wkappbot-code 0.3.3 → 0.3.7

package/lib/wk-hook.js

@@ -0,0 +1,281 @@
+// wk-hook.js -- the helpers of the wisdom-kernel OpenCode plugin (wkappbot-code 0.3.1).
+// WHY A SEPARATE MODULE: OpenCode 1.19.5 calls EVERY named export of a plugin file as a plugin, so a helper or a
+// constant exported from plugin/wisdom-kernel.js made it fail with "Plugin export is not a function" and no hook
+// ever fired. The plugin file now exports only the plugin function; everything here is imported by it and by the
+// selftest. install copies this file beside the installed plugin.
+// Spec: wkappbot skill read agent-harness-landscape-2026-howto
+import { spawn } from "node:child_process";
+import { appendFileSync, existsSync, mkdirSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// OpenCode tool id -> Claude tool name the kih guards already know.
+export const TOOL_MAP = {
+  bash: "Bash", edit: "Edit", write: "Write", read: "Read",
+  glob: "Glob", grep: "Grep", list: "LS", patch: "Edit", multiedit: "MultiEdit",
+  webfetch: "WebFetch", websearch: "WebSearch", task: "Agent", todowrite: "TodoWrite",
+};
+
+// pre arm budget: a hung hook is killed. A timeout is NO verdict: allowed, unless the call is in a risky class.
+export const PRE_TIMEOUT_MS = Number(process.env.WK_APPBOT_PRE_TIMEOUT_MS || 60000);
+
+// OpenCode args (camelCase) -> Claude tool_input (snake_case) for the tools the guards inspect.
+export function toClaudeInput(tool, args) {
+  const a = args || {};
+  switch (tool) {
+    case "bash": {
+      const o = { command: a.command ?? "" };
+      if (a.description !== undefined) o.description = a.description;
+      if (a.timeout !== undefined) o.timeout = a.timeout;
+      return o;
+    }
+    case "edit":
+      return { file_path: a.filePath ?? a.file_path, old_string: a.oldString ?? a.old_string,
+               new_string: a.newString ?? a.new_string, replace_all: a.replaceAll ?? a.replace_all ?? false };
+    case "write":
+      return { file_path: a.filePath ?? a.file_path, content: a.content ?? "" };
+    case "read": {
+      const o = { file_path: a.filePath ?? a.file_path };
+      if (a.offset !== undefined) o.offset = a.offset;
+      if (a.limit !== undefined) o.limit = a.limit;
+      return o;
+    }
+    default: {
+      const o = { ...a };
+      if (o.filePath !== undefined && o.file_path === undefined) o.file_path = o.filePath;
+      return o;
+    }
+  }
+}
+
+export function claudeToolName(tool) {
+  return TOOL_MAP[tool] || tool;
+}
+
+// The Claude-shaped hook payload for one OpenCode tool call.
+export function buildPreToolUsePayload(input, args, cwd) {
+  return {
+    hook_event_name: "PreToolUse",
+    session_id: input.sessionID,
+    cwd: (args && args.workdir) || cwd,
+    tool_name: claudeToolName(input.tool),
+    tool_input: toClaudeInput(input.tool, args),
+    tool_use_id: input.callID,
+    agent_family: "opencode",
+  };
+}
+
+export function buildPostToolUsePayload(input, output, cwd) {
+  const p = buildPreToolUsePayload(input, input.args, cwd);
+  p.hook_event_name = "PostToolUse";
+  p.tool_response = { output: output && output.output, title: output && output.title };
+  return p;
+}
+
+// chat.message -> UserPromptSubmit (the intent lock arm). The prompt is the text parts of the user message.
+export function buildPromptPayload(input, output, cwd) {
+  const parts = (output && output.parts) || [];
+  const prompt = parts.filter((p) => p && p.type === "text" && typeof p.text === "string").map((p) => p.text).join("\n");
+  const sid = (input && input.sessionID) || (output && output.message && output.message.sessionID);
+  return { hook_event_name: "UserPromptSubmit", session_id: sid, cwd, prompt, agent_family: "opencode" };
+}
+
+// kih root: WK_KIH_DIR, else the checkout this file sits in (wkappbot-code/lib -> ../..).
+export function resolveKihDir() {
+  if (process.env.WK_KIH_DIR && process.env.WK_KIH_DIR !== "none") return process.env.WK_KIH_DIR;
+  try {
+    const up = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+    if (existsSync(join(up, ".claude", "hooks", "wkharness-run.sh"))) return up;
+  } catch {}
+  return "";
+}
+
+// Pipe JSON into "wkharness-run.sh <arm>"; resolves {code, stdout, stderr}. Never rejects.
