/.test(c) || (!!harnessDir && c.includes(harnessDir));
+  let removed = 0;
+  const hooks = d && d.hooks;
+  if (!hooks || typeof hooks !== "object") return { d, removed };
+  for (const ev of Object.keys(hooks)) {
+    const groups = (hooks[ev] || []).map((g) => {
+      const hs = (g.hooks || []).filter((h) => { const o = ours(String(h.command || "")); if (o) removed++; return !o; });
+      return { ...g, hooks: hs };
+    }).filter((g) => g.hooks.length);
+    if (groups.length) hooks[ev] = groups; else delete hooks[ev];
+  }
+  if (!Object.keys(hooks).length) delete d.hooks;
+  return { d, removed };
+}
+const sortKeys = (v) => Array.isArray(v) ? v.map(sortKeys) : v && typeof v === "object" ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, sortKeys(v[k])])) : v;
+function uninstall(o) {
+  const st = readState(o);
+  const pr = st.prior || {};
+  let rc = 0;
+  if (!st.version) log("no install record at " + statePath(o) + "; removing only what is ours by name");
+  // 1. global core.hooksPath back to its recorded value (only when it still points at a dir we wrote)
+  const cur = globalHooksPath();
+  const oursHp = (p) => !!p && [HOOKS_DIR(), join(HARNESS_DIR(), ".githooks"), st.kihDir && join(st.kihDir, ".githooks")]
+    .filter(Boolean).some((x) => resolve(p.replace(/^~(?=\/|$)/, homedir())) === resolve(x));
+  if (cur !== (pr.hooksPath ?? null) && (cur === null || oursHp(cur))) {
+    const r = pr.hooksPath ? gitGlobal("core.hooksPath", pr.hooksPath) : gitGlobal("--unset", "core.hooksPath");
+    log("hooksPath: " + (cur || "unset") + " -> " + (pr.hooksPath || "unset") + (r.status === 0 ? "" : " (git rc " + r.status + ")"));
+  } else log("hooksPath: " + (cur || "unset") + (cur === (pr.hooksPath ?? null) ? " (as before install)" : " (set by you, kept)"));
+  // 2. settings.json: our arms out, yours kept
+  const sp = SETTINGS();
+  if (existsSync(sp)) {
+    try {
+      const raw = readFileSync(sp, "utf8");
+      const { d, removed } = stripOurHooks(JSON.parse(raw), HARNESS_DIR());
+      // A hook of yours that an older harness --wire dropped comes back from the pre-install snapshot; when the result is
+      // then the same JSON as before install, the snapshot's own bytes are written (formatting kept).
+      let preRaw = "", pre = null, restored = 0;
+      try { preRaw = readFileSync(PRE_SETTINGS(), "utf8"); pre = JSON.parse(preRaw); } catch {}
+      if (pre && pre.hooks) {
+        d.hooks = d.hooks || {};
+        for (const [ev, groups] of Object.entries(pre.hooks)) for (const g of groups || []) {
+          const have = JSON.stringify(d.hooks[ev] || []);
+          if (!have.includes(JSON.stringify(g))) { (d.hooks[ev] = d.hooks[ev] || []).push(g); restored++; }
+        }
+      }
+      if (removed || restored) {
+        copyFileSync(sp, sp + ".bak-" + stamp());
+        if (pr.settingsExisted === false && !Object.keys(d).length) { rmSync(sp); log("settings: removed " + sp + " (it did not exist before install)"); }
+        else {
+          const same = pre && JSON.stringify(sortKeys(pre)) === JSON.stringify(sortKeys(d));
+          writeFileSync(sp, same ? preRaw : JSON.stringify(d, null, 2) + "\n");
+          log("settings: removed " + removed + " harness hook entr" + (removed === 1 ? "y" : "ies") + (restored ? ", restored " + restored + " of yours" : "") +
+            " in " + sp + (same ? " (now byte-identical to before install)" : "; your other entries stay"));
+        }
+      } else log("settings: no harness hook in " + sp);
+    } catch (e) { rc = 1; log("settings: " + sp + " is not plain JSON, left untouched (" + e.message + ")"); }
+  }
+  // 3. the shims install created
+  for (const p of st.shims || []) {
+    if (isSymlink(p) || existsSync(p)) { rmSync(p, { force: true }); log("shim: removed " + p); }
+  }
+  // 4. the harness dirs we created, the plugin entry and our config folder
+  if (st.harness && st.harness.mode === "web" && pr.harnessDirExisted !== true && existsSync(HARNESS_DIR())) { rmSync(HARNESS_DIR(), { recursive: true, force: true }); log("harness: removed " + HARNESS_DIR()); }
+  if (pr.hooksDirExisted !== true && existsSync(HOOKS_DIR())) { rmSync(HOOKS_DIR(), { recursive: true, force: true }); log("push-gate: removed " + HOOKS_DIR()); }
+  const cfgFile = join(configDir(o), "opencode.json");
+  try {
+    const c = JSON.parse(readFileSync(cfgFile, "utf8"));
+    const keep = (c.plugin || []).filter((p) => !String(Array.isArray(p) ? p[0] : p).includes("wisdom-kernel"));
+    if (keep.length !== (c.plugin || []).length) {
+      copyFileSync(cfgFile, cfgFile + ".bak-" + stamp());
+      if (keep.length) c.plugin = keep; else delete c.plugin;
+      writeFileSync(cfgFile, JSON.stringify(c, null, 2) + "\n");
+      log("config: plugin entry removed from " + cfgFile);
+    }
+  } catch {}
+  rmSync(STATE_HOME(), { recursive: true, force: true });
+  rmSync(join(configDir(o), "wkappbot-code"), { recursive: true, force: true });
+  log("uninstall done. Kept: opencode-ai, the wkappbot core (" + ((st.bin && st.bin.dest) || binDest(o)) + ") and its skills, and this CLI (npm rm -g wkappbot-code)");
+  return rc;
+}
+
 // ---- doctor ---------------------------------------------------------------------------------------
 // The GitHub login a skill push would use: gh when present, else "none". Push is the owner's alone.
