wkappbot-code 0.3.8 → 0.3.9

package/bin/wkappbot-code.js

@@ -189,6 +189,9 @@ function installBin(o) {
   log("bin: bash " + script + " acquire --dest " + dest);
   const r = spawnSync("bash", [shPath(script), "acquire", "--dest", shPath(dest)], { encoding: "utf8", env: shEnv() });
   for (const line of ((r.stdout || "") + (r.stderr || "")).split("\n").filter(Boolean)) log("  " + line);
+  // rc 3 = the release host could not be reached (a package-registry-only VM): no core, but NOT a failed install --
+  // the hooks and the lite harness need no core and still refuse the risky classes. A sha256 mismatch stays rc 1.
+  if (r.status === 3) return { ok: false, degraded: true, dest, note: "core not fetched (release host unreachable); hooks + lite harness run without it -- rerun wkappbot-code install once github.com is reachable" };
   if (r.status !== 0) return { ok: false, dest, note: "wk-bin-acquire rc " + r.status };
   // Put `wkappbot` on PATH beside wkappbot-code itself, unless that name is already taken by someone else.
   let link = "";
@@ -398,7 +401,8 @@ function install(o) {
   }
   const dest = binDest(o);
   st.bin = o.bin ? installBin(o) : { skipped: true, dest };
-  if (o.bin && !st.bin.ok) { bad++; log("bin: FAILED -- " + st.bin.note); }
+  if (o.bin && st.bin.degraded) log("bin: WARN -- " + st.bin.note);
+  else if (o.bin && !st.bin.ok) { bad++; log("bin: FAILED -- " + st.bin.note); }
   st.harness = o.harness ? installHarness(o) : { skipped: true };
   if (o.harness && !st.harness.ok) { bad++; log("harness: FAILED -- " + st.harness.note); }
   // The plugin entry names the harness the install just chose (a forced web harness wins over a checkout).
@@ -549,6 +553,7 @@ function doctor(o) {
   const dest = o.binDest ? resolve(o.binDest) : (st.bin && st.bin.dest) || binDest(o);
   let core = "";
   if (st.bin && st.bin.skipped) add("bin", false, "skipped (--no-bin)", false, true);
+  else if (st.bin && st.bin.degraded && !existsSync(dest)) add("bin", false, dest + " absent -- " + st.bin.note, false);
   else {
     const r = spawnSync(dest, ["--version"], { encoding: "utf8", timeout: 60000 });
     core = r.status === 0 ? (r.stdout || "").trim().split("\n")[0] : "";

package/lib/wk-bin-acquire.sh

@@ -100,18 +100,20 @@ default_dest_win() {
   fi
 }
 
-# sdk_fetch PLAT DIR -- prints the verified asset path, or returns 1 and prints nothing.
+# sdk_fetch PLAT DIR -- prints the verified asset path; else prints nothing and returns
+# 3 when a download failed (host unreachable, no such asset) or 4 when the asset is UNVERIFIED
+# (no SHA256SUMS line for it, or a sha256 mismatch). Only 3 may degrade an install to hooks-only.
 sdk_fetch() {
   command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "sdk_fetch" || true
   local plat="$1" dir="$2" asset base want got
   asset="wkappbot-$plat"
   base="${WK_BIN_BASE:-https://github.com/kiexpert/wkappbot-sdk/releases/latest/download}"
-  curl -fsSL -m 120 "$base/$asset" -o "$dir/$asset" || return 1
-  curl -fsSL -m 120 "$base/SHA256SUMS" -o "$dir/SHA256SUMS" || return 1
+  curl -fsSL -m "${WK_BIN_TIMEOUT:-120}" "$base/$asset" -o "$dir/$asset" || return 3
+  curl -fsSL -m "${WK_BIN_TIMEOUT:-120}" "$base/SHA256SUMS" -o "$dir/SHA256SUMS" || return 3
   want="$(awk -v f="$asset" '{ n = $2; sub(/^\*/, "", n); if (n == f) { print $1; exit } }' "$dir/SHA256SUMS")"
-  [ -n "$want" ] || return 1
+  [ -n "$want" ] || return 4
   got="$(sha_of "$dir/$asset" || true)"
-  [ "$got" = "$want" ] || return 1
+  [ "$got" = "$want" ] || return 4
   echo "$dir/$asset"
 }
 
@@ -147,12 +149,20 @@ install_file() {
 
 acquire_unix() {
   command -v wk_stopwatch_lap >/dev/null 2>&1 && wk_stopwatch_lap "acquire_unix" || true
-  local dest="$1" plat="$2" offline="$3" src label
+  local dest="$1" plat="$2" offline="$3" src="" label frc=3
   [ -n "$dest" ] || dest="$(default_dest_unix)"
-  if [ "$offline" = 0 ] && src="$(sdk_fetch "$plat" "$WK_TMP")"; then
+  if [ "$offline" = 0 ]; then src="$(sdk_fetch "$plat" "$WK_TMP")" && frc=0 || frc=$?; fi
+  if [ "$frc" = 0 ]; then
     label="SDK release wkappbot-$plat"
   else
     if [ "$offline" = 0 ]; then note "SDK asset unavailable or unverified, using repo bin/$plat"; fi
+    # EXIT 3 = NOTHING TO FETCH FROM, never a security refusal: the release host is unreachable (a
+    # package-registry-only VM) and no checkout holds a repo copy. The caller may then install hooks
+    # and the lite harness without the core. An UNVERIFIED asset (frc 4) still dies rc 1 below.
+    if [ -z "$REPO" ] && [ "$frc" = 3 ]; then
+      note "UNREACHABLE: no wkappbot-$plat could be downloaded from ${WK_BIN_BASE:-github.com/kiexpert/wkappbot-sdk releases} and no kih checkout holds bin/$plat; nothing installed"
+      exit 3
+    fi
     src="$(repo_file "$plat/wkappbot")"
     label="repo bin/$plat/wkappbot"
   fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wkappbot-code",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "description": "wkappbot-code -- Wisdom Kernel: the pinned OpenCode bridge plus the reflex harness plugin, the wkappbot core, the web harness and the latest public skills in one install",
   "type": "module",
   "scripts": {