fix(wget): drop unsupported wget package

README.md

@@ -165,7 +165,6 @@ Browse pre-built agents, tools, filesystems, and software packages at the [agent
 | `@agentos-software/tar` | tar | GNU tar archiver | rust | - | - |
 | `@agentos-software/tree` | tree | tree directory listing | rust | - | - |
 | `@agentos-software/unzip` | unzip | unzip archive extraction | c | - | - |
-| `@agentos-software/wget` | wget | GNU wget HTTP client | c | - | - |
 | `@agentos-software/yq` | yq | yq YAML/JSON processor | rust | - | - |
 | `@agentos-software/zip` | zip | zip archive creation | c | - | - |
 

docs-internal/registry-parity-worklist.md

@@ -88,7 +88,7 @@ actual backing:
 | Command | Status | What it actually is | Replace with |
 |---|---|---|---|
 | **curl** | TODO | our custom driver over a libcurl fork | real `curl` CLI (upstream `src/tool_*.c`) |
-| **wget** | TODO | our 174-line `wget.c` | real GNU wget, or drop (curl covers it) |
+| **wget** | NOT POSSIBLE (WASI) | our 174-line `wget.c` | dropped; real `curl` covers network downloads |
 | **http-get** | TODO | our 95-line `http_get.c` | drop, or a real tool |
 | **git** | TODO | our hand-rolled git from `sha1`+`flate2` | **real git** (upstream C), patched for WASI — **NOT gitoxide** |
 | **fd** | TODO | our `secureexec-fd` on raw `regex` (not sharkdp/fd) | real **fd** (sharkdp) |
@@ -233,14 +233,28 @@ so a reader sees the whole board at a glance.
 
 ## P2 — Build / compile failures
 
-### 8. wget — does not compile (`duplicate symbol: getpeername`)
-- **Broken:** link error — wget's stub `getpeername` collides with the patched
-  sysroot's socket impl.
-- **Objective:** wget compiles cleanly against the patched sysroot (drop the stub;
-  use the real sysroot socket symbols) **and** downloads files e2e like Linux wget.
-- **Proof:** `make -C toolchain cmd/wget` succeeds; `software/wget/test/` passes
-  un-skipped (real download over the runtime network).
-- **rev:** `fix(wget): drop conflicting getpeername stub; build against sysroot sockets`
+### 8. wget — NOT POSSIBLE (WASI)
+- **Broken:** the shipped command was a custom 174-line `wget.c` wrapper, not real
+  GNU Wget. The original compile failure was a duplicate socket stub, but fixing
+  that would still leave a custom reimplementation, violating Cross-cutting #0.
+- **Tried:** GNU Wget 1.24.5 was configured for `wasm32-wasip1` with HTTP-only
+  features (`--without-ssl --without-zlib --without-libpsl --disable-iri`
+  and related auth/thread options disabled) against the patched sysroot. It
+  needed WASI patches for `inet_addr`, `O_BINARY`, process-group terminal checks,
+  `spawn.h`/`--use-askpass`, interactive `getpass`, gnulib `NSIG`, `F_DUPFD`, and
+  `flock`, then continued into more gnulib replacements requiring unsupported
+  `getrlimit`/`RLIMIT_NOFILE` and incompatible `getgroups` declarations.
+- **Outcome:** dropped the `wget` package and runtime command instead of shipping
+  another custom shim. The real upstream `curl` CLI built in #6 is the supported
+  network downloader.
+- **Proof:** `pnpm --dir packages/shell check-types` passes in
+  `2026-07-08T01-28-53-0700-item8-shell-check-types.txt`;
+  `pnpm --dir packages/runtime-core check-types` passes in
+  `2026-07-08T01-28-53-0700-item8-runtime-core-check-types.txt`;
+  `pnpm --dir packages/core check-types` passes in
+  `2026-07-08T01-28-54-0700-item8-core-check-types.txt`; lockfile validation
+  passes in `2026-07-08T01-29-03-0700-item8-pnpm-lockfile-check.txt`.
+- **rev:** `mxkxpnpn` — `fix(wget): drop unsupported wget package`
 
 ### 9. codex-cli — not buildable in-checkout (needs external fork)
 - **Broken:** requires the external `codex-rs` fork (`CODEX_REPO` absent); tests
@@ -268,14 +282,13 @@ so a reader sees the whole board at a glance.
 For each: replace `describe.skip` with `describeIf(binaryPresent)` **and** write
 real e2e tests that prove Linux-parity behavior — not smoke tests.
 
-### 11. Disabled suites — git, duckdb, wget, codex
+### 11. Disabled suites — git, duckdb, codex
 - **Broken:** tests exist but are `describe.skip`, so nothing runs even when the
   binary is present.
 - **Objective (per command, Linux parity):**
   - **git** — clone/commit/log/diff/branch against a real repo & remote.
   - **duckdb** — real analytical SQL, CSV read/write, file-backed DBs (the bar
     example: real duckdb, not a WASI-stripped `SELECT 1`).
-  - **wget** — real download (after #8).
   - **codex** — real run (after #9).
 - **Proof:** each un-skipped suite passes with real behavior.
 - **rev:** one per command, e.g. `test(duckdb): real analytical-SQL e2e; un-skip`
@@ -306,6 +319,5 @@ real e2e tests that prove Linux-parity behavior — not smoke tests.
 ## Sequencing note
 
 P0 first — several P1/P3 items depend on it: curl (#6) needs sockets/HTTP;
-sqlite3 file-DB tests (#11) need pwrite (#4); wget (#8) needs sockets. Fix the
-runtime layer, then the commands that ride on it, then backfill coverage. One jj
-rev per item throughout.
+sqlite3 file-DB tests (#11) need pwrite (#4). Fix the runtime layer, then the
+commands that ride on it, then backfill coverage. One jj rev per item throughout.