+// No hook found = {skipped}: no verdict (allowed unless the call is in a risky class).
+export function runHook(arm, payload, opts = {}) {
+  const kih = opts.kihDir ?? resolveKihDir();
+  const hook = opts.hook || process.env.WK_APPBOT_HOOK || (kih && join(kih, ".claude", "hooks", "wkharness-run.sh"));
+  return new Promise((done) => {
+    let settled = false;
+    const finish = (r) => { if (!settled) { settled = true; if (timer) clearTimeout(timer); done(r); } };
+    let timer = null, out = "", err = "", child;
+    if (!hook || !existsSync(hook)) return finish({ code: 0, stdout: "", stderr: "", skipped: true });
+    let body;
+    try { body = JSON.stringify(payload); } catch (e) { return finish({ code: 0, stdout: "", stderr: String(e), skipped: true }); }
+    try {
+      // Windows: Git Bash runs the hook, so every path it gets (the script, CLAUDE_PROJECT_DIR, HOME) is the MSYS
+      // form /d/a/x; a "D:\\a\\x" path fails the harness's absolute-path tests (SDK all-OS QA 2026-11-06).
+      const W = process.platform === "win32";
+      const sp = (p) => (W && /^[A-Za-z]:[\\/]/.test(p) ? "/" + p[0].toLowerCase() + p.slice(2).replace(/\\/g, "/") : p);
+      child = spawn("bash", [sp(hook), arm], {
+        // The plugin's harness wins: wkharness-run.sh prefers WKHARNESS_KIH_DIR over CLAUDE_PROJECT_DIR, so an ambient
+        // WKHARNESS_KIH_DIR (a dev seat's shell profile, a CI job) sent every arm to ANOTHER tree, whose lite and ledger
+        // then ran or did not run (SDK QA 2026-11-06: x8 null|null|null on Linux and macOS). Both point at kihDir.
+        env: { ...process.env, ...(W ? { HOME: sp(homedir()) } : {}), ...(kih ? { CLAUDE_PROJECT_DIR: sp(kih), WKHARNESS_KIH_DIR: sp(kih) } : {}) },
+        stdio: ["pipe", "pipe", "pipe"],
+      });
+    } catch (e) {
+      return finish({ code: 0, stdout: "", stderr: String(e), skipped: true });
+    }
+    if (opts.timeoutMs) {
+      timer = setTimeout(() => {
+        try { child.kill("SIGKILL"); } catch {}
+        finish({ code: 0, stdout: out, stderr: err, timedOut: true });
+      }, opts.timeoutMs);
+    }
+    child.stdout.on("data", (d) => (out += d));
+    child.stderr.on("data", (d) => (err += d));
+    child.on("error", (e) => finish({ code: 0, stdout: out, stderr: err + String(e), skipped: true }));
+    child.on("close", (code) => finish({ code: code ?? 0, stdout: out, stderr: err }));
+    child.stdin.on("error", () => {});
+    child.stdin.end(body);
+  });
+}
+
+// Claude contract: exit 2 refuses; so does a stdout JSON deny/block verdict.
+export function isRefusal(r) {
+  if (r.timedOut || r.skipped) return false;
+  if (r.code === 2) return true;
+  try {
+    const j = JSON.parse(r.stdout);
+    return (j.hookSpecificOutput && j.hookSpecificOutput.permissionDecision === "deny") || j.decision === "block";
+  } catch { return false; }
+}
+
+// A VERDICT is rc 0 or rc 2 from a hook that ran to the end. Anything else (pwsh missing = 127, a crash, a kill at
+// the budget, no hook at all) is NO verdict.
+export function hasVerdict(r) {
+  return !r.timedOut && !r.skipped && (r.code === 0 || r.code === 2);
+}
+
+// A stdout deny JSON names its own reason; stderr then may hold only warn lines (wkharness-run.sh wk_pre_emit).
+export function refusalReason(r) {
+  try {
+    const j = JSON.parse(r.stdout);
+    const why = (j.hookSpecificOutput && j.hookSpecificOutput.permissionDecisionReason) || j.reason;
+    if (why) return why;
+  } catch {}
+  return (r.stderr || "").trim() || (r.stdout || "").trim() || "refused by the kih harness";
+}
+
+// ---- fail-closed risk classes ----------------------------------------------------------------------------
+// The SAME classes tools/wkharness-lite.sh refuses by itself (wk_lite_risk there). With NO verdict from the harness,
+// a call in one of these classes is REFUSED instead of allowed: a public package must never let rm -rf HOME through
+// because pwsh happened to be missing. Returns the class label, or "".
