gm-copilot-cli 2.0.1069 → 2.0.1071

package/copilot-profile.md

@@ -1,6 +1,6 @@
 ---
 name: gm
-version: 2.0.1069
+version: 2.0.1071
 description: Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement
 author: AnEntrypoint
 repository: https://github.com/AnEntrypoint/gm-copilot-cli

package/index.html

@@ -74,7 +74,7 @@ body { display: flex; flex-direction: column; min-height: 100vh; }
 <section>
   <div class="gm-section-label"><span class="slash">//</span>status</div>
   <div class="panel">
-    <div class="panel-head"><span>release · v2.0.1069</span><span>probably emerging</span></div>
+    <div class="panel-head"><span>release · v2.0.1071</span><span>probably emerging</span></div>
     <div class="panel-body">
       <div class="row">
         <span class="code"><span style="color:var(--panel-accent)">●</span></span>

package/lib/wasm-host.js

@@ -0,0 +1,241 @@
+const fs = require('fs');
+const path = require('path');
+const { execSync, spawnSync } = require('child_process');
+const fetch = (...args) => import('node-fetch').then(({ default: fetch }) => fetch(...args));
+
+class WasmHost {
+  constructor(wasmPath) {
+    this.wasmPath = wasmPath;
+    this.instance = null;
+    this.memory = null;
+  }
+
+  async init() {
+    try {
+      const wasmBuffer = fs.readFileSync(this.wasmPath);
+      const wasmModule = new WebAssembly.Module(wasmBuffer);
+
+      const importObject = {
+        host: {
+          host_fs_read: this.hostFsRead.bind(this),
+          host_fs_write: this.hostFsWrite.bind(this),
+          host_fs_readdir: this.hostFsReaddir.bind(this),
+          host_fs_stat: this.hostFsStat.bind(this),
+          host_kv_get: this.hostKvGet.bind(this),
+          host_kv_put: this.hostKvPut.bind(this),
+          host_kv_query: this.hostKvQuery.bind(this),
+          host_fetch: this.hostFetch.bind(this),
+          host_vec_search: this.hostVecSearch.bind(this),
+          host_vec_embed: this.hostVecEmbed.bind(this),
+          host_browser_spawn: this.hostBrowserSpawn.bind(this),
+          host_browser_eval: this.hostBrowserEval.bind(this),
+          host_browser_close: this.hostBrowserClose.bind(this),
+          host_exec_js: this.hostExecJs.bind(this),
+          host_log: this.hostLog.bind(this),
+          host_now_ms: this.hostNowMs.bind(this),
+          host_env_get: this.hostEnvGet.bind(this),
+        },
+        env: {
+          memory: new WebAssembly.Memory({ initial: 256, maximum: 512 }),
+        }
+      };
+
+      this.instance = new WebAssembly.Instance(wasmModule, importObject);
+      this.memory = importObject.env.memory;
+      return { ok: true };
+    } catch (err) {
+      return { ok: false, error: err.message };
+    }
+  }
+
+  readString(offset, len) {
+    const buf = new Uint8Array(this.memory.buffer, offset, len);
+    return new TextDecoder().decode(buf);
+  }
+
+  writeString(str) {
+    const encoder = new TextEncoder();
+    const encoded = encoder.encode(str);
+    const len = encoded.length;
+    const offset = this.instance.exports.plugkit_alloc(len);
+    const buf = new Uint8Array(this.memory.buffer, offset, len);
+    buf.set(encoded);
+    return [offset, len];
+  }
+
+  hostFsRead(pathPtr, pathLen) {
+    try {
+      const pathStr = this.readString(pathPtr, pathLen);
+      const content = fs.readFileSync(pathStr, 'utf8');
+      const [offset, len] = this.writeString(content);
+      return offset;
+    } catch (err) {
+      return 0;
+    }
+  }
+
+  hostFsWrite(pathPtr, pathLen, dataPtr, dataLen) {
+    try {
+      const pathStr = this.readString(pathPtr, pathLen);
+      const data = this.readString(dataPtr, dataLen);
+      fs.writeFileSync(pathStr, data, 'utf8');
+      return 1;
+    } catch (err) {
+      return 0;
+    }
+  }
+
+  hostFsReaddir(pathPtr, pathLen) {
+    try {
