feat(cli): rename command to opk (#48)

VERSION

@@ -1 +1 @@
-0.0.24
+0.0.25

docs/concepts/ddev-integration.md

@@ -192,7 +192,7 @@ elevation path** (`ddev hostname <name> 127.0.0.1` as your user →
 `ddev-hostname.exe` → the Windows permission dialog):
 
 ```bash
-opencode-permissions-kit ddev-hosts-add          # in the project dir
+opk ddev-hosts-add          # in the project dir
 ```
 
 It adds every hostname missing from
@@ -202,10 +202,10 @@ under the default `*.ddev.site` TLD are never touched: ddev's public
 wildcard DNS already resolves them, no hosts entry is needed. After
 `ddev start`/`restart` the kit's `ddev()` shell function prints the
 missing hostnames with one ready-made command each —
-`opencode-permissions-kit ddev-hosts-add <hostname>` also works
+`opk ddev-hosts-add <hostname>` also works
 standalone from anywhere, so you add exactly what was reported;
 `ddev-hosts-check` lists them on demand, and
-`opencode-permissions-kit status` reports them per project root (its
+`opk status` reports them per project root (its
 scan skips `vendor/`, `node_modules/` and `testdata/` — packages and
 test fixtures ship their own `.ddev` dirs that are not your projects).
 
@@ -252,7 +252,7 @@ sudo sh /usr/local/lib/opencode-permissions-kit/ddev-migrate.sh import
 ddev start <project> && ddev import-db <project> --file=<dump>.sql.gz
 ```
 
-`opencode-permissions-kit status` lists dumps still waiting for import.
+`opk status` lists dumps still waiting for import.
 Only each project's **default** database is exported; extra named
 databases need a manual `ddev export-db --database=<name>` on the old
 side — do that **before** the `.ddev` handover made your side

docs/concepts/sharing-group.md

@@ -60,5 +60,5 @@ soft `.git/config` deny — see
 If group bits drift (e.g. after unpacking an archive as root), re-apply:
 
 ```bash
-opencode-permissions-kit update --refresh
+opk update --refresh
 ```

docs/getting-started.md

@@ -85,7 +85,7 @@ wrapper. Same-shell fix: `hash -r` and
 Run the status script:
 
 ```bash
-opencode-permissions-kit status
+opk status
 ```
 
 It reports the protection mode, backend + socket reachability, ddev runtime

docs/how-to/dev-owned-projects.md

@@ -48,14 +48,14 @@ Fresh installs already have it on (recommended default). On an existing
 install:
 
 ```bash
-sudo opencode-permissions-kit config ddev-settings on
-sudo opencode-permissions-kit config refresh   # flags existing projects + hands back
+sudo opk config ddev-settings on
+sudo opk config refresh   # flags existing projects + hands back
 ```
 
 Per project (faster, no full baseline):
 
 ```bash
-sudo opencode-permissions-kit config handover /var/www/vhosts/<project>
+sudo opk config handover /var/www/vhosts/<project>
 ```
 
 **Commit the added `disable_settings_management: true` line** — it is
@@ -92,7 +92,7 @@ hand-write the include (design plan, open extension).
 ## Disable it
 
 ```bash
-sudo opencode-permissions-kit config ddev-settings off
+sudo opk config ddev-settings off
 ```
 
 Stops future flag writes. Already-committed flags stay (repo content) —

docs/how-to/manage-projects.md

@@ -10,7 +10,7 @@ inside one of these directories or their subdirectories.
 ## Add a project directory
 
 ```bash
-opencode-permissions-kit config projects add /var/www/vhosts/new-project
+opk config projects add /var/www/vhosts/new-project
 ```
 
 Multiple paths at once are fine, and `~` works. System paths (`/`, `/usr`,
@@ -32,13 +32,13 @@ sudo setfacl -R -d -m g:opencode:rwx /var/www/vhosts/new-project
 ## List configured directories
 
 ```bash
-opencode-permissions-kit config projects list
+opk config projects list
 ```
 
 ## Remove a project directory
 
 ```bash
-opencode-permissions-kit config projects remove /var/www/vhosts/old-project
+opk config projects remove /var/www/vhosts/old-project
 ```
 
 Only the `projects.conf` line is removed; files and their group bits stay as

docs/how-to/secure-git-config.md

@@ -19,9 +19,9 @@ curl -fsSL https://raw.githubusercontent.com/steffenmaechtel/opencode-permission
 Later, at any time:
 