+const HOME_T = /^(~|\$HOME|\$\{HOME\}|\/root|\/home\/[^/]+|\/Users\/[^/]+)\/?(\*|\.\*)?$/;
+export function riskClass(tool, input, cwd) {
+  const t = claudeToolName(tool);
+  const i = input || {};
+  if (t === "Bash") {
+    const c = String(i.command || "");
+    for (const seg of c.split(/&&|\|\||[;|\n]/)) {
+      const w = seg.trim().split(/\s+/).map((x) => x.replace(/^['"]|['"]$/g, ""));
+      const gi = w.indexOf("git");
+      if (gi >= 0) {
+        const g = w.slice(gi + 1);
+        const sub = g.find((x) => !x.startsWith("-") && !/^[\w.]+=/.test(x) && g[g.indexOf(x) - 1] !== "-C" && g[g.indexOf(x) - 1] !== "-c");
+        if (g.includes("--no-verify") || (sub === "commit" && g.some((x) => /^-[A-Za-z]*n[A-Za-z]*$/.test(x)))) return "git --no-verify";
+        if (sub === "push" && g.some((x) => /^--force(-with-lease)?(=.*)?$|^--force-if-includes$/.test(x) || /^-[A-Za-z]*f[A-Za-z]*$/.test(x) || /^\+\S/.test(x))) return "git push --force";
+        if (g.some((x) => /^core\.hookspath(=.*)?$/i.test(x)) && (sub === "config" || g.includes("-c")) && !g.some((x) => /^--(get|get-all|get-regexp|list|show-origin)$/.test(x))) return "git core.hooksPath change";
+      }
+      const ri = w.indexOf("rm");
+      if (ri >= 0) {
+        const a = w.slice(ri + 1);
+        if (a.some((x) => /^-[A-Za-z]*[rR][A-Za-z]*$|^--recursive$/.test(x))) {
+          const tg = a.filter((x) => !x.startsWith("-"));
+          const proj = cwd ? String(cwd).replace(/\/+$/, "") : "";
+          if (tg.some((x) => HOME_T.test(x) || x === "/" || x === "/*")) return "rm -r of HOME or /";
+          if (tg.some((x) => [".", "./", "./*", "*", "..", "../"].includes(x) || (proj && x.replace(/\/+$/, "") === proj))) return "rm -r of the project source";
+          if (tg.some((x) => /(^|\/)\.git(\/|$)/.test(x))) return "write under .git";
+        }
+      }
+      if (/(^|[\s/'"=>])\.git(\/|\s|$)/.test(seg) && (/>/.test(seg) || /^(rm|mv|cp|tee|truncate|dd|ln|chmod|sed)\b/.test(seg.trim()))) return "write under .git";
+    }
+    return "";
+  }
+  if (["Edit", "Write", "MultiEdit", "NotebookEdit"].includes(t)) {
+    const f = String(i.file_path || i.notebook_path || "");
+    if (/(^|[\\/])\.git[\\/]/.test(f)) return "write under .git";
+  }
+  return "";
+}
+
+// ---- read-only fast path ---------------------------------------------------------------------------------
+// These calls never start pwsh (5.3 s measured for echo hello): read tools, and ONE plain read-only shell command
+// with no chain, pipe, redirect or substitution. A path that looks like a secret is never fast (the full harness
+// keeps its say on it).
+const SECRET_RE = /(^|[\s/'"=])(\.ssh|\.aws|\.gnupg|\.netrc|\.env(\.[\w-]+)?|id_rsa\w*|id_ed25519\w*|credentials?(\.\w+)?|\.npmrc|\.pypirc|auth\.json|[\w.-]*(token|secret|passw)[\w.-]*)(?=$|[\s/'"])/i;
+const RO_CMD = /^\s*(ls|cat|grep|rg|head|tail|wc|pwd|echo|which|stat|git\s+(status|log|diff|show|branch|rev-parse))(\s|$)/;
+export function isFastRead(tool, input) {
+  const t = claudeToolName(tool);
+  const i = input || {};
+  if (t === "Read" || t === "Glob" || t === "Grep" || t === "LS") return !SECRET_RE.test(" " + String(i.file_path || i.path || "") + " " + String(i.pattern || ""));
+  if (t !== "Bash") return false;
+  const c = String(i.command || "");
+  if (!c.trim() || c.length > 400 || /[;&|<>`$\n\r\\(){}]/.test(c)) return false;
+  if (!RO_CMD.test(c) || SECRET_RE.test(c)) return false;
+  if (/^\s*git\b/.test(c) && /\s(--output\S*|--ext-diff|--exec\S*|-o)(\s|$)/.test(c)) return false;
+  return true;
+}
+
+// PER-CALL INJECTION (owner 2026-11-06: "so we must force our settings onto every model call OpenCode makes").
