wkappbot-code 0.3.8 → 0.3.10

package/bin/prepack.js

@@ -43,7 +43,9 @@ if (!existsSync(join(stage, "tools", "wkharness-lite.sh"))) die("the baked tree
 rmSync(OUT, { recursive: true, force: true });
 mkdirSync(OUT, { recursive: true });
 const tgz = join(OUT, "wk-harness-min.tar.gz");
-const t = spawnSync("tar", ["--exclude=./.git", "--exclude=./bin/linux-x64", "-czf", sh(tgz), "-C", sh(stage), "."], { encoding: "utf8" });
+// A RELATIVE archive name, run in OUT: GNU tar on Git for Windows reads "D:/a/..." as host "D" (rsh) and fails with
+// "Cannot connect to D: resolve failed" (SDK windows-latest 2026-11-06); bsdtar and GNU tar both take a relative -f.
+const t = spawnSync("tar", ["--exclude=./.git", "--exclude=./bin/linux-x64", "-czf", "wk-harness-min.tar.gz", "-C", sh(stage), "."], { encoding: "utf8", cwd: OUT });
 if (t.status !== 0) die("tar rc " + t.status + " " + t.stderr);
 const sha = createHash("sha256").update(readFileSync(tgz)).digest("hex");
 writeFileSync(tgz + ".sha256", sha + "  wk-harness-min.tar.gz\n");

package/bin/wkappbot-code.js

@@ -38,7 +38,7 @@ import {
 import { homedir, tmpdir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { quietCheck, runUpdate, updateRow } from "../lib/update.js";
+import { quietCheck, runUpdate, updateRow } from "../lib/update.js"; import { rmTreeHard } from "../lib/rmtree.js"; import { plainFileUrl } from "../lib/fileurl.js";
 import { applySets, askEach, buildConfig, configRow, detect, lineDiff, printDetected } from "../lib/config.js";
 