 ```bash
-opencode-permissions-kit config git-config on
-opencode-permissions-kit config git-config off
-opencode-permissions-kit config git-config status
+opk config git-config on
+opk config git-config off
+opk config git-config status
 ```
 
 `on` re-renders the agent's `opencode.jsonc` with the deny rules (the

docs/how-to/switch-container-backend.md

@@ -7,13 +7,13 @@ The backend is configured at install time (`--container-backend
 docker-rootless|podman-rootless`) and can be switched at any time:
 
 ```bash
-opencode-permissions-kit config container-backend podman-rootless
+opk config container-backend podman-rootless
 ```
 
 Check the current backend and socket state:
 
 ```bash
-opencode-permissions-kit config container-backend status
+opk config container-backend status
 ```
 
 ## What the switch does

docs/how-to/uninstall.md

@@ -6,7 +6,7 @@ stays behind.
 ## Run the uninstall
 
 ```bash
-opencode-permissions-kit uninstall
+opk uninstall
 ```
 
 Run it as your default user (it asks for `sudo` where needed). Options:

docs/how-to/update.md

@@ -21,18 +21,18 @@ curl -fsSL https://raw.githubusercontent.com/steffenmaechtel/opencode-permission
 `update.sh` re-deploys the kit files and refreshes the `install.conf` version
 stamp. It does **not** touch `projects.conf` or
 `/home/opencode/.config/opencode/opencode.jsonc` — your project list and
-deny-list customizations survive. Since this update (kit 0.0.14) the
-`opencode-permissions-kit` command (see [CLI](../reference/cli.md)) exists —
+deny-list customizations survive. Since kit 0.0.14 the
+`opk` command (see [CLI](../reference/cli.md)) exists —
 future updates work without the curl one-liner:
 
 ```bash
-opencode-permissions-kit update
+opk update
 ```
 
 To re-apply the group baseline (chgrp/setgid/default ACLs) as well:
 
 ```bash
-opencode-permissions-kit update --refresh
+opk update --refresh
 ```
 
 ## Upgrade the opencode binary
@@ -43,10 +43,10 @@ the bundled config sets `autoupdate: false`, and `update.sh` is the upgrade
 entry point:
 
 ```bash
-opencode-permissions-kit upgrade-opencode                 # latest release
-opencode-permissions-kit upgrade-opencode --binary-path ./opencode  # specific file
+opk upgrade-opencode                 # latest release
+opk upgrade-opencode --binary-path ./opencode  # specific file
 # equivalent long form:
-opencode-permissions-kit update --only-binary
+opk update --only-binary
 ```
 
 Binary upgrades are best-effort: a failure leaves the current binary in
@@ -55,7 +55,7 @@ place, the previous one is kept in `/tmp/opencode-upgrade-backup-*`.
 ## Verify
 
 ```bash
-opencode-permissions-kit status
+opk status
 ```
 
 `status.sh` shows the deployed version and the backend state after the

docs/reference/cli.md

@@ -2,20 +2,20 @@
 
 This page lists the kit's commands and flags.
 
-## The `opencode-permissions-kit` command
+## The `opk` command
 
 After installation, one command manages everything (works from anywhere in
 your WSL/Linux system):
 
 ```bash
-opencode-permissions-kit status
-opencode-permissions-kit config projects add /var/www/vhosts/new-project
-opencode-permissions-kit update --binary
-opencode-permissions-kit upgrade-opencode   # just the opencode binary
-opencode-permissions-kit ddev-hosts-add     # in a ddev project dir
-opencode-permissions-kit handover me .gotmp # mixed-owner tree -> yours again
-opencode-permissions-kit uninstall
-opencode-permissions-kit help        # commands + arguments overview
+opk status
+opk config projects add /var/www/vhosts/new-project
+opk update --binary
+opk upgrade-opencode   # just the opencode binary
+opk ddev-hosts-add     # in a ddev project dir
+opk handover me .gotmp # mixed-owner tree -> yours again
+opk uninstall
+opk help        # commands + arguments overview
 ```
 
 Everything after the subcommand goes to the underlying script unchanged,
@@ -24,9 +24,11 @@ elevate via sudo automatically; `status` needs no sudo; `uninstall` runs as
 your user and asks for sudo itself; `ddev-hosts-*` run as your user (they
 drive Windows-side elevation through ddev itself).
 
-The command is a symlink (`/usr/local/bin/opencode-permissions-kit`) into
-the kit library — deployed since kit 0.0.14. On older installs, run
-[update](../how-to/update.md) once to get it. The direct script calls below
+The command is a symlink (`/usr/local/bin/opk`) into
+the kit library — deployed since kit 0.0.14 as `opencode-permissions-kit`
+and renamed to `opk` (issue #48). On older installs, run
+[update](../how-to/update.md) once to switch to the new name — it creates
+`opk` and removes the old long-name symlink. The direct script calls below
 keep working everywhere.
 
 ## handover
@@ -38,13 +40,13 @@ Switch file ownership between the two kit users — you and the agent:
 # cache now contains files of both users and every build complains
 # ("chmod ... Operation not permitted"). Make the whole tree yours again:
 cd /var/www/vhosts/ddev
-opencode-permissions-kit handover me .gotmp
+opk handover me .gotmp
 
 # Same idea the other way — give a folder to the agent user:
-opencode-permissions-kit handover opencode /var/www/vhosts/some-project/
+opk handover opencode /var/www/vhosts/some-project/
 
 # Not sure yet? Show what would happen, without sudo:
-opencode-permissions-kit handover me .gotmp --dry-run
+opk handover me .gotmp --dry-run
 ```
 