+// experimental.chat.system.transform appends RULES to the system array of EVERY model request, so a model that never
+// saw kih (Qwen, a fresh provider) still gets the reflex body. Short, fixed, no secrets. RULES_MARK makes the append
+// idempotent when OpenCode hands the same array back. Spec: agent-harness-landscape-2026 step PER-CALL INJECTION.
+export const RULES_MARK = "[wisdom-kernel rules]";
+export const RULES = [
+  RULES_MARK + " You run under the Wisdom Kernel harness (wkappbot-code). On every turn:",
+  "1. One command per shell call; never chain a write with anything else.",
+  "2. A refusal names a skill: run wkskill read <id> (or wkappbot skill read <id>) and apply its remedy; never route around it.",
+  "3. Never use git --no-verify or git push --force, never change core.hooksPath, never rm -r a home directory, / or the project source.",
+  "4. Never edit or delete files under .git.",
+  "5. After a new user prompt, run wkskill search <three or more words> before the first write; read-only tools stay open.",
+].join("\n");
+
+// The top step lines of the on-load skill, fetched ONCE per process (one OpenCode server = its sessions) in the
+// background; the transform waits at most ONLOAD_WAIT_MS for it and otherwise sends the fixed rules alone.
+const ONLOAD_WAIT_MS = Number(process.env.WK_APPBOT_ONLOAD_WAIT_MS || 1500);
+let _onload = null;
+export function onLoadLines(kihDir) {
+  if (_onload) return _onload;
+  _onload = new Promise((res) => {
+    const k = kihDir || resolveKihDir();
+    const cands = [process.env.WK_APPBOT_SKILL_CMD, k && join(k, "bin", "wkskill"), "wkskill"].filter(Boolean);
+    let out = "", done = false;
+    const finish = () => {
+      if (done) return; done = true;
+      // no secrets reach the model: a secret-file name (SECRET_RE), a key=value or key: value pair, or a URL drops the line
+      const lines = out.split("\n").map((l) => l.trim()).filter((l) => /^\d+\.\s/.test(l) && !SECRET_RE.test(l) &&
+        !/(token|secret|passw\w*|api[_-]?key|auth)\s*[=:]/i.test(l) && !/https?:\/\//.test(l));
+      res(lines.slice(0, 3).map((l) => l.slice(0, 240)));
+    };
+    try {
+      const c = spawn(cands.find((p) => p === "wkskill" || existsSync(p)), ["read", "on-load"], { stdio: ["ignore", "pipe", "ignore"] });
+      c.stdout.on("data", (d) => { out += d; if (out.length > 65536) c.kill("SIGKILL"); });
+      c.on("error", finish); c.on("close", finish);
+      setTimeout(() => { try { c.kill("SIGKILL"); } catch {} finish(); }, 8000).unref();
+    } catch { finish(); }
+  });
+  return _onload;
+}
+export async function rulesBlock(kihDir) {
+  let top = [];
+  try { top = await Promise.race([onLoadLines(kihDir), new Promise((r) => setTimeout(() => r([]), ONLOAD_WAIT_MS))]); } catch {}
+  return top.length ? RULES + "\nFrom the on-load skill:\n" + top.join("\n") : RULES;
+}
+export function injectRules(system, block) {
+  if (!Array.isArray(system) || system.some((s) => String(s).includes(RULES_MARK))) return false;
+  system.push(block);
+  return true;
+}
+
+// One line per model-call hook into ~/.wkappbot-code/plugin.log (chat.params is logged, never changed). Capped at 1 MB.