 const PKG_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "..");
@@ -48,8 +48,8 @@ const OWNER_LOGIN = "kiexpert";
 // The harness this package carries (harness/, baked by bin/prepack.js at pack time) comes first: it needs no checkout
 // and no network (spokesman 2026-11-06, a Default-environment VM). WK_HARNESS_BASE overrides; the web page serves an unbaked tree.
 const BUNDLED_HARNESS = () => join(PKG_DIR, "harness");
-const HARNESS_BASE = () => (process.env.WK_HARNESS_BASE || (existsSync(join(BUNDLED_HARNESS(), "install.sh")) ? pathToFileURL(BUNDLED_HARNESS()).href
-  : "https://kiexpert.github.io/wkappbot-kih/webvm/x64/harness")).replace(/\/+$/, "");
+const HARNESS_BASE = () => plainFileUrl(process.env.WK_HARNESS_BASE || (existsSync(join(BUNDLED_HARNESS(), "install.sh")) ? pathToFileURL(BUNDLED_HARNESS()).href
+  : "https://kiexpert.github.io/wkappbot-kih/webvm/x64/harness")).replace(/\/+$/, "");   // plainFileUrl: curl on Windows reads RUNNER%7E1 literally
 const HARNESS_DIR = () => process.env.WK_HARNESS_DIR || join(homedir(), ".wk-harness");
 const HOOKS_DIR = () => join(homedir(), ".wk-harness-hooks");   // tools/wk-global-hooks.sh install default
 const SETTINGS = () => process.env.WK_SETTINGS || join(homedir(), ".claude", "settings.json");
@@ -189,6 +189,9 @@ function installBin(o) {
   log("bin: bash " + script + " acquire --dest " + dest);
   const r = spawnSync("bash", [shPath(script), "acquire", "--dest", shPath(dest)], { encoding: "utf8", env: shEnv() });
   for (const line of ((r.stdout || "") + (r.stderr || "")).split("\n").filter(Boolean)) log("  " + line);
+  // rc 3 = the release host could not be reached (a package-registry-only VM): no core, but NOT a failed install --
+  // the hooks and the lite harness need no core and still refuse the risky classes. A sha256 mismatch stays rc 1.
+  if (r.status === 3) return { ok: false, degraded: true, dest, note: "core not fetched (release host unreachable); hooks + lite harness run without it -- rerun wkappbot-code install once github.com is reachable" };
   if (r.status !== 0) return { ok: false, dest, note: "wk-bin-acquire rc " + r.status };
   // Put `wkappbot` on PATH beside wkappbot-code itself, unless that name is already taken by someone else.
   let link = "";
@@ -368,7 +371,7 @@ function installPlugin(o, kih, kihSource) {
 // The machine state an uninstall must give back, recorded ONCE (a re-install never overwrites the first record, or
 // it would record our own dispatcher as the "prior" hooksPath). Shim paths are those install may create.
 function shimCandidates() {
-  return [join(linkDir(), "wkappbot"), join(HARNESS_LINKS(), "wkskill"), join(HARNESS_LINKS(), "wk-verify")];
+  return [join(linkDir(), "wkappbot"), join(HARNESS_LINKS(), "wkskill"), join(HARNESS_LINKS(), "wk-verify"), join(HARNESS_LINKS(), "wkskill.cmd"), join(HARNESS_LINKS(), "wk-verify.cmd")];   // Windows (Git Bash) .cmd twins from harness-install.sh: recorded like the rest, so uninstall removes them, never a user file
 }
 const PRE_SETTINGS = () => join(STATE_HOME(), "settings.pre-install.json");
 function recordPrior(prev) {
@@ -398,7 +401,8 @@ function install(o) {
   }
   const dest = binDest(o);
   st.bin = o.bin ? installBin(o) : { skipped: true, dest };
-  if (o.bin && !st.bin.ok) { bad++; log("bin: FAILED -- " + st.bin.note); }
+  if (o.bin && st.bin.degraded) log("bin: WARN -- " + st.bin.note);
+  else if (o.bin && !st.bin.ok) { bad++; log("bin: FAILED -- " + st.bin.note); }
   st.harness = o.harness ? installHarness(o) : { skipped: true };
   if (o.harness && !st.harness.ok) { bad++; log("harness: FAILED -- " + st.harness.note); }
   // The plugin entry names the harness the install just chose (a forced web harness wins over a checkout).
@@ -449,8 +453,10 @@ function uninstall(o) {
   if (!st.version) log("no install record at " + statePath(o) + "; removing only what is ours by name");
   // 1. global core.hooksPath back to its recorded value (only when it still points at a dir we wrote)
   const cur = globalHooksPath();
+  // REAL paths: macOS /var is a symlink to /private/var, so git and HOME may spell one dir two ways (SDK run 42252316617).
+  const real = (x) => { const r = resolve(x.replace(/^~(?=\/|$)/, homedir())); try { return realpathSync.native(r); } catch { return r; } };   // .native expands a Windows 8.3 name (RUNNER~1) that git config spells in the long form
   const oursHp = (p) => !!p && [HOOKS_DIR(), join(HARNESS_DIR(), ".githooks"), st.kihDir && join(st.kihDir, ".githooks")]
-    .filter(Boolean).some((x) => resolve(p.replace(/^~(?=\/|$)/, homedir())) === resolve(x));
+    .filter(Boolean).some((x) => real(p) === real(x));
   if (cur !== (pr.hooksPath ?? null) && (cur === null || oursHp(cur))) {
     const r = pr.hooksPath ? gitGlobal("core.hooksPath", pr.hooksPath) : gitGlobal("--unset", "core.hooksPath");
     log("hooksPath: " + (cur || "unset") + " -> " + (pr.hooksPath || "unset") + (r.status === 0 ? "" : " (git rc " + r.status + ")"));
@@ -489,11 +495,10 @@ function uninstall(o) {
     if (isSymlink(p) || existsSync(p)) { rmSync(p, { force: true }); log("shim: removed " + p); }
   }
   // 4. the harness dirs we created, the plugin entry and our config folder
-  // Windows releases a just-closed handle late (EBUSY/EPERM/ENOTEMPTY), so every tree delete retries and, when it
-  // still fails, names the path and goes on with the rest instead of aborting the uninstall half way.
+  // Windows frees a closed handle late (ENOTEMPTY): lib/rmtree.js retries ~6 s, then a per-entry pass names the blocker; a failure goes on.
   const rmTree = (p, what) => {
-    try { rmSync(p, { recursive: true, force: true, maxRetries: 10, retryDelay: 300 }); if (what) log(what + ": removed " + p); }
-    catch (e) { rc = 1; log((what || "remove") + ": could not remove " + p + " (" + (e.code || e.message) + ") -- delete it by hand"); }
+    const r = rmTreeHard(p); if (r.ok) { if (what) log(what + ": removed " + p); return; }
+    rc = 1; log((what || "remove") + ": could not remove " + p + " -- blocked by " + r.blockers.slice(0, 5).join("; ") + " -- delete it by hand");
   };
   if (st.harness && st.harness.mode === "web" && pr.harnessDirExisted !== true && existsSync(HARNESS_DIR())) rmTree(HARNESS_DIR(), "harness");
   if (pr.hooksDirExisted !== true && existsSync(HOOKS_DIR())) rmTree(HOOKS_DIR(), "push-gate");
@@ -549,6 +554,7 @@ function doctor(o) {
   const dest = o.binDest ? resolve(o.binDest) : (st.bin && st.bin.dest) || binDest(o);
   let core = "";
   if (st.bin && st.bin.skipped) add("bin", false, "skipped (--no-bin)", false, true);
+  else if (st.bin && st.bin.degraded && !existsSync(dest)) add("bin", false, dest + " absent -- " + st.bin.note, false);
   else {
     const r = spawnSync(dest, ["--version"], { encoding: "utf8", timeout: 60000 });
     core = r.status === 0 ? (r.stdout || "").trim().split("\n")[0] : "";