+      const pathStr = this.readString(pathPtr, pathLen);
+      const entries = fs.readdirSync(pathStr);
+      const result = JSON.stringify(entries);
+      const [offset] = this.writeString(result);
+      return offset;
+    } catch (err) {
+      return 0;
+    }
+  }
+
+  hostFsStat(pathPtr, pathLen) {
+    try {
+      const pathStr = this.readString(pathPtr, pathLen);
+      const stat = fs.statSync(pathStr);
+      const result = JSON.stringify({
+        isFile: stat.isFile(),
+        isDirectory: stat.isDirectory(),
+        size: stat.size,
+        mtime: stat.mtime.getTime(),
+      });
+      const [offset] = this.writeString(result);
+      return offset;
+    } catch (err) {
+      return 0;
+    }
+  }
+
+  hostKvGet(keyPtr, keyLen) {
+    return 0;
+  }
+
+  hostKvPut(keyPtr, keyLen, valPtr, valLen) {
+    return 1;
+  }
+
+  hostKvQuery(queryPtr, queryLen) {
+    return 0;
+  }
+
+  hostFetch(urlPtr, urlLen, optsPtr, optsLen) {
+    return 0;
+  }
+
+  hostVecSearch(queryPtr, queryLen) {
+    return 0;
+  }
+
+  hostVecEmbed(textPtr, textLen) {
+    return 0;
+  }
+
+  hostBrowserSpawn(urlPtr, urlLen) {
+    return 0;
+  }
+
+  hostBrowserEval(sessionPtr, sessionLen, jsPtr, jsLen) {
+    return 0;
+  }
+
+  hostBrowserClose(sessionPtr, sessionLen) {
+    return 1;
+  }
+
+  hostExecJs(codePtr, codeLen) {
+    try {
+      const code = this.readString(codePtr, codeLen);
+      const result = eval(`(${code})`);
+      const [offset] = this.writeString(JSON.stringify(result));
+      return offset;
+    } catch (err) {
+      return 0;
+    }
+  }
+
+  hostLog(msgPtr, msgLen) {
+    const msg = this.readString(msgPtr, msgLen);
+    console.log(msg);
+    return 1;
+  }
+
+  hostNowMs() {
+    return Date.now();
+  }
+
+  hostEnvGet(keyPtr, keyLen) {
+    const key = this.readString(keyPtr, keyLen);
+    const val = process.env[key] || '';
+    const [offset] = this.writeString(val);
+    return offset;
+  }
+
+  async dispatch(verb, body) {
+    if (!this.instance) {
+      const initResult = await this.init();
+      if (!initResult.ok) return initResult;
+    }
+
+    try {
+      const bodyStr = typeof body === 'string' ? body : JSON.stringify(body);
+      const [verbOffset, verbLen] = this.writeString(verb);
+      const [bodyOffset, bodyLen] = this.writeString(bodyStr);
+
+      const resultPtr = this.instance.exports.dispatch_verb(verbOffset, verbLen, bodyOffset, bodyLen);
+      if (resultPtr === 0) {
+        return { ok: false, error: 'dispatch_verb returned null' };
+      }
+
+      const resultStr = this.readString(resultPtr, 1024);
+      try {
+        return JSON.parse(resultStr);
+      } catch {
+        return { ok: true, output: resultStr };
+      }
+    } catch (err) {
+      return { ok: false, error: err.message };
+    }
+  }
+
+  async hook(name, body) {
+    if (!this.instance) {
+      const initResult = await this.init();
+      if (!initResult.ok) return initResult;
+    }
+
+    try {
+      const bodyStr = typeof body === 'string' ? body : JSON.stringify(body);
+      const [nameOffset, nameLen] = this.writeString(name);
+      const [bodyOffset, bodyLen] = this.writeString(bodyStr);
+
+      const hookFn = this.instance.exports[`hook_${name}`];
+      if (!hookFn) {
+        return { ok: false, error: `hook_${name} not found` };
+      }
+
+      const resultPtr = hookFn(bodyOffset, bodyLen);
+      if (resultPtr === 0) {
+        return { ok: false, error: `hook_${name} returned null` };
+      }
+
+      const resultStr = this.readString(resultPtr, 1024);
+      try {
+        return JSON.parse(resultStr);
+      } catch {
+        return { ok: true, output: resultStr };
+      }
+    } catch (err) {
+      return { ok: false, error: err.message };
+    }
+  }
+}
+
+module.exports = WasmHost;