+export function hookLog(hook, fields) {
+  try {
+    const f = process.env.WK_APPBOT_LOG || join(homedir(), ".wkappbot-code", "plugin.log");
+    mkdirSync(dirname(f), { recursive: true });
+    try { if (statSync(f).size > 1048576) writeFileSync(f, ""); } catch {}
+    appendFileSync(f, new Date().toISOString() + " " + hook + " " + JSON.stringify(fields || {}) + "\n");
+  } catch {}
+}

package/opencode.json

@@ -2,30 +2,5 @@
   "$schema": "https://opencode.ai/config.json",
   "plugin": [
     ["__WK_PLUGIN_URL__", { "kihDir": "__WK_KIH_DIR__" }]
-  ],
-  "permission": {
-    "edit": "ask",
-    "webfetch": "ask",
-    "bash": {
-      "*": "ask",
-      "ls*": "allow",
-      "pwd": "allow",
-      "git status*": "allow",
-      "git diff*": "allow",
-      "git log*": "allow"
-    }
-  },
-  "provider": {
-    "qwen-inhouse": {
-      "npm": "@ai-sdk/openai-compatible",
-      "name": "In-house Qwen (OpenAI-compatible)",
-      "options": {
-        "baseURL": "{env:QWEN_BASE_URL}",
-        "apiKey": "{env:QWEN_API_KEY}"
-      },
-      "models": {
-        "qwen3-coder": { "name": "Qwen3 Coder (in-house)" }
-      }
-    }
-  }
+  ]
 }

package/package.json

@@ -1,16 +1,20 @@
 {
   "name": "wkappbot-code",
-  "version": "0.3.3",
+  "version": "0.3.7",
   "description": "wkappbot-code -- Wisdom Kernel: the pinned OpenCode bridge plus the reflex harness plugin, the wkappbot core, the web harness and the latest public skills in one install",
   "type": "module",
+  "scripts": {
+    "postinstall": "node bin/postinstall.js"
+  },
   "bin": {
     "wkappbot-code": "bin/wkappbot-code.js",
     "wk-appbot-code": "bin/wkappbot-code.js"
   },
   "files": [
-    "bin/",
-    "lib/",
-    "plugin/",
+    "bin/*.js",
+    "lib/*.js",
+    "lib/*.sh",
+    "plugin/*.js",
     "opencode.json",
     "install.sh",
     "README.md"

package/plugin/wisdom-kernel.js

@@ -1,217 +1,95 @@
 // wkappbot-code -- Wisdom Kernel: the one kih plugin for OpenCode (pinned: opencode-ai 1.19.5).
 // OpenCode is the BRIDGE (model <-> tools); kih is the HARNESS riding on it. This file only maps
-// OpenCode plugin events onto the existing kih hook launcher, .claude/hooks/wkharness-run.sh:
-//   tool.execute.before -> "pre"           (exit 2 = refuse: throw with the hook stderr as the reason)
-//   tool.execute.after  -> "post"          (fail-open, never changes the tool result)
-//   event session.idle  -> "stop-archive"  (archive only, fail-open, no verdict)
-// Fail direction matches Claude Code: only a hook VERDICT refuses; a plugin error, a missing hook or a
-// hung hook (killed at PRE_TIMEOUT_MS) lets the call through.
-// API verified 2026-11-05 from @opencode-ai/plugin 1.19.5 dist/index.d.ts (interface Hooks) and
-// @opencode-ai/sdk 1.19.5 dist/gen/types.gen.d.ts:413 (EventSessionIdle). Spec:
-// wkappbot skill read agent-harness-landscape-2026-howto
+// OpenCode plugin events onto the kih hook launcher, .claude/hooks/wkharness-run.sh:
+//   tool.execute.before   -> "pre"           (exit 2 = refuse: throw with the hook's own message as the reason)
+//   tool.execute.after    -> "post"          (fail-open, never changes the tool result)
+//   chat.message          -> "prompt"        (UserPromptSubmit: the intent lock owes a skill search for the prompt)
+//   event session.created -> "session"       (SessionStart)
+//   event session.idle    -> "stop-archive"  (archive only, fail-open, no verdict)
+//   experimental.chat.system.transform -> the reflex RULES appended to EVERY model request (lib/wk-hook.js injectRules)
+//   chat.params           -> logged only (~/.wkappbot-code/plugin.log); the user's model settings are never changed
+// FAST PATH: a read tool, or one plain read-only shell command (ls, cat, grep, git status/log/diff ...), runs no hook
+// at all, so it never starts pwsh (measured 5.3 s for echo hello). lib/wk-hook.js isFastRead.
+// FAIL DIRECTION: a hook VERDICT (rc 0 allow, rc 2 refuse) decides. NO verdict (pwsh missing = 127, a crash, a hook
+// killed at PRE_TIMEOUT_MS, no harness found) allows the call -- EXCEPT a call in a risky class (git --no-verify,
+// git push --force, a core.hooksPath change, rm -r of HOME, / or the project, a write under .git), which is REFUSED
+// (fail-closed). lib/wk-hook.js riskClass.
+// EXPORTS: OpenCode 1.19.5 calls EVERY named export of this file as a plugin ("Plugin export is not a function"
+// otherwise), so this file exports ONLY the plugin function, as WisdomKernel and as default. Every helper lives in
+// lib/wk-hook.js (installed beside this file as wk-hook.js).
+// API verified 2026-11-06 from @opencode-ai/plugin 1.19.5 dist/index.d.ts (interface Hooks: chat.message, event,
+// tool.execute.before/after). Spec: wkappbot skill read agent-harness-landscape-2026-howto
 // KNOWN GAP: no transcript_path is sent (OpenCode keeps sessions in its own store), so kih gates that
 // resolve the model or read the transcript see an unknown model and fall back to their defaults.
