gm-codex 2.0.948 → 2.0.950

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-codex",
-  "version": "2.0.948",
+  "version": "2.0.950",
   "description": "State machine agent with hooks, skills, and automated git enforcement",
   "author": {
     "name": "AnEntrypoint",

package/bin/bootstrap.js

@@ -88,6 +88,43 @@ function readVersionFile(wrapperDir) {
   return fs.readFileSync(p, 'utf8').trim();
 }
 
+function readRtkVersion(wrapperDir) {
+  const p = path.join(wrapperDir, 'rtk.version');
+  if (!fs.existsSync(p)) return null;
+  const v = fs.readFileSync(p, 'utf8').trim();
+  return v || null;
+}
+
+function sha256OfFileSync(filePath) {
+  const h = crypto.createHash('sha256');
+  const fd = fs.openSync(filePath, 'r');
+  try {
+    const buf = Buffer.alloc(1024 * 1024);
+    for (;;) {
+      const n = fs.readSync(fd, buf, 0, buf.length, null);
+      if (n <= 0) break;
+      h.update(buf.subarray(0, n));
+    }
+  } finally { try { fs.closeSync(fd); } catch (_) {} }
+  return h.digest('hex');
+}
+
+function healIfShaMatches(binPath, expectedSha, sentinelPath, partialPath, kind) {
+  if (!fs.existsSync(binPath)) return false;
+  if (partialPath) { try { if (fs.existsSync(partialPath)) fs.unlinkSync(partialPath); } catch (_) {} }
+  if (!expectedSha) return false;
+  let got;
+  try { got = sha256OfFileSync(binPath); }
+  catch (_) { return false; }
+  if (got !== expectedSha) {
+    try { fs.unlinkSync(binPath); } catch (_) {}
+    return false;
+  }
+  try { fs.writeFileSync(sentinelPath, new Date().toISOString()); } catch (_) { return false; }
+  obsEvent('bootstrap', 'cache.heal', { path: binPath, kind });
+  return true;
+}
+
 function readShaManifest(wrapperDir, manifestName) {
   const p = path.join(wrapperDir, manifestName || 'plugkit.sha256');
   if (!fs.existsSync(p)) return null;
@@ -248,12 +285,15 @@ function isLockStale(lockPath) {
   return false;
 }
 
-function pruneOldVersions(root, keepVersion) {
+function pruneOldVersions(root, keepVersion, keepRtkVersion) {
   try {
     const entries = fs.readdirSync(root);
     for (const e of entries) {
-      if (!e.startsWith('v')) continue;
-      if (e === `v${keepVersion}`) continue;
+      const isPlugkit = e.startsWith('v') && !e.startsWith('rtk-');
+      const isRtk = e.startsWith('rtk-v');
+      if (!isPlugkit && !isRtk) continue;
+      if (isPlugkit && e === `v${keepVersion}`) continue;
+      if (isRtk && keepRtkVersion && e === `rtk-v${keepRtkVersion}`) continue;
       const dir = path.join(root, e);
       const lock = path.join(dir, '.lock');
       if (fs.existsSync(lock) && !isLockStale(lock)) continue;
@@ -283,10 +323,19 @@ async function bootstrap(opts) {
 
   const finalPath = path.join(verDir, binName);
   const okSentinel = path.join(verDir, '.ok');
+  const partialPath = `${finalPath}.partial`;
 
   if (fs.existsSync(finalPath) && fs.existsSync(okSentinel)) {
     if (!opts.silent) log(`cache hit: ${finalPath}`);
-    pruneOldVersions(root, version);
+    pruneOldVersions(root, version, readRtkVersion(wrapperDir));
+    return finalPath;
+  }
+
+  if (healIfShaMatches(finalPath, expectedSha, okSentinel, partialPath, 'plugkit')) {
+    if (!opts.silent) log(`cache heal (sha match): ${finalPath}`);
+    pruneOldVersions(root, version, readRtkVersion(wrapperDir));
+    try { await bootstrapRtk(verDir, version, wrapperDir, opts.silent, root); }
+    catch (err) { log(`rtk fetch skipped: ${err.message}`); }
     return finalPath;
   }
 
@@ -294,27 +343,33 @@ async function bootstrap(opts) {
   acquireLock(lockPath);
   try {
     if (fs.existsSync(finalPath) && fs.existsSync(okSentinel)) {
-      pruneOldVersions(root, version);
+      pruneOldVersions(root, version, readRtkVersion(wrapperDir));
+      return finalPath;
+    }
+    if (healIfShaMatches(finalPath, expectedSha, okSentinel, partialPath, 'plugkit')) {
+      log(`cache heal (sha match) under lock: ${finalPath}`);
+      pruneOldVersions(root, version, readRtkVersion(wrapperDir));
+      try { await bootstrapRtk(verDir, version, wrapperDir, opts.silent, root); }
+      catch (err) { log(`rtk fetch skipped: ${err.message}`); }
       return finalPath;
     }
 