package/lib/fileurl.js

@@ -0,0 +1,12 @@
+// fileurl.js -- a file:// base that curl can open on every platform.
+// pathToFileURL percent-encodes "~" ("RUNNER~1" -> "RUNNER%7E1") and Windows curl does not decode a file:// path, so a
+// Windows profile with a short name, a space or a non-ASCII letter failed to read the harness. plainFileUrl hands curl the plain path.
+import { fileURLToPath } from "node:url";
+
+export function plainFileUrl(u) {
+  if (!/^file:\/\//i.test(u)) return u;
+  let p;
+  try { p = fileURLToPath(u); } catch { return u; }
+  p = p.replace(/\\/g, "/");
+  return "file://" + (p.startsWith("/") ? "" : "/") + p;
+}

package/lib/rmtree.js

@@ -0,0 +1,35 @@
+// rmtree.js -- delete a tree on a platform that releases a just-closed handle late (Windows: EBUSY/EPERM/ENOTEMPTY).
+// rmTreeHard(p, rm) -> { ok, blockers[] }: a long bounded retry first, then a per-entry pass that names what stays.
+import { existsSync, lstatSync, readdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+
+const sleepMs = (ms) => { try { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); } catch { /* no wait available */ } };
+
+// rm is injectable so the selftest can fake a held handle (default: fs.rmSync with Node's own retry)
+export function rmTreeHard(p, rm = (q, o) => rmSync(q, o), opts = {}) {
+  const tries = opts.tries || 6, gap = opts.gap || 1000;
+  const once = (q) => rm(q, { recursive: true, force: true, maxRetries: 10, retryDelay: 300 });
+  let last = null;
+  for (let i = 0; i < tries; i++) {
+    try { once(p); if (!existsSync(p)) return { ok: true, blockers: [] }; last = new Error("ENOTEMPTY"); }
+    catch (e) { last = e; }
+    sleepMs(gap);
+  }
+  // per-entry pass: remove what can go and name every entry (and nested file) that cannot
+  const blockers = [];
+  const walk = (d) => {
+    let names = [];
+    try { names = readdirSync(d); } catch (e) { blockers.push(d + " (" + (e.code || e.message) + ")"); return; }
+    for (const n of names) {
+      const q = join(d, n);
+      let dir = false; try { dir = lstatSync(q).isDirectory(); } catch { /* vanished */ }
+      if (dir) walk(q);
+      try { rm(q, { recursive: true, force: true }); } catch (e) { blockers.push(q + " (" + (e.code || e.message) + ")"); }
+    }
+  };
+  if (existsSync(p)) walk(p);
+  try { rm(p, { recursive: true, force: true }); } catch (e) { if (existsSync(p)) blockers.push(p + " (" + (e.code || e.message) + ")"); }
+  if (!existsSync(p)) return { ok: true, blockers: [] };
+  if (!blockers.length) blockers.push(p + " (" + ((last && (last.code || last.message)) || "not removed") + ")");
+  return { ok: false, blockers };
+}