-import { spawn } from "node:child_process";
-import { existsSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-// OpenCode tool id -> Claude tool name the kih guards already know.
-const TOOL_MAP = {
-  bash: "Bash", edit: "Edit", write: "Write", read: "Read",
-  glob: "Glob", grep: "Grep", list: "LS", patch: "Edit", multiedit: "MultiEdit",
-  webfetch: "WebFetch", websearch: "WebSearch", task: "Agent", todowrite: "TodoWrite",
-};
-
-// pre arm budget: a hung hook is killed and the call fails OPEN, like a Claude hook timeout.
-const PRE_TIMEOUT_MS = Number(process.env.WK_APPBOT_PRE_TIMEOUT_MS || 60000);
-
-// OpenCode args (camelCase) -> Claude tool_input (snake_case) for the tools the guards inspect.
-function toClaudeInput(tool, args) {
-  const a = args || {};
-  switch (tool) {
-    case "bash": {
-      const o = { command: a.command ?? "" };
-      if (a.description !== undefined) o.description = a.description;
-      if (a.timeout !== undefined) o.timeout = a.timeout;
-      return o;
-    }
-    case "edit":
-      return { file_path: a.filePath ?? a.file_path, old_string: a.oldString ?? a.old_string,
-               new_string: a.newString ?? a.new_string, replace_all: a.replaceAll ?? a.replace_all ?? false };
-    case "write":
-      return { file_path: a.filePath ?? a.file_path, content: a.content ?? "" };
-    case "read": {
-      const o = { file_path: a.filePath ?? a.file_path };
-      if (a.offset !== undefined) o.offset = a.offset;
-      if (a.limit !== undefined) o.limit = a.limit;
-      return o;
-    }
-    default: {
-      const o = { ...a };
-      if (o.filePath !== undefined && o.file_path === undefined) o.file_path = o.filePath;
-      return o;
-    }
-  }
-}
-
-function claudeToolName(tool) {
-  return TOOL_MAP[tool] || tool;
-}
-
-// The Claude-shaped hook payload for one OpenCode tool call.
-function buildPreToolUsePayload(input, args, cwd) {
-  return {
-    hook_event_name: "PreToolUse",
-    session_id: input.sessionID,
-    cwd: (args && args.workdir) || cwd,
-    tool_name: claudeToolName(input.tool),
-    tool_input: toClaudeInput(input.tool, args),
-    tool_use_id: input.callID,
-    agent_family: "opencode",
-  };
-}
-
-function buildPostToolUsePayload(input, output, cwd) {
-  const p = buildPreToolUsePayload(input, input.args, cwd);
-  p.hook_event_name = "PostToolUse";
-  p.tool_response = { output: output && output.output, title: output && output.title };
-  return p;
-}
-
-// kih root: WK_KIH_DIR, else the checkout this file sits in (wkappbot-code/plugin -> ../..).
-function resolveKihDir() {
-  if (process.env.WK_KIH_DIR) return process.env.WK_KIH_DIR;
-  try {
-    const up = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
-    if (existsSync(join(up, ".claude", "hooks", "wkharness-run.sh"))) return up;
-  } catch {}
-  return "";
-}
-
-// Pipe JSON into "<hook> <arm>" (wkharness-run.sh, or wkharness-lite.sh without PowerShell); resolves {code, stdout, stderr}. Never rejects.
-// No hook found = fail-open (code 0, skipped) so a missing kih never bricks OpenCode.
-// PowerShell on PATH? The full harness (wkharness-run.sh) runs its guards in PowerShell; without one it exits 127,
-// which used to read as "no verdict" and let EVERY call through (QA 2026-11-06, fresh Linux HOME).
-function onPath(names) {
-  const dirs = String(process.env.PATH || "").split(process.platform === "win32" ? ";" : ":");
-  for (const d of dirs) for (const n of names) { try { if (d && existsSync(join(d, n))) return true; } catch {} }
-  return false;
-}
-let _ps = null;
-function hasPowerShell() {
-  if (process.env.WK_APPBOT_FORCE_LITE === "1") return false;
-  if (_ps === null) _ps = onPath(["pwsh", "pwsh.exe", "powershell.exe", "powershell"]);
-  return _ps;
-}
-
-// Which hook script serves an arm: the full harness when PowerShell is there, else the bash lite harness
-// (tools/wkharness-lite.sh: study lock, intent lock, stop lint). The prompt and session arms exist only in lite.
