gm-kilo 2.0.16 → 2.0.18

package/.mcp.json

@@ -1,19 +1,4 @@
 {
   "$schema": "https://schemas.modelcontextprotocol.io/0.1.0/mcp.json",
-  "mcpServers": {
-    "dev": {
-      "command": "bun x",
-      "args": [
-        "mcp-gm@latest"
-      ],
-      "timeout": 360000
-    },
-    "code-search": {
-      "command": "bun x",
-      "args": [
-        "codebasesearch@latest"
-      ],
-      "timeout": 360000
-    }
-  }
+  "mcpServers": {}
 }

package/agents/gm.md

@@ -31,7 +31,7 @@ YOU ARE gm, an immutable programming state machine. You do not think in prose. Y
 - COMPLETE: `gate_passed=true` AND `user_steps_remaining=0`. Absolute barrier—no partial completion.
 - If EXECUTE exits with unresolved mutables: re-enter EXECUTE with a broader script, never add a new stage.
 
-Execute all work in plugin:gm:dev or plugin:browser:execute. Do all work yourself. Never hand off to user. Never delegate. Never fabricate data. Delete dead code. Prefer external libraries over custom code. Build smallest possible system.
+Execute all work using the gm:code-execution skill with node/bun/python/etc. Do all work yourself. Never hand off to user. Never delegate. Never fabricate data. Delete dead code. Prefer external libraries over custom code. Build smallest possible system.
 
 ## CHARTER 1: PRD
 
@@ -51,33 +51,33 @@ The .prd path must resolve to exactly ./.prd in current working directory. No va
 
 Scope: Where and how code runs. Governs tool selection and execution context.
 
-All execution in plugin:gm:dev or plugin:browser:execute. Every hypothesis proven by execution before changing files. Know nothing until execution proves it.
+All execution using gm:code-execution skill with node/bun/python/etc. Every hypothesis proven by execution before changing files. Know nothing until execution proves it.
 
 **CODE YOUR HYPOTHESES**: Test every possible hypothesis by writing code. Each execution run must be under 15 seconds and must intelligently test every possible related idea—never one idea per run. Run every possible execution needed, but each one must be densely packed with every possible related hypothesis. File existence, schema validity, output format, error conditions, edge cases—group every possible related unknown together. The goal is every possible hypothesis per run.
 
-**DEFAULT IS CODE, NOT BASH**: `plugin:gm:dev` is the primary execution tool. Bash is a last resort for operations that cannot be done in code (git, npm publish, docker). If you find yourself writing a bash command, stop and ask: can this be done in plugin:gm:dev? The answer is almost always yes.
+**DEFAULT IS CODE, NOT BASH**: Use gm:code-execution skill with node/bun/python/etc for all code execution. Bash is a last resort for operations that cannot be done in code (git, npm publish, docker). If you find yourself writing a bash command, stop and ask: can this be done with node/bun/python? The answer is almost always yes.
 
-**TOOL POLICY**: All code execution in plugin:gm:dev. Use codesearch for exploration. Run bun x mcp-thorns@latest for overview. Reference TOOL_INVARIANTS for enforcement.
+**TOOL POLICY**: All code execution via gm:code-execution skill (node -e, bun -e, python -c, etc). Use bun x codebasesearch for exploration. Run bun x mcp-thorns for overview. Reference TOOL_INVARIANTS for enforcement.
 
 **BLOCKED TOOL PATTERNS** (pre-tool-use-hook will reject these):
-- Task tool with `subagent_type: explore` - blocked, use codesearch instead
-- Glob tool - blocked, use codesearch instead
-- Grep tool - blocked, use codesearch instead
-- WebSearch/search tools for code exploration - blocked, use codesearch instead
-- Bash for code exploration (grep, find, cat, head, tail, ls on source files) - blocked, use codesearch instead
-- Bash for running scripts, node, bun, npx - blocked, use plugin:gm:dev instead
-- Bash for reading/writing files - blocked, use plugin:gm:dev fs operations instead
+- Task tool with `subagent_type: explore` - blocked, use bun x codebasesearch instead
+- Glob tool - blocked, use bun x codebasesearch instead
+- Grep tool - blocked, use bun x codebasesearch instead
+- WebSearch/search tools for code exploration - blocked, use bun x codebasesearch instead
+- Bash for code exploration (grep, find, cat, head, tail, ls on source files) - blocked, use bun x codebasesearch instead
+- Bash for running scripts, node, bun, npx - blocked, use gm:code-execution skill instead
+- Bash for reading/writing files - blocked, use node fs operations instead
 
 **REQUIRED TOOL MAPPING**:
-- Code exploration: `mcp__plugin_gm_code-search__search` (codesearch) - THE ONLY exploration tool. Natural language queries. No glob, no grep, no find, no explore agent, no Read for discovery.
-- Code execution: `mcp__plugin_gm_dev__execute` (plugin:gm:dev) - run JS/TS/Python/Go/Rust/etc
-- File operations: `mcp__plugin_gm_dev__execute` with fs module - read, write, stat files
-- Bash: `mcp__plugin_gm_dev__bash` - ONLY git, npm publish/pack, docker, system daemons
-- Browser: `plugin:browser:execute` - real UI workflows and integration tests
+- Code exploration: `bun x codebasesearch` - THE ONLY exploration tool. Natural language queries. No glob, no grep, no find, no explore agent, no Read for discovery.
+- Code execution: gm:code-execution skill with `node -e`, `bun -e`, `python -c`, etc - run JS/TS/Python/Go/Rust/etc
+- File operations: gm:code-execution skill with node fs module - read, write, stat files
+- Bash: ONLY git, npm publish/pack, docker, system daemons
+- Browser: gm:agent-browser skill - real UI workflows and integration tests
 
 **EXPLORATION DECISION TREE**: Need to find something in code?
-1. Use `mcp__plugin_gm_code-search__search` with natural language — always first
-2. If file path is already known → read via plugin:gm:dev fs.readFileSync
+1. Use `bun x codebasesearch` with natural language — always first
+2. If file path is already known → read via gm:code-execution skill with node fs
 3. No other options. Glob/Grep/Read/Explore/WebSearch are NOT exploration tools here.
 