package/manifest.yml

@@ -1,5 +1,5 @@
 name: gm
-version: 2.0.1069
+version: 2.0.1071
 description: Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement
 author: AnEntrypoint
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-copilot-cli",
-  "version": "2.0.1069",
+  "version": "2.0.1071",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",

package/skills/code-search/SKILL.md

@@ -5,7 +5,7 @@ description: Mandatory codebase search workflow. Use whenever you need to find a
 
 # Codebase search
 
-`exec:codesearch` is the only codebase search tool. Grep, Glob, Find, Explore, raw `grep`/`rg`/`find` inside `exec:bash` are all hook-blocked. No fallback.
+`exec:codesearch` is the only codebase search tool. Never use Grep, Glob, Find, Explore, raw `grep`/`rg`/`find` inside `exec:bash`. No fallback.
 
 A `@<discipline>` first-token after the verb scopes the search to that discipline's index; absent the sigil, results fan across default plus enabled disciplines, prefixed by source.
 

package/skills/gm-complete/SKILL.md

@@ -26,7 +26,7 @@ Failure triage: broken output to EMIT, wrong logic to EXECUTE, new unknown to PL
 - `git_clean` — `git status --porcelain` returns empty
 - `git_pushed` — `git log origin/main..HEAD --oneline` returns empty
 - `ci_passed` — every GitHub Actions run reaches `conclusion: success`
-- `mutables_resolved` — `.gm/mutables.yml` deleted OR every entry `status: witnessed`. Stop hook hard-blocks turn-stop while any entry is `status: unknown`.
+- `mutables_resolved` — `.gm/mutables.yml` deleted OR every entry `status: witnessed`. Never stop the turn while any entry is `status: unknown` — this gate is self-enforced.
 - `prd_empty` — `.gm/prd.yml` deleted AFTER residual scan: enumerate every in-spirit reachable residual surfaced this session; any hit re-enters `planning`, appends PRD items, executes. Empty PRD is necessary, not sufficient — done = empty PRD AND zero reachable in-spirit residuals. Out-of-spirit-or-unreachable residuals are named in the response and skipped; everything else is this turn's work.
 - `stress_suite_clear` — change walked through M1–D1 (governance), none flunked
 - `hidden_decision_posture` — open → down_weighted → closed only when CI is green AND stress suite is clear
@@ -81,7 +81,7 @@ Both must return empty. Local commit without push is not complete.
 
 ## CI is automated
 
-The Stop hook watches Actions for the pushed HEAD. Do not call `gh run list` manually. All-green → Stop approves with CI summary in next-turn context. Failure → Stop blocks with run names + IDs; investigate via `gh run view <id> --log-failed`, fix, push, hook re-watches. Deadline 180s (override `GM_CI_WATCH_SECS`); slow jobs get a "still in progress" approve.
+After `git push`, poll `gh run list --branch main --limit 5 --json status,name,databaseId` until all runs reach a terminal state. Green → continue; failure → investigate via `gh run view <id> --log-failed`, fix, push again. Deadline 180s (override `GM_CI_WATCH_SECS`). Poll every 10s via a nodejs spool file with a `setInterval` loop writing results to stdout.
 