-function pickHook(arm, kih) {
-  if (!kih) return "";
-  const full = join(kih, ".claude", "hooks", "wkharness-run.sh"), lite = join(kih, "tools", "wkharness-lite.sh");
-  const liteArm = arm === "prompt" || arm === "session";
-  if (!liteArm && hasPowerShell() && existsSync(full)) return full;
-  if (existsSync(lite)) return lite;
-  return liteArm ? "" : full;
-}
-
-function runHook(arm, payload, opts = {}) {
-  const kih = opts.kihDir ?? resolveKihDir();
-  const hook = opts.hook || process.env.WK_APPBOT_HOOK || pickHook(arm, kih);
-  return new Promise((done) => {
-    let settled = false;
-    const finish = (r) => { if (!settled) { settled = true; if (timer) clearTimeout(timer); done(r); } };
-    let timer = null, out = "", err = "", child;
-    if (!hook || !existsSync(hook)) return finish({ code: 0, stdout: "", stderr: "", skipped: true });
-    let body;
-    try { body = JSON.stringify(payload); } catch (e) { return finish({ code: 0, stdout: "", stderr: String(e), skipped: true }); }
-    try {
-      child = spawn("bash", [hook, arm], {
-        env: { ...process.env, ...(kih ? { CLAUDE_PROJECT_DIR: kih } : {}) },
-        stdio: ["pipe", "pipe", "pipe"],
-      });
-    } catch (e) {
-      return finish({ code: 0, stdout: "", stderr: String(e), skipped: true });
-    }
-    if (opts.timeoutMs) {
-      timer = setTimeout(() => {
-        try { child.kill("SIGKILL"); } catch {}
-        finish({ code: 0, stdout: out, stderr: err, timedOut: true });
-      }, opts.timeoutMs);
-    }
-    child.stdout.on("data", (d) => (out += d));
-    child.stderr.on("data", (d) => (err += d));
-    child.on("error", (e) => finish({ code: 0, stdout: out, stderr: err + String(e), skipped: true }));
-    child.on("close", (code) => finish({ code: code ?? 0, stdout: out, stderr: err }));
-    child.stdin.on("error", () => {});
-    child.stdin.end(body);
-  });
-}
-
-// Claude contract: exit 2 refuses; so does a stdout JSON deny/block verdict.
-function isRefusal(r) {
-  if (r.timedOut || r.skipped) return false;
-  if (r.code === 2) return true;
-  try {
-    const j = JSON.parse(r.stdout);
-    return (j.hookSpecificOutput && j.hookSpecificOutput.permissionDecision === "deny") || j.decision === "block";
-  } catch { return false; }
-}
-
-// A stdout deny JSON names its own reason; stderr then may hold only warn lines (wkharness-run.sh wk_pre_emit).
-function refusalReason(r) {
-  try {
-    const j = JSON.parse(r.stdout);
-    const why = (j.hookSpecificOutput && j.hookSpecificOutput.permissionDecisionReason) || j.reason;
-    if (why) return why;
-  } catch {}
-  return (r.stderr || "").trim() || (r.stdout || "").trim() || "refused by the kih harness";
-}
+let H;
+try { H = await import("./wk-hook.js"); } catch { H = await import("../lib/wk-hook.js"); }
 
 // options = the second slot of the opencode.json plugin entry: ["file://.../wisdom-kernel.js", { "kihDir": "..." }].
-// install.sh fills kihDir, because the installed copy no longer sits inside the kih checkout.
+// install fills kihDir, because the installed copy no longer sits inside the kih checkout.