docs/wasmvm/supported-commands.md

@@ -213,7 +213,6 @@
 | Command | just-bash | Status | Implementation | Target |
 |---------|-----------|--------|----------------|--------|
 | curl | yes | done | `curl_cli.c` (libcurl HTTP-only, C program via `host_net`) | — |
-| wget | yes | done | `wget.c` (libcurl-based, C program via `host_net`) | — |
 
 ## Version Control
 

packages/core/src/runtime-compat.ts

@@ -1460,7 +1460,6 @@ export const WASMVM_COMMANDS = Object.freeze([
 	"unzip",
 	"sqlite3",
 	"curl",
-	"wget",
 	"git",
 	"git-remote-http",
 	"git-remote-https",
@@ -1629,7 +1628,6 @@ export const DEFAULT_FIRST_PARTY_TIERS: Readonly<
 	tac: "read-only",
 	tsort: "read-only",
 	curl: "full",
-	wget: "full",
 	sqlite3: "read-write",
 });
 

packages/core/tests/helpers/registry-commands.ts

@@ -13,7 +13,7 @@
  * command set still fails loudly.
  *
  * The only sanctioned exception is the C-sysroot package set (duckdb,
- * http-get, sqlite3, wget, zip, unzip): those need the patched wasi C sysroot
+ * http-get, sqlite3, zip, unzip): those need the patched wasi C sysroot
  * that most checkouts don't have, so `cSysrootPackageSkipReason` reports a
  * skip reason instead of throwing. Everything else is load-or-throw.
  */
@@ -161,7 +161,7 @@ export function requireBuilt<T extends RegistryPackageRef>(
 
 /**
  * Skip reason for the C-sysroot package set ONLY (duckdb, http-get, sqlite3,
- * wget, zip, unzip). These need the patched wasi C sysroot
+ * zip, unzip). These need the patched wasi C sysroot
  * (`make -C toolchain/c`), which most checkouts don't build — a missing
  * artifact is an environment limitation, not a forgotten build, so suites may
  * skip with this reason instead of throwing.

packages/runtime-core/src/test-runtime.ts

@@ -1587,7 +1587,6 @@ export const WASMVM_COMMANDS = Object.freeze([
 	"unzip",
 	"sqlite3",
 	"curl",
-	"wget",
 	"git",
 	"git-remote-http",
 	"git-remote-https",
@@ -1756,7 +1755,6 @@ export const DEFAULT_FIRST_PARTY_TIERS: Readonly<
 	tac: "read-only",
 	tsort: "read-only",
 	curl: "full",
-	wget: "full",
 	sqlite3: "read-write",
 });
 

packages/shell/package.json

@@ -35,7 +35,6 @@
 		"@agentos-software/tree": "workspace:*",
 		"@agentos-software/unzip": "workspace:*",
 		"@agentos-software/vim": "workspace:*",
-		"@agentos-software/wget": "workspace:*",
 		"@agentos-software/yq": "workspace:*",
 		"@agentos-software/zip": "workspace:*",
 		"@rivet-dev/agentos": "workspace:*",

software/CONTRIBUTING.md

@@ -34,7 +34,7 @@ From the repo root:
 
 ```bash
 just toolchain-build            # compile the fast native wasm command gate
-just toolchain-cmd <name> # build one command (required for git, duckdb, vim, wget, codex)
+just toolchain-cmd <name> # build one command (required for git, duckdb, vim, codex)
 just software-build <pkg>       # stage bin/ + assemble dist/package/
 pnpm --filter './software/*' test
 ```

software/README.md

@@ -68,7 +68,7 @@ per-binary entry point; it dispatches to whichever toolchain owns the command:
 | kind | commands | what it runs |
 |---|---|---|
 | Rust | any `software/<pkg>/native/crates/cmd-<name>` command crate (sh, ls, rg, …) | `cargo build -p cmd-<name>` (build-std) + `wasm-opt` |
-| C | `zip unzip envsubst sqlite3 curl wget duckdb` | `make -C c sysroot build/<src>` + per-command install |
+| C | `zip unzip envsubst sqlite3 curl duckdb` | `make -C c sysroot build/<src>` + per-command install |
 | codex | `codex`, `codex-exec` | the codex fork build (needs the fork checkout) |
 | C | `vim` (pinned upstream clone + bridge in `c/vim/`) | `make -C c sysroot build/vim` + install |
 
@@ -77,7 +77,7 @@ The default native build (`toolchain`) compiles the fast command gate to
 `wasm-opt -O3`, and drops the binaries in
 `toolchain/target/wasm32-wasip1/release/commands/`. The bulk gate
 intentionally excludes slow/heavy or non-default commands: `git`, `duckdb`,
-`vim`, `wget`, and the external `codex`/`codex-exec` fork build. Build those explicitly with
+`vim` and the external `codex`/`codex-exec` fork build. Build those explicitly with
 `just toolchain-cmd <name>` when working on them. Package builds then run
 `agentos-toolchain stage` (with `--if-missing skip`, so a checkout without the
 native build still assembles valid empty placeholders) followed by `tsc` and
@@ -90,7 +90,7 @@ packages are pnpm workspace members, so tests and examples resolve them via
 Exceptions:
 - `software/codex/wasm/` is the install target of the codex fork's build
   (`make -C toolchain codex`); `software/codex-cli` stages from it.
-- C-built commands (sqlite3, zip, unzip, curl, wget, duckdb) need the patched
+- C-built commands (sqlite3, zip, unzip, curl, duckdb) need the patched
   sysroot; `just toolchain-cmd <name>` builds it on demand. Without it
   those packages stay empty placeholders.
 - `vim` builds from source: `just toolchain-cmd vim` clones the pinned