wkappbot-code 0.3.7 → 0.3.9

package/bin/prepack.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+// prepack -- bakes the minimal web harness INTO the npm package (harness/), so `npm install wkappbot-code` wires the
+// Claude Code hooks from the package alone: no kih or WKAppBot checkout and no reach to the harness web page (a
+// Default-environment cloud VM allows the package registries and little else; spokesman order 2026-11-06).
+// harness/ holds the same four files the web page serves: install.sh, wk-harness-min.tar.gz, its .sha256, version.json.
+// The tarball is the manifest bake (tools/wk-harness-min-copy.sh, scrub gate included) minus .git and bin/linux-x64, the
+// core binary the installer fetches on its own (part: bin); 4 MB instead of 35 MB.
+// Env: WKAPPBOT_CODE_HARNESS_STAGE = an already baked tree to pack (selftest.sh bakes once per run; 50 s per pack saved).
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const PKG_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const KIH = resolve(PKG_DIR, "..");
+const OUT = join(PKG_DIR, "harness");
+const PKG = JSON.parse(readFileSync(join(PKG_DIR, "package.json"), "utf8"));
+const die = (m) => { console.error("[wkappbot-code prepack] " + m); process.exit(1); };
+const sh = (p) => process.platform === "win32" ? p.replace(/\\/g, "/") : p;
+
+let stage = process.env.WKAPPBOT_CODE_HARNESS_STAGE || "";
+let tmp = "";
+const copy = join(KIH, "tools", "wk-harness-min-copy.sh");
+const install = join(KIH, "webvm", "x64-build", "harness-install.sh");
+// A copy of the package packed OUTSIDE a kih checkout (the self-update selftest's tree) has nothing to bake from: it
+// packs without harness/ and its install falls back to the web harness. The publish packs from the checkout, and
+// selftest x16 refuses a tgz that carries no harness/.
+if (!existsSync(install) || (!stage && !existsSync(copy))) {
+  console.error("[wkappbot-code prepack] no kih checkout at " + KIH + ": harness/ not baked (install falls back to the web harness)");
+  process.exit(0);
+}
+if (!stage) {
+  tmp = mkdtempSync(join(tmpdir(), "wkc-prepack-"));
+  stage = join(tmp, "h");
+  const r = spawnSync("bash", [sh(copy), sh(KIH), sh(stage), sh(join(KIH, "tools", "wk-harness-min-manifest.txt"))],
+    { encoding: "utf8", env: { ...process.env, GIT_CONFIG_GLOBAL: "/dev/null" } });
+  if (r.status !== 0) die("harness bake rc " + r.status + "\n" + String(r.stderr).slice(-800));
+}
+if (!existsSync(join(stage, "tools", "wkharness-lite.sh"))) die("the baked tree " + stage + " has no tools/wkharness-lite.sh");
+
+rmSync(OUT, { recursive: true, force: true });
+mkdirSync(OUT, { recursive: true });
+const tgz = join(OUT, "wk-harness-min.tar.gz");
+const t = spawnSync("tar", ["--exclude=./.git", "--exclude=./bin/linux-x64", "-czf", sh(tgz), "-C", sh(stage), "."], { encoding: "utf8" });
+if (t.status !== 0) die("tar rc " + t.status + " " + t.stderr);
+const sha = createHash("sha256").update(readFileSync(tgz)).digest("hex");
+writeFileSync(tgz + ".sha256", sha + "  wk-harness-min.tar.gz\n");
+const count = (d) => readdirSync(d, { withFileTypes: true }).reduce((n, e) => n + (e.isDirectory() ? (e.name === ".git" ? 0 : count(join(d, e.name))) : 1), 0);
+writeFileSync(join(OUT, "version.json"), JSON.stringify({ version: "npm-" + PKG.version + "-" + sha.slice(0, 12), sha256: sha,
+  built: new Date().toISOString().replace(/\.\d+Z$/, "Z"), files: count(stage) }) + "\n");
+copyFileSync(install, join(OUT, "install.sh"));
+if (tmp) rmSync(tmp, { recursive: true, force: true });
+console.error("[wkappbot-code prepack] harness/ baked: " + sha.slice(0, 12) + " (" + readFileSync(tgz).length + " bytes)");