 `me` and `opencode` resolve to your default user and the agent user from
@@ -67,8 +69,8 @@ the Windows hosts file — your Windows browser cannot resolve custom-
 agent never gets hosts-file access.
 
 ```bash
-opencode-permissions-kit ddev-hosts-check   # what is missing?
-opencode-permissions-kit ddev-hosts-add     # add it (Windows asks permission)
+opk ddev-hosts-check   # what is missing?
+opk ddev-hosts-add     # add it (Windows asks permission)
 ```
 
 `ddev-hosts-add` runs `ddev hostname <name> 127.0.0.1` as your user for
@@ -84,7 +86,7 @@ entry is needed (the per-hostname commands the status and the `ddev()`
 hook print include the name, so you add exactly what was reported:
 
 ```bash
-opencode-permissions-kit ddev-hosts-add my-fancy-project.local
+opk ddev-hosts-add my-fancy-project.local
 ```
 
 works from anywhere). The status scan also skips `vendor/` and
@@ -149,7 +151,7 @@ curl -fsSL https://raw.githubusercontent.com/steffenmaechtel/opencode-permission
 | `--only-binary` | Skip every kit step, only upgrade the opencode binary |
 | `--binary-path <file>` | Install a specific binary file instead |
 
-`opencode-permissions-kit upgrade-opencode` is the shorthand for
+`opk upgrade-opencode` is the shorthand for
 `update --yes --only-binary` — extra flags (e.g. `--binary-path`) pass
 through.
 

docs/reference/files.md

@@ -43,7 +43,7 @@ This page lists every file and directory the kit manages, and every key in
 | Path | Purpose |
 |---|---|
 | `/usr/local/bin/opencode` | Wrapper symlink |
-| `/usr/local/bin/opencode-permissions-kit` | CLI dispatcher symlink (see [CLI](cli.md)) |
+| `/usr/local/bin/opk` | CLI dispatcher symlink (see [CLI](cli.md)) |
 | `/usr/local/lib/opencode-permissions-kit/kit` | CLI dispatcher (status/config/update/uninstall routing) |
 | `/usr/local/lib/opencode-permissions-kit/bin/opencode` | The actual opencode binary (`root:opencode` 750) |
 | `/usr/local/lib/opencode-permissions-kit/bin/socket-check.sh` | Rootless socket probe (`test -S` only) |

docs/troubleshooting.md

@@ -169,7 +169,7 @@ owner-only on Linux.
 **Fix:** run the handover (fast — one project, no group baseline):
 
 ```bash
-sudo opencode-permissions-kit config handover /var/www/vhosts/<project>
+sudo opk config handover /var/www/vhosts/<project>
 ```
 
 (or `update.sh` / `config.sh refresh` to re-run it over every registered
@@ -221,12 +221,12 @@ shows its permission dialog:
 
 ```bash
 cd /var/www/vhosts/<project>
-opencode-permissions-kit ddev-hosts-add
+opk ddev-hosts-add
 ```
 