package/lib/winpath.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+# winpath.sh -- sourced by selftest-opencode-e2e.sh and selftest-win-paths.sh. wk_winpath PATH prints the form a NATIVE
+# Windows program takes: `cygpath -m` (C:/x/y) when cygpath is on PATH, else PATH unchanged. A failed conversion also
+# leaves the path as it was. bash 3.2 safe (macOS /bin/bash).
+wk_winpath() {
+  local w
+  if command -v cygpath >/dev/null 2>&1; then
+    w="$(cygpath -m "$1" 2>/dev/null)"
+    if [ -n "$w" ]; then printf '%s\n' "$w"; return 0; fi
+  fi
+  printf '%s\n' "$1"
+}

package/lib/wk-bin-acquire.sh

@@ -100,18 +100,20 @@ default_dest_win() {
   fi
 }
 
-# sdk_fetch PLAT DIR -- prints the verified asset path, or returns 1 and prints nothing.
+# sdk_fetch PLAT DIR -- prints the verified asset path; else prints nothing and returns
+# 3 when a download failed (host unreachable, no such asset) or 4 when the asset is UNVERIFIED
+# (no SHA256SUMS line for it, or a sha256 mismatch). Only 3 may degrade an install to hooks-only.
 sdk_fetch() {
   command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "sdk_fetch" || true
   local plat="$1" dir="$2" asset base want got
   asset="wkappbot-$plat"
   base="${WK_BIN_BASE:-https://github.com/kiexpert/wkappbot-sdk/releases/latest/download}"
-  curl -fsSL -m 120 "$base/$asset" -o "$dir/$asset" || return 1
-  curl -fsSL -m 120 "$base/SHA256SUMS" -o "$dir/SHA256SUMS" || return 1
+  curl -fsSL -m "${WK_BIN_TIMEOUT:-120}" "$base/$asset" -o "$dir/$asset" || return 3
+  curl -fsSL -m "${WK_BIN_TIMEOUT:-120}" "$base/SHA256SUMS" -o "$dir/SHA256SUMS" || return 3
   want="$(awk -v f="$asset" '{ n = $2; sub(/^\*/, "", n); if (n == f) { print $1; exit } }' "$dir/SHA256SUMS")"
-  [ -n "$want" ] || return 1
+  [ -n "$want" ] || return 4
   got="$(sha_of "$dir/$asset" || true)"
-  [ "$got" = "$want" ] || return 1
+  [ "$got" = "$want" ] || return 4
   echo "$dir/$asset"
 }
 
@@ -147,12 +149,20 @@ install_file() {
 
 acquire_unix() {
   command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "acquire_unix" || true
-  local dest="$1" plat="$2" offline="$3" src label
+  local dest="$1" plat="$2" offline="$3" src="" label frc=3
   [ -n "$dest" ] || dest="$(default_dest_unix)"
-  if [ "$offline" = 0 ] && src="$(sdk_fetch "$plat" "$WK_TMP")"; then
+  if [ "$offline" = 0 ]; then src="$(sdk_fetch "$plat" "$WK_TMP")" && frc=0 || frc=$?; fi
+  if [ "$frc" = 0 ]; then
     label="SDK release wkappbot-$plat"
   else
     if [ "$offline" = 0 ]; then note "SDK asset unavailable or unverified, using repo bin/$plat"; fi
+    # EXIT 3 = NOTHING TO FETCH FROM, never a security refusal: the release host is unreachable (a
+    # package-registry-only VM) and no checkout holds a repo copy. The caller may then install hooks
+    # and the lite harness without the core. An UNVERIFIED asset (frc 4) still dies rc 1 below.
+    if [ -z "$REPO" ] && [ "$frc" = 3 ]; then
+      note "UNREACHABLE: no wkappbot-$plat could be downloaded from ${WK_BIN_BASE:-github.com/kiexpert/wkappbot-sdk releases} and no kih checkout holds bin/$plat; nothing installed"
+      exit 3
+    fi
     src="$(repo_file "$plat/wkappbot")"
     label="repo bin/$plat/wkappbot"
   fi