package/bin/wkappbot-code.js

@@ -45,7 +45,11 @@ const PKG_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const PKG = JSON.parse(readFileSync(join(PKG_DIR, "package.json"), "utf8"));
 const OPENCODE_VERSION = PKG.wkAppbotCode.opencodeVersion;
 const OWNER_LOGIN = "kiexpert";
-const HARNESS_BASE = () => (process.env.WK_HARNESS_BASE || "https://kiexpert.github.io/wkappbot-kih/webvm/x64/harness").replace(/\/+$/, "");
+// The harness this package carries (harness/, baked by bin/prepack.js at pack time) comes first: it needs no checkout
+// and no network (spokesman 2026-11-06, a Default-environment VM). WK_HARNESS_BASE overrides; the web page serves an unbaked tree.
+const BUNDLED_HARNESS = () => join(PKG_DIR, "harness");
+const HARNESS_BASE = () => (process.env.WK_HARNESS_BASE || (existsSync(join(BUNDLED_HARNESS(), "install.sh")) ? pathToFileURL(BUNDLED_HARNESS()).href
+  : "https://kiexpert.github.io/wkappbot-kih/webvm/x64/harness")).replace(/\/+$/, "");
 const HARNESS_DIR = () => process.env.WK_HARNESS_DIR || join(homedir(), ".wk-harness");
 const HOOKS_DIR = () => join(homedir(), ".wk-harness-hooks");   // tools/wk-global-hooks.sh install default
 const SETTINGS = () => process.env.WK_SETTINGS || join(homedir(), ".claude", "settings.json");
@@ -185,6 +189,9 @@ function installBin(o) {
   log("bin: bash " + script + " acquire --dest " + dest);
   const r = spawnSync("bash", [shPath(script), "acquire", "--dest", shPath(dest)], { encoding: "utf8", env: shEnv() });
   for (const line of ((r.stdout || "") + (r.stderr || "")).split("\n").filter(Boolean)) log("  " + line);
+  // rc 3 = the release host could not be reached (a package-registry-only VM): no core, but NOT a failed install --
+  // the hooks and the lite harness need no core and still refuse the risky classes. A sha256 mismatch stays rc 1.
+  if (r.status === 3) return { ok: false, degraded: true, dest, note: "core not fetched (release host unreachable); hooks + lite harness run without it -- rerun wkappbot-code install once github.com is reachable" };
   if (r.status !== 0) return { ok: false, dest, note: "wk-bin-acquire rc " + r.status };
   // Put `wkappbot` on PATH beside wkappbot-code itself, unless that name is already taken by someone else.
   let link = "";
@@ -394,7 +401,8 @@ function install(o) {
   }
   const dest = binDest(o);
   st.bin = o.bin ? installBin(o) : { skipped: true, dest };
-  if (o.bin && !st.bin.ok) { bad++; log("bin: FAILED -- " + st.bin.note); }
+  if (o.bin && st.bin.degraded) log("bin: WARN -- " + st.bin.note);
+  else if (o.bin && !st.bin.ok) { bad++; log("bin: FAILED -- " + st.bin.note); }
   st.harness = o.harness ? installHarness(o) : { skipped: true };
   if (o.harness && !st.harness.ok) { bad++; log("harness: FAILED -- " + st.harness.note); }
   // The plugin entry names the harness the install just chose (a forced web harness wins over a checkout).
@@ -485,8 +493,14 @@ function uninstall(o) {
     if (isSymlink(p) || existsSync(p)) { rmSync(p, { force: true }); log("shim: removed " + p); }
   }
   // 4. the harness dirs we created, the plugin entry and our config folder
-  if (st.harness && st.harness.mode === "web" && pr.harnessDirExisted !== true && existsSync(HARNESS_DIR())) { rmSync(HARNESS_DIR(), { recursive: true, force: true }); log("harness: removed " + HARNESS_DIR()); }
-  if (pr.hooksDirExisted !== true && existsSync(HOOKS_DIR())) { rmSync(HOOKS_DIR(), { recursive: true, force: true }); log("push-gate: removed " + HOOKS_DIR()); }
+  // Windows releases a just-closed handle late (EBUSY/EPERM/ENOTEMPTY), so every tree delete retries and, when it
+  // still fails, names the path and goes on with the rest instead of aborting the uninstall half way.
+  const rmTree = (p, what) => {
+    try { rmSync(p, { recursive: true, force: true, maxRetries: 10, retryDelay: 300 }); if (what) log(what + ": removed " + p); }
+    catch (e) { rc = 1; log((what || "remove") + ": could not remove " + p + " (" + (e.code || e.message) + ") -- delete it by hand"); }
+  };
+  if (st.harness && st.harness.mode === "web" && pr.harnessDirExisted !== true && existsSync(HARNESS_DIR())) rmTree(HARNESS_DIR(), "harness");
+  if (pr.hooksDirExisted !== true && existsSync(HOOKS_DIR())) rmTree(HOOKS_DIR(), "push-gate");
   const cfgFile = join(configDir(o), "opencode.json");
   try {
     const c = JSON.parse(readFileSync(cfgFile, "utf8"));
@@ -498,8 +512,8 @@ function uninstall(o) {
       log("config: plugin entry removed from " + cfgFile);
     }
   } catch {}
-  rmSync(STATE_HOME(), { recursive: true, force: true });
-  rmSync(join(configDir(o), "wkappbot-code"), { recursive: true, force: true });
+  rmTree(STATE_HOME());
+  rmTree(join(configDir(o), "wkappbot-code"));
   log("uninstall done. Kept: opencode-ai, the wkappbot core (" + ((st.bin && st.bin.dest) || binDest(o)) + ") and its skills, and this CLI (npm rm -g wkappbot-code)");
   return rc;
 }
@@ -539,6 +553,7 @@ function doctor(o) {
   const dest = o.binDest ? resolve(o.binDest) : (st.bin && st.bin.dest) || binDest(o);
   let core = "";
   if (st.bin && st.bin.skipped) add("bin", false, "skipped (--no-bin)", false, true);
+  else if (st.bin && st.bin.degraded && !existsSync(dest)) add("bin", false, dest + " absent -- " + st.bin.note, false);
   else {
     const r = spawnSync(dest, ["--version"], { encoding: "utf8", timeout: 60000 });
     core = r.status === 0 ? (r.stdout || "").trim().split("\n")[0] : "";