 ## Hygiene sweep
 

package/skills/gm-emit/SKILL.md

@@ -49,7 +49,7 @@ Re-import from disk — in-memory state is stale and inadmissible. Run identical
 
 ## Mutables gate
 
-Before pre-emit run, read `.gm/mutables.yml`. Any entry with `status: unknown` → regress to `gm-execute`. The pre-tool-use hook hard-blocks Write/Edit/NotebookEdit while unresolved entries exist; trying to emit anyway returns deny. Zero unresolved is the precondition for every legitimacy question below.
+Before pre-emit run, read `.gm/mutables.yml`. Any entry with `status: unknown` → regress to `gm-execute`. Never use Write/Edit/NotebookEdit while unresolved entries exist — this gate is self-enforced. Zero unresolved is the precondition for every legitimacy question below.
 
 ## Gate (all true at once)
 

package/skills/gm-execute/SKILL.md

@@ -30,7 +30,7 @@ Resolves to KNOWN only when all four pass:
 
 Unresolved after 2 passes regresses to `planning`. Never narrate past an unresolved mutable.
 
-Every witness that resolves a mutable writes back to `.gm/mutables.yml` the same step: set `status: witnessed` and fill `witness_evidence` with concrete proof (file:line, codesearch hit, exec output snippet). No write-back = the mutable stays unknown and the EMIT-gate stays closed. The hook reads this file; the agent's memory of "I resolved it" does not unblock anything.
+Every witness that resolves a mutable writes back to `.gm/mutables.yml` the same step: set `status: witnessed` and fill `witness_evidence` with concrete proof (file:line, codesearch hit, exec output snippet). No write-back = the mutable stays unknown and the EMIT-gate stays closed. The file is the record; the agent's memory of "I resolved it" does not count.
 
 Route candidates from PLAN are `weak_prior` only. Plausibility is the right to test, not the right to believe. A claim with no witness in the current session is a hypothesis — say so when stating it, and say what would settle it. The next reader (you, next turn) needs to know which lines were earned and which were carried forward.
 
@@ -44,13 +44,13 @@ Code AND utility verbs both run through the file-spool. Write a file to `.gm/exe
 
 Pack runs: `Promise.allSettled`, each idea own try/catch, under 12s per call. Runner: write `in/runner/<N>.txt` with body `start` | `stop` | `status`.
 
-Every exec daemonizes. The hook tails the task logfile up to 30s wall-clock and returns whatever is there — short tasks complete inside the window and look synchronous; long tasks return a task_id with partial output. Continue with `exec:tail` (drain, bounded), `exec:watch` (resume blocking until match or timeout), or `exec:close` (terminate). Never re-spawn a long task to check on it — that orphans the first one. `exec:wait` is a pure timer; `exec:sleep` blocks on a specific task's output; `exec:watch` is the match-or-timeout primitive. Every execution-platform RPC returns the live list of running tasks for this session — close stragglers via `exec:close\n<id>` so the list stays scannable. Session-end (clear/logout/prompt_input_exit) kills the session's tasks; compaction/handoff preserves them.
+Every exec daemonizes. The spool watcher tails the task logfile up to 30s wall-clock and returns whatever is there — short tasks complete inside the window and look synchronous; long tasks return a task_id with partial output. Continue with `exec:tail` (drain, bounded), `exec:watch` (resume blocking until match or timeout), or `exec:close` (terminate). Never re-spawn a long task to check on it — that orphans the first one. `exec:wait` is a pure timer; `exec:sleep` blocks on a specific task's output; `exec:watch` is the match-or-timeout primitive. Every execution-platform RPC returns the live list of running tasks for this session — close stragglers via `exec:close\n<id>` so the list stays scannable. Session-end (clear/logout/prompt_input_exit) kills the session's tasks; compaction/handoff preserves them.
 
-Every utility verb dispatches via `in/<verb>/<N>.txt`; the body of the file is the verb's argument. There is no inline form and no Bash-prefix form — both are denied by the hook.
+Every utility verb dispatches via `in/<verb>/<N>.txt`; the body of the file is the verb's argument. There is no inline form and no Bash-prefix form — use only the spool path.
 
 ## Codebase search
 
-Codesearch only. Grep, Glob, Find, Explore, raw grep/rg/find inside Bash are all hook-blocked. Write query to `.gm/exec-spool/in/codesearch/<N>.txt`. Read result from `.gm/exec-spool/out/<N>.out`.
+Codesearch only. Never use Grep, Glob, Find, Explore, raw grep/rg/find inside Bash. Write query to `.gm/exec-spool/in/codesearch/<N>.txt`. Read result from `.gm/exec-spool/out/<N>.out`.
 