package/lib/wk-hook.js

@@ -164,13 +164,84 @@ export function refusalReason(r) {
 // a call in one of these classes is REFUSED instead of allowed: a public package must never let rm -rf HOME through
 // because pwsh happened to be missing. Returns the class label, or "".
 const HOME_T = /^(~|\$HOME|\$\{HOME\}|\/root|\/home\/[^/]+|\/Users\/[^/]+)\/?(\*|\.\*)?$/;
+// The shell line as the risk floor reads it. A heredoc body (after <<'TAG', <<TAG or <<-TAG, up to the line TAG) is
+// dropped, and a quoted string is ONE word with its quotes removed, so its text is never read as a git flag or a path.
+// Words handed to a shell (sh/bash -c, eval) are also returned in seg.inner and are checked again as a command line.
+const SHELL_NAME_RE = /^(sh|bash|zsh|dash|ksh)$/;
+export function shellSegments(cmd) {
+  const s = String(cmd || "");
+  const segs = [];
+  let seg = { words: [], inner: [], redirect: false };
+  let word = null, quote = "", pending = [], i = 0;
+  const add = (ch) => { word = (word === null ? "" : word) + ch; };
+  const endWord = () => {
+    if (word === null) return;
+    const head = seg.words[0] || "";
+    const prev = seg.words[seg.words.length - 1];
+    if ((prev === "-c" && SHELL_NAME_RE.test(head)) || head === "eval") seg.inner.push(word);
+    seg.words.push(word);
+    word = null;
+  };
+  const endSeg = () => {
+    endWord();
+    if (seg.words.length || seg.redirect) segs.push(seg);
+    seg = { words: [], inner: [], redirect: false };
+  };
+  while (i < s.length) {
+    const ch = s[i];
+    if (quote === "'") { if (ch === "'") quote = ""; else add(ch); i++; continue; }
+    if (quote === '"') {
+      if (ch === '"') quote = "";
+      else if (ch === "\\" && i + 1 < s.length && /["\\$`]/.test(s[i + 1])) { add(s[i + 1]); i++; }
+      else add(ch);
+      i++; continue;
+    }
+    if (ch === "'" || ch === '"') { quote = ch; if (word === null) word = ""; i++; continue; }
+    if (ch === "\\" && i + 1 < s.length) { add(s[i + 1]); i += 2; continue; }
+    if (ch === "<" && s[i + 1] === "<" && s[i + 2] !== "<") {
+      endWord();
+      let j = i + 2;
+      const dash = s[j] === "-";
+      if (dash) j++;
+      while (s[j] === " " || s[j] === "\t") j++;
+      let tag = "";
+      if (s[j] === "'" || s[j] === '"') { const q = s[j]; j++; while (j < s.length && s[j] !== q && s[j] !== "\n") tag += s[j++]; j++; }
+      else while (j < s.length && !/[\s;&|<>()'"]/.test(s[j])) tag += s[j++];
+      if (tag) pending.push({ tag, dash });
+      i = j; continue;
+    }
+    if (ch === "\n") {
+      endSeg(); i++;
+      for (const h of pending) {
+        for (;;) {
+          if (i >= s.length) break;
+          let e = s.indexOf("\n", i);
+          if (e < 0) e = s.length;
+          const line = s.slice(i, e).replace(/\r$/, "");
+          i = e + 1;
+          if ((h.dash ? line.replace(/^\t+/, "") : line) === h.tag) break;
+        }
+      }
+      pending = [];
+      continue;
+    }
+    if (/\s/.test(ch)) { endWord(); i++; continue; }
+    if (ch === ";" || ch === "|" || ch === "&" || ch === "(" || ch === ")") { endSeg(); i++; continue; }
+    if (ch === ">") { endWord(); seg.redirect = true; i++; continue; }
+    if (ch === "<") { endWord(); i++; continue; }
+    add(ch); i++;
+  }
+  endSeg();
+  return segs;
+}
+
 export function riskClass(tool, input, cwd) {
   const t = claudeToolName(tool);
   const i = input || {};
   if (t === "Bash") {
-    const c = String(i.command || "");
-    for (const seg of c.split(/&&|\|\||[;|\n]/)) {
-      const w = seg.trim().split(/\s+/).map((x) => x.replace(/^['"]|['"]$/g, ""));
+    for (const seg of shellSegments(i.command)) {
+      const w = seg.words;
+      for (const inner of seg.inner) { const r = riskClass(tool, { command: inner }, cwd); if (r) return r; }
       const gi = w.indexOf("git");
       if (gi >= 0) {
         const g = w.slice(gi + 1);
@@ -190,7 +261,7 @@ export function riskClass(tool, input, cwd) {
           if (tg.some((x) => /(^|\/)\.git(\/|$)/.test(x))) return "write under .git";
         }
       }
-      if (/(^|[\s/'"=>])\.git(\/|\s|$)/.test(seg) && (/>/.test(seg) || /^(rm|mv|cp|tee|truncate|dd|ln|chmod|sed)\b/.test(seg.trim()))) return "write under .git";
+      if (w.some((x) => /(^|\/)\.git(\/|$)/.test(x)) && (seg.redirect || /^(rm|mv|cp|tee|truncate|dd|ln|chmod|sed)$/.test(w[0] || ""))) return "write under .git";
     }
     return "";
   }
@@ -219,6 +290,21 @@ export function isFastRead(tool, input) {
   return true;
 }
 