-    const tmpPath = `${finalPath}.partial`;
-    if (fs.existsSync(tmpPath)) {
+    if (fs.existsSync(partialPath)) {
       try {
-        const st = fs.statSync(tmpPath);
+        const st = fs.statSync(partialPath);
         if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
-          fs.unlinkSync(tmpPath);
-          log(`cleared stale partial: ${tmpPath}`);
+          fs.unlinkSync(partialPath);
+          log(`cleared stale partial: ${partialPath}`);
         }
       } catch (_) {}
     }
     const url = `https://github.com/${RELEASE_REPO}/releases/download/v${version}/${binName}`;
-    await downloadWithRetry(url, tmpPath);
+    await downloadWithRetry(url, partialPath);
 
     if (expectedSha) {
-      const got = await sha256OfFile(tmpPath);
+      const got = await sha256OfFile(partialPath);
       if (got !== expectedSha) {
-        try { fs.unlinkSync(tmpPath); } catch (_) {}
+        try { fs.unlinkSync(partialPath); } catch (_) {}
         throw new Error(`sha256 mismatch for ${binName}: expected ${expectedSha}, got ${got}`);
       }
       log('sha256 verified');
@@ -322,11 +377,11 @@ async function bootstrap(opts) {
       log('no sha256 manifest — skipping verify');
     }
 
-    try { fs.renameSync(tmpPath, finalPath); }
+    try { fs.renameSync(partialPath, finalPath); }
     catch (err) {
       if (err.code === 'EEXIST' || err.code === 'EPERM') {
         try { fs.unlinkSync(finalPath); } catch (_) {}
-        fs.renameSync(tmpPath, finalPath);
+        fs.renameSync(partialPath, finalPath);
       } else throw err;
     }
 
@@ -337,10 +392,9 @@ async function bootstrap(opts) {
     fs.writeFileSync(okSentinel, new Date().toISOString());
     log(`installed ${finalPath}`);
     obsEvent('bootstrap', 'install.done', { path: finalPath, version, kind: 'plugkit' });
-    pruneOldVersions(root, version);
+    pruneOldVersions(root, version, readRtkVersion(wrapperDir));
     proactiveKillForNewInstall(version);
-    // Best-effort rtk fetch: failures here never block plugkit usage
-    try { await bootstrapRtk(verDir, version, wrapperDir, opts.silent); }
+    try { await bootstrapRtk(verDir, version, wrapperDir, opts.silent, root); }
     catch (err) { log(`rtk fetch skipped: ${err.message}`); }
     return finalPath;
   } finally {
@@ -348,10 +402,19 @@ async function bootstrap(opts) {
   }
 }
 
-async function bootstrapRtk(verDir, version, wrapperDir, silent) {
+function rtkCacheDir(root, wrapperDir, plugkitVerDir) {
+  const rtkVer = readRtkVersion(wrapperDir);
+  if (!rtkVer) return plugkitVerDir;
+  const dir = path.join(root, `rtk-v${rtkVer}`);
+  ensureDir(dir);
+  return dir;
+}
+
+async function bootstrapRtk(plugkitVerDir, plugkitVersion, wrapperDir, silent, root) {
   const rtkName = rtkBinaryName();
-  const rtkPath = path.join(verDir, rtkName);
-  const rtkOk = path.join(verDir, '.rtk-ok');
+  const cacheDir = rtkCacheDir(root || cacheRoot(), wrapperDir, plugkitVerDir);
+  const rtkPath = path.join(cacheDir, rtkName);
+  const rtkOk = path.join(cacheDir, '.rtk-ok');
   if (fs.existsSync(rtkPath) && fs.existsSync(rtkOk)) {
     if (!silent) log(`rtk cache hit: ${rtkPath}`);
     return rtkPath;
@@ -359,7 +422,11 @@ async function bootstrapRtk(verDir, version, wrapperDir, silent) {
   const rtkSha = readShaManifest(wrapperDir, 'rtk.sha256');
   const expected = rtkSha ? rtkSha[rtkName] : null;
   const tmp = `${rtkPath}.partial`;
-  const url = `https://github.com/${RELEASE_REPO}/releases/download/v${version}/${rtkName}`;
+  if (healIfShaMatches(rtkPath, expected, rtkOk, tmp, 'rtk')) {
+    if (!silent) log(`rtk cache heal (sha match): ${rtkPath}`);
+    return rtkPath;
+  }
+  const url = `https://github.com/${RELEASE_REPO}/releases/download/v${plugkitVersion}/${rtkName}`;
   await downloadWithRetry(url, tmp);
   if (expected) {
     const got = await sha256OfFile(tmp);
@@ -378,7 +445,7 @@ async function bootstrapRtk(verDir, version, wrapperDir, silent) {
   if (os.platform() !== 'win32') { try { fs.chmodSync(rtkPath, 0o755); } catch (_) {} }
   fs.writeFileSync(rtkOk, new Date().toISOString());
   log(`installed ${rtkPath}`);
-  obsEvent('bootstrap', 'install.done', { path: rtkPath, version, kind: 'rtk' });
+  obsEvent('bootstrap', 'install.done', { path: rtkPath, plugkit_version: plugkitVersion, rtk_version: readRtkVersion(wrapperDir) || plugkitVersion, kind: 'rtk' });
   return rtkPath;
 }
 