 export function pushLogin() {
@@ -367,6 +512,15 @@ export function pushLogin() {
   return r.status === 0 && r.stdout.trim() ? r.stdout.trim() : "none";
 }
 
+// The verdict road a pre call takes in harness dir k: "full" (pwsh hub, lite first for OpenCode), "lite", or "" (none).
+export function harnessMode(k, ps = pwshPath()) {
+  if (!hasHook(k)) return "";
+  const lite = existsSync(join(k, "tools", "wkharness-lite.sh"));
+  const user = existsSync(join(k, USER_MARK));
+  if (ps && !user) return "full";
+  return lite ? "lite" : "";
+}
+
 function doctor(o) {
   const cfg = configDir(o);
   const st = readState(o);
@@ -375,7 +529,7 @@ function doctor(o) {
   const v = opencodeVersion();
   add("opencode", v === OPENCODE_VERSION, v ? v + (v === OPENCODE_VERSION ? "" : " (pinned " + OPENCODE_VERSION + ")") : "not on PATH", false);
   const pdest = join(cfg, "wkappbot-code", "wisdom-kernel.js");
-  add("plugin", existsSync(pdest), pdest, true);
+  add("plugin", existsSync(pdest) && existsSync(join(cfg, "wkappbot-code", "wk-hook.js")), pdest + " + wk-hook.js", true);
   let entry = null;
   try { entry = (JSON.parse(readFileSync(join(cfg, "opencode.json"), "utf8")).plugin || []).find((p) => String(Array.isArray(p) ? p[0] : p).includes("wisdom-kernel")); } catch {}
   add("config", !!entry, join(cfg, "opencode.json"), true);
@@ -390,19 +544,15 @@ function doctor(o) {
     core = r.status === 0 ? (r.stdout || "").trim().split("\n")[0] : "";
     add("bin", !!core, core ? dest + "  " + core + (st.bin && st.bin.link ? "  (PATH link " + st.bin.link + ")" : "") : dest + " does not run", !!(st.bin && !st.bin.skipped));
   }
-  // kih-hook: the harness the plugin calls
+  // kih-hook: the harness the plugin calls, and the verdict road it takes. No pwsh and no lite = NO verdict at all:
+  // that is a FAIL whatever the install mode, since the plugin then only refuses its own risky classes.
   const k = (entry && Array.isArray(entry) && entry[1] && entry[1].kihDir) || kihDir(o);
   const hk = hasHook(k);
+  const ps = pwshPath();
+  const mode = harnessMode(k, ps);
   if (st.harness && st.harness.skipped && !hk) add("kih-hook", false, "skipped (--no-harness)", false, true);
-  else add("kih-hook", hk, k ? k + (st.harness && st.harness.mode ? "  (" + st.harness.mode + ")" : "") : "not found", !!(st.harness && st.harness.mode === "web"));
-  // guards: which guard set the plugin can run. The full set needs PowerShell; without it the plugin falls back to
-  // the bash lite harness (intent lock, study lock), so this row WARNs instead of passing silently (QA 2026-11-06).