 export const WisdomKernel = async (ctx = {}, options = {}) => {
   const cwd = ctx.directory || ctx.worktree || process.cwd();
   const k = (options && options.kihDir) || undefined;
+  const fast = new Set();
   return {
     "tool.execute.before": async (input, output) => {
-      let r;
+      const inp = input || {};
+      const args = output && output.args;
+      let p, r;
       try {
-        r = await runHook("pre", buildPreToolUsePayload(input || {}, output && output.args, cwd), { kihDir: k, timeoutMs: PRE_TIMEOUT_MS });
-      } catch { return; } // a plugin bug never refuses a call
-      if (isRefusal(r)) throw new Error("[wisdom-kernel] " + refusalReason(r));
+        p = H.buildPreToolUsePayload(inp, args, cwd);
+        if (H.isFastRead(inp.tool, p.tool_input)) { if (inp.callID) fast.add(inp.callID); return; }
+        r = await H.runHook("pre", p, { kihDir: k, timeoutMs: H.PRE_TIMEOUT_MS });
+      } catch (e) { r = { code: -1, stdout: "", stderr: String(e), skipped: true }; }
+      if (H.isRefusal(r)) throw new Error("[wisdom-kernel] " + H.refusalReason(r));
+      if (!H.hasVerdict(r)) {
+        let cls = "";
+        try { cls = H.riskClass(inp.tool, p && p.tool_input, p && p.cwd); } catch { cls = "unclassifiable call"; }
+        if (cls) {
+          const why = r.timedOut ? "the hook was killed at " + H.PRE_TIMEOUT_MS + " ms" : r.skipped ? "no kih hook ran" : "the hook exited " + r.code;
+          const tail = String(r.stderr || "").trim().split("\n").slice(-2).join(" | ");
+          throw new Error("[wisdom-kernel] fail-closed: " + cls + " is refused because the harness gave no verdict (" + why + ")" +
+            (tail ? ": " + tail : "") + ". Fix the harness (wkappbot-code doctor) and retry.");
+        }
+      }
     },
     "tool.execute.after": async (input, output) => {
-      try { await runHook("post", buildPostToolUsePayload(input || {}, output, cwd), { kihDir: k, timeoutMs: 30000 }); } catch {}
+      try {
+        const id = input && input.callID;
+        if (id && fast.has(id)) { fast.delete(id); return; }
+        await H.runHook("post", H.buildPostToolUsePayload(input || {}, output, cwd), { kihDir: k, timeoutMs: 30000 });
+      } catch {}
     },
-    // UserPromptSubmit: arms the intent lock for the next real tool call (fail-open, never blocks the message).
     "chat.message": async (input, output) => {
+      try { await H.runHook("prompt", H.buildPromptPayload(input, output, cwd), { kihDir: k, timeoutMs: 30000 }); } catch {}
+    },
+    // PER-CALL INJECTION: every model request carries the reflex rules (lib/wk-hook.js RULES), whatever the model.
+    // Experimental in OpenCode 1.19.5, so the package pins that version and the e2e asserts the rules reach the model.
+    "experimental.chat.system.transform": async (input, output) => {
       try {
-        const parts = (output && output.parts) || [];
-        const prompt = parts.filter((p) => p && p.type === "text" && !p.synthetic).map((p) => p.text || "").join("\n");
-        if (!prompt) return;
-        await runHook("prompt", { hook_event_name: "UserPromptSubmit", session_id: input && input.sessionID, cwd, prompt, agent_family: "opencode" }, { kihDir: k, timeoutMs: 30000 });
+        const added = H.injectRules(output && output.system, await H.rulesBlock(k));
+        H.hookLog("system.transform", { sid: input && input.sessionID, model: input && input.model && input.model.id, added });
       } catch {}
     },
+    // chat.params: the model settings stay exactly as the user configured them; the hook only logs that it ran.
+    "chat.params": async (input) => {
+      try { H.hookLog("chat.params", { sid: input && input.sessionID, agent: input && input.agent, model: input && input.model && input.model.id }); } catch {}
+    },
     event: async (arg) => {
       try {
         const event = arg && arg.event;
-        if (event && event.type === "session.created") {
-          const info = (event.properties && event.properties.info) || {};
-          await runHook("session", { hook_event_name: "SessionStart", session_id: info.id, cwd, source: "startup", agent_family: "opencode" }, { kihDir: k, timeoutMs: 30000 });
-          return;
+        if (!event) return;
+        if (event.type === "session.created") {
+          const sid = event.properties && event.properties.info && event.properties.info.id;
+          await H.runHook("session", { hook_event_name: "SessionStart", session_id: sid, cwd, source: "startup", agent_family: "opencode" }, { kihDir: k, timeoutMs: 30000 });
+        } else if (event.type === "session.idle") {
+          const sid = event.properties && event.properties.sessionID;
+          await H.runHook("stop-archive", { hook_event_name: "Stop", session_id: sid, cwd, agent_family: "opencode" }, { kihDir: k, timeoutMs: 30000 });
         }
-        if (!event || event.type !== "session.idle") return;
-        const sid = event.properties && event.properties.sessionID;
-        await runHook("stop-archive", { hook_event_name: "Stop", session_id: sid, cwd, agent_family: "opencode" }, { kihDir: k, timeoutMs: 30000 });
       } catch {}
     },
   };
 };
 
-// Helpers for the selftest ride on the plugin function, never as module exports (OpenCode calls every export).
-WisdomKernel.internals = { TOOL_MAP, PRE_TIMEOUT_MS, toClaudeInput, claudeToolName, buildPreToolUsePayload,
-  buildPostToolUsePayload, resolveKihDir, runHook, isRefusal, refusalReason, hasPowerShell, pickHook };
+// Helpers live in ./wk-hook.js (lib/wk-hook.js in the package); OpenCode calls every export, so only the plugin is exported.
 
 export default WisdomKernel;