+// SHIM PATH (SDK ROOT C 2026-11-06, run 42289814533): OpenCode's bash tool runs /bin/zsh on macOS, whose default PATH
+// has no ~/.local/bin, so "zsh:1: command not found: wkskill" and a Mac user could never pay the intent lock. A bash call
+// that names wkskill or wk-verify gets the shim dir (WK_LINK_DIR, else ~/.local/bin, where harness install.sh links
+// them) prepended to PATH for that one command; nothing else changes. Returns the command to run (unchanged when the
+// shim is absent or the command names neither shim).
+export function withShimPath(tool, args, linkDir) {
+  if (claudeToolName(tool) !== "Bash" || !args || typeof args.command !== "string") return args && args.command;
+  const c = args.command;
+  if (!/(^|[\s;&|(`])(wkskill|wk-verify)(\s|$)/.test(c)) return c;
+  const dir = linkDir || process.env.WK_LINK_DIR || join(homedir(), ".local", "bin");
+  if (!existsSync(join(dir, "wkskill")) && !existsSync(join(dir, "wk-verify"))) return c;
+  if (c.startsWith("PATH=")) return c;
+  return "PATH=" + JSON.stringify(dir) + ':"$PATH"; export PATH; ' + c;
+}
+
 // PER-CALL INJECTION (owner 2026-11-06: "so we must force our settings onto every model call OpenCode makes").
 // experimental.chat.system.transform appends RULES to the system array of EVERY model request, so a model that never
 // saw kih (Qwen, a fresh provider) still gets the reflex body. Short, fixed, no secrets. RULES_MARK makes the append
@@ -251,7 +337,9 @@ export function onLoadLines(kihDir) {
       res(lines.slice(0, 3).map((l) => l.slice(0, 240)));
     };
     try {
-      const c = spawn(cands.find((p) => p === "wkskill" || existsSync(p)), ["read", "on-load"], { stdio: ["ignore", "pipe", "ignore"] });
+      const target = cands.find((p) => p === "wkskill" || existsSync(p)), opt = { stdio: ["ignore", "pipe", "ignore"] };
+      // Windows: a shell-less spawn cannot run a .cmd shim, the bare wkskill name (PATHEXT) or an extensionless sh script
+      const c = process.platform !== "win32" ? spawn(target, ["read", "on-load"], opt) : /\.exe$/i.test(target) ? spawn(target, ["read", "on-load"], opt) : /\.(cmd|bat)$/i.test(target) || target === "wkskill" ? spawn(target, ["read", "on-load"], { ...opt, shell: true }) : spawn("sh", [target.replace(/\\/g, "/"), "read", "on-load"], opt);
       c.stdout.on("data", (d) => { out += d; if (out.length > 65536) c.kill("SIGKILL"); });
       c.on("error", finish); c.on("close", finish);
       setTimeout(() => { try { c.kill("SIGKILL"); } catch {} finish(); }, 8000).unref();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wkappbot-code",
-  "version": "0.3.8",
+  "version": "0.3.10",
   "description": "wkappbot-code -- Wisdom Kernel: the pinned OpenCode bridge plus the reflex harness plugin, the wkappbot core, the web harness and the latest public skills in one install",
   "type": "module",
   "scripts": {

package/plugin/wisdom-kernel.js

@@ -51,6 +51,8 @@ export const WisdomKernel = async (ctx = {}, options = {}) => {
             (tail ? ": " + tail : "") + ". Fix the harness (wkappbot-code doctor) and retry.");
         }
       }
+      // macOS /bin/zsh has no ~/.local/bin on PATH: a wkskill call gets the shim dir for that one command (lib/wk-hook.js).
+      try { if (args && typeof args.command === "string") args.command = H.withShimPath(inp.tool, args); } catch {}
     },
     "tool.execute.after": async (input, output) => {
       try {