@@ -390,9 +457,10 @@ function resolveCachedRtk(opts) {
     try { const r = cacheRoot(); ensureDir(r); return r; }
     catch (_) { const r = fallbackCacheRoot(); ensureDir(r); return r; }
   })();
-  const verDir = path.join(root, `v${version}`);
-  const rtkPath = path.join(verDir, rtkBinaryName());
-  const rtkOk = path.join(verDir, '.rtk-ok');
+  const plugkitVerDir = path.join(root, `v${version}`);
+  const cacheDir = rtkCacheDir(root, wrapperDir, plugkitVerDir);
+  const rtkPath = path.join(cacheDir, rtkBinaryName());
+  const rtkOk = path.join(cacheDir, '.rtk-ok');
   if (fs.existsSync(rtkPath) && fs.existsSync(rtkOk)) return rtkPath;
   return null;
 }

package/bin/plugkit.sha256

@@ -1,6 +1,6 @@
-29c07cfbe1536e683a8892a2bfa459a879bd48bf0652adf606dea9a39e4d2fa7  plugkit-win32-x64.exe
-5523ce4c5167cfb01f2dc5a865daf8dfedde321393f8a02743f224cd0b6bf610  plugkit-win32-arm64.exe
-710fdb8a301c7b13b86677bbea64e2a54a092bb91c5fef0c8ec391795ab23202  plugkit-darwin-x64
-082d56484e02458bbc97ba63b89010fd155265e74cb17c7d227ed57dbcef96c3  plugkit-darwin-arm64
-b9d1f97cf048a9ab6345cd68177762a8603cd0f52e79e29c611cacb22adf02f7  plugkit-linux-x64
-6c64c385204b903d661002daf2e6b287082a02e579ce9c5533a24828765e46ab  plugkit-linux-arm64
+bbc4d0161be4088b66eea6cc3f7e463a43ab136f42da72d65953a68928fc5995  plugkit-win32-x64.exe
+291dafaab31076f25dd2e2a05a1a58db941465ea48762b7b029e4b309af1d63c  plugkit-win32-arm64.exe
+25cd1a010844e9a3652b9da382088500740b4773c11eea51a871b0d62d436327  plugkit-darwin-x64
+1d38873d0c3cb3317f1b8cab4b12f50631546af4edad3e88fecd870e6d344009  plugkit-darwin-arm64
+d5a94da58384f623aa05da0f77d3dd90d6d65a1d0de0ee718ceae522d9eef458  plugkit-linux-x64
+01d5b0f1f7476ae8dccf13e7fdcc7ec925f27456e76a54e886576d962f433f77  plugkit-linux-arm64

package/bin/plugkit.version

@@ -1 +1 @@
-0.1.321
+0.1.322

package/bin/rtk.sha256

@@ -1,5 +1,5 @@
-67e7f3aa39ab54376f90d040820ae471adc47374b0b9fa2527a09de9be73216b  rtk-win32-x64.exe
-7f0ce6ff2ae933fd82c5d309df3e06f2ba12b2a47b495ed54a8eacb096ef5264  rtk-win32-arm64.exe
+15d0b8abcf02d4b5c246370ad63f4948ed38855696e429d752edea1edb819dae  rtk-win32-x64.exe
+9a035ec6e0a49c6986defb7495731785b9adfe3cb4a5d2180231bb418de266c7  rtk-win32-arm64.exe
 1b1e792767ed0e1e6ca0e2f0a8de02e77b06dea2f5ae667278b94baf239fcdc3  rtk-darwin-x64
 9717978d9d6216ea50c94444e00e359479b6315a17bd48c16064b267c8b0b60d  rtk-darwin-arm64
 a100d3defac54194144e5723aec57e6f286b42298c67145c8428815246c9ee56  rtk-linux-x64

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.948",
+  "version": "2.0.950",
   "description": "State machine agent with hooks, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",
@@ -23,5 +23,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "plugkitVersion": "0.1.321"
+  "plugkitVersion": "0.1.322"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-codex",
-  "version": "2.0.948",
+  "version": "2.0.950",
   "description": "State machine agent with hooks, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.948",
+  "version": "2.0.950",
   "description": "State machine agent with hooks, skills, and automated git enforcement",
   "author": {
     "name": "AnEntrypoint",