package/lib/wk-bin-acquire.sh

@@ -100,18 +100,20 @@ default_dest_win() {
   fi
 }
 
-# sdk_fetch PLAT DIR -- prints the verified asset path, or returns 1 and prints nothing.
+# sdk_fetch PLAT DIR -- prints the verified asset path; else prints nothing and returns
+# 3 when a download failed (host unreachable, no such asset) or 4 when the asset is UNVERIFIED
+# (no SHA256SUMS line for it, or a sha256 mismatch). Only 3 may degrade an install to hooks-only.
 sdk_fetch() {
   command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "sdk_fetch" || true
   local plat="$1" dir="$2" asset base want got
   asset="wkappbot-$plat"
   base="${WK_BIN_BASE:-https://github.com/kiexpert/wkappbot-sdk/releases/latest/download}"
-  curl -fsSL -m 120 "$base/$asset" -o "$dir/$asset" || return 1
-  curl -fsSL -m 120 "$base/SHA256SUMS" -o "$dir/SHA256SUMS" || return 1
+  curl -fsSL -m "${WK_BIN_TIMEOUT:-120}" "$base/$asset" -o "$dir/$asset" || return 3
+  curl -fsSL -m "${WK_BIN_TIMEOUT:-120}" "$base/SHA256SUMS" -o "$dir/SHA256SUMS" || return 3
   want="$(awk -v f="$asset" '{ n = $2; sub(/^\*/, "", n); if (n == f) { print $1; exit } }' "$dir/SHA256SUMS")"
-  [ -n "$want" ] || return 1
+  [ -n "$want" ] || return 4
   got="$(sha_of "$dir/$asset" || true)"
-  [ "$got" = "$want" ] || return 1
+  [ "$got" = "$want" ] || return 4
   echo "$dir/$asset"
 }
 
@@ -147,12 +149,20 @@ install_file() {
 
 acquire_unix() {
   command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "acquire_unix" || true
-  local dest="$1" plat="$2" offline="$3" src label
+  local dest="$1" plat="$2" offline="$3" src="" label frc=3
   [ -n "$dest" ] || dest="$(default_dest_unix)"
-  if [ "$offline" = 0 ] && src="$(sdk_fetch "$plat" "$WK_TMP")"; then
+  if [ "$offline" = 0 ]; then src="$(sdk_fetch "$plat" "$WK_TMP")" && frc=0 || frc=$?; fi
+  if [ "$frc" = 0 ]; then
     label="SDK release wkappbot-$plat"
   else
     if [ "$offline" = 0 ]; then note "SDK asset unavailable or unverified, using repo bin/$plat"; fi
+    # EXIT 3 = NOTHING TO FETCH FROM, never a security refusal: the release host is unreachable (a
+    # package-registry-only VM) and no checkout holds a repo copy. The caller may then install hooks
+    # and the lite harness without the core. An UNVERIFIED asset (frc 4) still dies rc 1 below.
+    if [ -z "$REPO" ] && [ "$frc" = 3 ]; then
+      note "UNREACHABLE: no wkappbot-$plat could be downloaded from ${WK_BIN_BASE:-github.com/kiexpert/wkappbot-sdk releases} and no kih checkout holds bin/$plat; nothing installed"
+      exit 3
+    fi
     src="$(repo_file "$plat/wkappbot")"
     label="repo bin/$plat/wkappbot"
   fi

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "wkappbot-code",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "description": "wkappbot-code -- Wisdom Kernel: the pinned OpenCode bridge plus the reflex harness plugin, the wkappbot core, the web harness and the latest public skills in one install",
   "type": "module",
   "scripts": {
+    "prepack": "node bin/prepack.js",
     "postinstall": "node bin/postinstall.js"
   },
   "bin": {
@@ -17,7 +18,8 @@
     "plugin/*.js",
     "opencode.json",
     "install.sh",
-    "README.md"
+    "README.md",
+    "harness/*"
   ],
   "wkAppbotCode": {
     "opencodeVersion": "1.19.5"