-  if (hk) {
-    const psDirs = String(process.env.PATH || "").split(IS_WIN ? ";" : ":");
-    const ps = ["pwsh", "pwsh.exe", "powershell.exe", "powershell"].find((n) => psDirs.some((d) => d && existsSync(join(d, n))));
-    const lite = existsSync(join(k, "tools", "wkharness-lite.sh"));
-    add("guards", !!ps, ps ? "full guard set (" + ps + ")" : lite ? "no PowerShell on PATH: lite guards only (intent lock, study lock); install pwsh 7 for the full set" : "no PowerShell and no lite harness: every tool call is let through", !ps && !lite);
-  }
+  else if (hk && !mode) add("kih-hook", false, k + ": pwsh is missing and the lite harness (tools/wkharness-lite.sh) is not there -- no hook verdict; reinstall the harness", true);
+  else add("kih-hook", hk, k ? k + (st.harness && st.harness.mode ? "  (" + st.harness.mode + ")" : "") + (mode ? "  verdict: " + (mode === "full" ? "full pwsh hub (" + ps + ") after lite" : "lite sh harness" + (ps ? " (user install)" : " (no pwsh)")) : "") : "not found", !!(st.harness && st.harness.mode === "web"));
   // skills: the HQ holds on-load and the core prints it
   const hq = (st.skills && st.skills.hq) || hqDir(o, dest);
   if (st.skills && st.skills.skipped) add("skills", false, "skipped (--no-skills)", false, true);
@@ -417,10 +567,12 @@ function doctor(o) {
       if (!printed) why = "  skill read on-load rc " + r.status;
       rmSync(cwd, { recursive: true, force: true });
     } else why = "  (no core to read with)";
-    add("skills", n > 0 && printed, n + " skills in " + hq + (printed ? "; wkappbot skill read on-load prints" : why), !!(st.skills && !st.skills.skipped));
+    // Without a core (--no-bin, or win-x64 where no single core asset exists yet) the skills cannot be read back:
+    // that is a WARN about the missing core, not a FAIL of the skills that did install (SDK all-OS QA 2026-11-06).
+    add("skills", n > 0 && printed, n + " skills in " + hq + (printed ? "; wkappbot skill read on-load prints" : why), !!(st.skills && !st.skills.skipped) && !!core);
   }
   // push-gate: the global core.hooksPath runs the push-owner gate (directly, or through the global dispatcher).
-  const ghp = (() => { try { return execFileSync("git", ["config", "--global", "--get", "core.hooksPath"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim(); } catch { return ""; } })();
+  const ghp = globalHooksPath() || "";
   let gated = false;
   try { gated = /push-owner-gate|wk-global-hooks\.sh/.test(readFileSync(join(ghp.replace(/^~(?=\/|$)/, homedir()), "pre-push"), "utf8")); } catch {}
   add("push-gate", gated, "global core.hooksPath " + (ghp || "unset") + (gated ? " runs the push-owner gate" : " does not run the push-owner gate"), false);
@@ -452,12 +604,13 @@ switch (o.cmd) {
   case "--version": case "-v": case "version":
     console.log("wkappbot-code " + PKG.version + " (opencode-ai " + OPENCODE_VERSION + ")"); process.exit(0);
   case "install": process.exit(install(o));
+  case "uninstall": process.exit(uninstall(o));
   case "doctor": process.exit(doctor(o));
   case "update": process.exit(upd());
-  case "config": installPlugin(o, kihDir(o), kihCheckout(o) ? "kih checkout" : "web harness"); process.exit(0);
+  case "config": installPlugin(o, kihDir(o), kihCheckout(o) ? "harness checkout" : "web harness"); process.exit(0);
   default:
-    console.log("usage: wkappbot-code --version | install [--no-npm] [--no-bin] [--no-harness] [--no-skills] [--web-harness]\n" +
+    console.log("usage: wkappbot-code --version | install [--no-npm] [--no-bin] [--no-harness] [--no-skills] [--web-harness] [--dev-seat]\n" +
       "         [--config-dir DIR] [--kih-dir DIR] [--bin-dest FILE] [--hq-dir DIR] [--update] [--auto-update] | doctor [--config-dir DIR]\n" +
-      "       | update [install opts] | config [--yes] [--project] [--set key=value] [--config-dir DIR]");
+      "       | uninstall [--config-dir DIR] | update [install opts] | config [--yes] [--project] [--set key=value] [--config-dir DIR]");
     process.exit(o.cmd === "help" || o.cmd === "--help" ? 0 : 64);
 }

package/lib/config.js

@@ -97,9 +97,13 @@ export function buildConfig(user, it, template) {
   const ours = [it.plugin ? it.plugin.value : "", { kihDir: it.harness ? it.harness.value : "" }];
   const keep = (Array.isArray(user.plugin) ? user.plugin : []).filter((p) => !String(Array.isArray(p) ? p[0] : p).includes("wisdom-kernel"));
   out.plugin = [...keep, ours];
-  if (!out.provider) out.provider = template.provider;
-  else if (template.provider) for (const [k, v] of Object.entries(template.provider)) if (!(k in out.provider)) out.provider[k] = v;
-  if (!out.permission) out.permission = template.permission;
+  // 0.3.1 (owner: minimum items only): the shipped template carries no provider and no permission, so nothing is
+  // added for them; a template that does carry one still only fills what the user has not set.
+  if (template.provider) {
+    if (!out.provider) out.provider = template.provider;
+    else for (const [k, v] of Object.entries(template.provider)) if (!(k in out.provider)) out.provider[k] = v;
+  }
+  if (template.permission && !out.permission) out.permission = template.permission;
   if (it.model && (it.model.forced || !user.model)) out.model = it.model.value;
   return out;
 }