 Start two words, change/add one per pass, minimum four attempts before concluding absent. Known absolute path → `Read`. Known directory → nodejs spool file + `fs.readdirSync`.
 
@@ -80,4 +80,4 @@ Up to 3 `gm:gm` subagents for independent items in one message. Browser escalati
 
 ## CI is automated
 
-`git push` triggers the Stop hook to watch Actions for the pushed HEAD on the same repo (downstream cascades are not auto-watched). Green → Stop approves with summary; failure → run names + IDs surfaced, investigate via `gh run view <id> --log-failed`. Deadline 180s (override `GM_CI_WATCH_SECS`).
+After `git push`, poll `gh run list --branch main --limit 5 --json status,name,databaseId` until all runs reach a terminal state. Green → continue; failure → investigate via `gh run view <id> --log-failed`, fix, push again. Deadline 180s (override `GM_CI_WATCH_SECS`). Poll every 10s via a nodejs spool file with a `setInterval` loop writing results to stdout.

package/skills/planning/SKILL.md

@@ -77,7 +77,7 @@ Plan exits when zero new unknowns surfaced last pass AND every item has acceptan
 
 ## .gm/mutables.yml — co-equal with .gm/prd.yml
 
-Every unknown surfaced during PLAN lands as an entry in `.gm/mutables.yml` the same pass. Live during work, deleted when empty. Hook-gated: Write/Edit/NotebookEdit and `git commit`/`git push` are hard-blocked while any entry has `status: unknown`; turn-stop is hard-blocked the same way.
+Every unknown surfaced during PLAN lands as an entry in `.gm/mutables.yml` the same pass. Live during work, deleted when empty. Self-enforced: never use Write/Edit/NotebookEdit, never run `git commit`/`git push`, never stop the turn while any entry has `status: unknown`. This discipline is owned by the agent — not by external infrastructure.
 
 ```yaml
 - id: kebab-id
@@ -143,7 +143,7 @@ The 200 lines are a *budget* for maximum surface coverage, not a target. Subsyst
 
 Code execution AND utility verbs both write to `.gm/exec-spool/in/<lang-or-verb>/<N>.<ext>`. Languages live under `in/<lang>/` (nodejs, python, bash, typescript, go, rust, c, cpp, java, deno); verbs live under `in/<verb>/` (codesearch, recall, memorize, wait, sleep, status, close, browser, runner, type, kill-port, forget, feedback, learn-status, learn-debug, learn-build, discipline, pause, health). The spool watcher runs the file and streams to `out/<N>.out` (stdout) + `out/<N>.err` (stderr) line-by-line, then writes `out/<N>.json` metadata (exitCode, durationMs, timedOut, startedAt, endedAt) at completion. Both streams return as systemMessage with `--- stdout ---` / `--- stderr ---` separators. `in/` and `out/` are wiped at session start and at real-exit session end. Only `git` (and `gh`) run directly via Bash; never `Bash(node/npm/npx/bun)`, never `Bash(exec:<anything>)`. Spool paths in nodejs files are platform-literal — use `os.tmpdir()` and `path.join`. The spool enforces per-task timeouts; on timeout, partial output is preserved and the watcher emits `[exec timed out after Nms; partial output above]`.
 
-Codesearch only — Grep/Glob/Find/Explore are hook-blocked. Write to `.gm/exec-spool/in/codesearch/<N>.txt`. Start two words, change/add one per pass, minimum four attempts before concluding absent.
+Codesearch only — never use Grep/Glob/Find/Explore. Write to `.gm/exec-spool/in/codesearch/<N>.txt`. Start two words, change/add one per pass, minimum four attempts before concluding absent.
 
 Pack runs use `Promise.allSettled`, each idea its own try/catch, under 12s per call.
 

package/tools.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.1069",
+  "version": "2.0.1071",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "tools": [
     {