 `ddev-hosts-check` lists what is missing (one ready-made
 `ddev-hosts-add <hostname>` command each — that form works from
-anywhere); `opencode-permissions-kit status` reports it per project
+anywhere); `opk status` reports it per project
 root. Manual fallback: edit
 `C:\Windows\System32\drivers\etc\hosts` in an elevated editor and add
 `127.0.0.1 <project>.<tld>`. Hostnames under the default `*.ddev.site`

files/config.sh

@@ -536,8 +536,8 @@ ddev_settings_apply() {
         DDEV_DEV_OWNED=true
         ui_success "ddev-settings on — dev-owned projects (recommended)"
         ui_info "existing projects get the flag + handback on the next scan. Run:"
-        ui_detail "sudo opencode-permissions-kit config refresh"
-        ui_detail "(or per project: sudo opencode-permissions-kit config handover <path>)"
+        ui_detail "sudo opk config refresh"
+        ui_detail "(or per project: sudo opk config handover <path>)"
         ui_detail "commit the added disable_settings_management line in each repo."
     else
         update_install_conf_ddev_owned false

files/install.sh

@@ -470,7 +470,7 @@ if id "$OPENCODE_USER" >/dev/null 2>&1 || [ -f /etc/opencode-permissions-kit/ins
     if [ "$INTERACTIVE" = true ]; then
         # Convention: docs/design/conventions.md — [Y/n] via ui_confirm.
         if ! ui_confirm "Re-configure the existing installation with install.sh?" "y"; then
-            ui_info "Aborted — run: opencode-permissions-kit update"
+            ui_info "Aborted — run: opk update"
             exit 0
         fi
     fi
@@ -1262,10 +1262,11 @@ sudo ln -sf "$LIBDIR/wrapper" /usr/local/bin/opencode
 ui_success "wrapper installed: /usr/local/bin/opencode -> $LIBDIR/wrapper"
 log "wrapper symlink: /usr/local/bin/opencode -> $LIBDIR/wrapper"
 
-# CLI dispatcher: /usr/local/bin/opencode-permissions-kit -> kit
-sudo ln -sf "$LIBDIR/kit" /usr/local/bin/opencode-permissions-kit
-ui_success "cli installed: opencode-permissions-kit -> $LIBDIR/kit"
-log "cli symlink: /usr/local/bin/opencode-permissions-kit -> $LIBDIR/kit"
+# CLI dispatcher: /usr/local/bin/opk -> kit
+sudo rm -f /usr/local/bin/opencode-permissions-kit
+sudo ln -sf "$LIBDIR/kit" /usr/local/bin/opk
+ui_success "cli installed: opk -> $LIBDIR/kit"
+log "cli symlink: /usr/local/bin/opk -> $LIBDIR/kit"
 
 # sudoers -> /etc/opencode-permissions-kit/sudoers, symlinked as /etc/sudoers.d/opencode-permissions-kit
 SUDO_TMP=$(mktemp)
@@ -1569,7 +1570,7 @@ echo ""
 ui_info "Next:"
 ui_detail "opencode                       start the agent (new terminal!)"
 [ -n "$DD_MIG_DUMP_DIR" ] && ui_detail "ddev-migrate.sh import          re-import your ddev databases (first start pulls images)"
-ui_detail "opencode-permissions-kit status   verify the protection"
-ui_detail "opencode-permissions-kit config   change settings later (or update/uninstall)"
+ui_detail "opk status   verify the protection"
+ui_detail "opk config   change settings later (or update/uninstall)"
 ui_detail "Docs:  https://github.com/steffenmaechtel/opencode-permissions-kit/blob/master/docs/README.md"
 log "install complete"

files/opencode-deny-all.jsonc

@@ -15,7 +15,7 @@
     // locks out the bypass mode. The agent runs as its own user and reads:
     //   /home/opencode/.config/opencode/opencode.jsonc
     // Edit that file (you are in its sharing group) or run
-    // `opencode-permissions-kit config` to change settings.
+    // `opk config` to change settings.
     "share": "disabled",
     "permission": { "*": "deny" }
 }

files/opencode-permissions-kit-lib/ddev-as-opencode.sh

@@ -136,7 +136,7 @@ _opk_hosts_hint() {
     echo "  add them (Windows asks for permission, one command each —"
     echo "  you see exactly what gets added):"
     for _opk_h in $_opk_miss; do
-        echo "    opencode-permissions-kit ddev-hosts-add $_opk_h"
+        echo "    opk ddev-hosts-add $_opk_h"
     done
     return 0
 }
@@ -170,7 +170,7 @@ _opk_bootstrap_hint() {
     echo "  the root belongs to you, ddev runs as opencode). Hand it over once"
     echo "  (the kit hands it back after install):"
     echo ""
-    echo "    sudo opencode-permissions-kit config handover $PWD"
+    echo "    sudo opk config handover $PWD"
     # Dev-owned mode: the same command also writes
     # disable_settings_management: true (the durable fix — ddev then never
     # touches paths outside .ddev/, the root stays yours permanently).