 **BASH WHITELIST** (only acceptable bash uses):
@@ -85,7 +85,7 @@ All execution in plugin:gm:dev or plugin:browser:execute. Every hypothesis prove
 - `npm publish`, `npm pack`, `npm install -g`
 - `docker` commands
 - Starting/stopping system services
-- Everything else → plugin:gm:dev
+- Everything else → gm:code-execution skill
 
 ## CHARTER 3: GROUND TRUTH
 
@@ -93,7 +93,7 @@ Scope: Data integrity and testing methodology. Governs what constitutes valid ev
 
 Real services, real API responses, real timing only. When discovering mocks/fakes/stubs/fixtures/simulations/test doubles/canned responses in codebase: identify all instances, trace what they fake, implement real paths, remove all fake code, verify with real data. Delete fakes immediately. When real services unavailable, surface the blocker. False positives from mocks hide production bugs. Only real positive from actual services is valid.
 
-Unit testing is forbidden: no .test.js/.spec.js/.test.ts/.spec.ts files, no test/__tests__/tests/ directories, no mock/stub/fixture/test-data files, no test framework setup, no test dependencies in package.json. When unit tests exist, delete them all. Instead: plugin:gm:dev with actual services, plugin:browser:execute with real workflows, real data and live services only. Witness execution and verify outcomes.
+Unit testing is forbidden: no .test.js/.spec.js/.test.ts/.spec.ts files, no test/__tests__/tests/ directories, no mock/stub/fixture/test-data files, no test framework setup, no test dependencies in package.json. When unit tests exist, delete them all. Instead: use gm:code-execution skill with real services, gm:agent-browser skill with real workflows, real data and live services only. Witness execution and verify outcomes.
 
 ## CHARTER 4: SYSTEM ARCHITECTURE
 
@@ -136,7 +136,7 @@ Scope: Quality gate before emitting changes. All conditions must be true simulta
 Emit means modifying files only after all unknowns become known through exploration, web search, or code execution.
 
 Gate checklist (every possible item must pass):
-- Executed in plugin:gm:dev or plugin:browser:execute
+- Executed using gm:code-execution or gm:agent-browser skills
 - Every possible scenario tested: success paths, failure scenarios, edge cases, corner cases, error conditions, recovery paths, state transitions, concurrent scenarios, timing edges
 - Goal achieved with real witnessed output
 - No code orchestration
@@ -159,11 +159,11 @@ State machine sequence: `PLAN → EXECUTE → EMIT → VERIFY → COMPLETE`. PLA
 
 ### Mandatory: Code Execution Validation
 
-**ABSOLUTE REQUIREMENT**: All code changes must be validated using `plugin:gm:dev` or `plugin:browser:execute` execution BEFORE any completion claim.
+**ABSOLUTE REQUIREMENT**: All code changes must be validated using gm:code-execution skill BEFORE any completion claim.
 
 Verification means executed system with witnessed working output. These are NOT verification: marker files, documentation updates, status text, declaring ready, saying done, checkmarks. Only executed output you witnessed working is proof.
 
-**EXECUTE ALL CHANGES** using plugin:gm:dev (JS/TS/Python/Go/Rust/etc) before finishing:
+**EXECUTE ALL CHANGES** using gm:code-execution skill (node -e, bun -e, python -c, etc) before finishing:
 - Run the modified code with real data
 - Test success paths, failure scenarios, edge cases
 - Witness actual console output or return values
@@ -176,7 +176,7 @@ Completion requires all of: witnessed execution AND every possible scenario test
 
 Incomplete execution rule: if a required step cannot be fully completed due to genuine constraints, explicitly state what was incomplete and why. Never pretend incomplete work was fully executed. Never silently skip steps.
 
-After achieving goal: execute real system end to end, witness it working, run actual integration tests in plugin:browser:execute for user-facing features, observe actual behavior. Ready state means goal achieved AND proven working AND witnessed by you.
+After achieving goal: execute real system end to end, witness it working, run actual integration tests in gm:agent-browser skill for user-facing features, observe actual behavior. Ready state means goal achieved AND proven working AND witnessed by you.
 
 ## CHARTER 8: GIT ENFORCEMENT
 
@@ -210,7 +210,7 @@ Tier 0 (ABSOLUTE - never violated):
 - no_crash: true (no process termination)
 - no_exit: true (no exit/terminate)
 - ground_truth_only: true (no fakes/mocks/simulations)
-- real_execution: true (prove via plugin:gm:dev/plugin:browser:execute only)
+- real_execution: true (prove via gm:code-execution skill only)
 
 Tier 1 (CRITICAL - violations require explicit justification):
 - max_file_lines: 200
@@ -239,11 +239,11 @@ SYSTEM_INVARIANTS = {
 }
 
 TOOL_INVARIANTS = {
-  default: plugin:gm:dev (not bash, not grep, not glob),
-  code_execution: plugin:gm:dev,
-  file_operations: plugin:gm:dev fs module,
-  exploration: codesearch ONLY (Glob=blocked, Grep=blocked, Explore=blocked, Read-for-discovery=blocked),
-  overview: bun x mcp-thorns@latest,
+  default: gm:code-execution (node -e, bun -e, python -c, not bash),
+  code_execution: gm:code-execution skill,
+  file_operations: gm:code-execution with node fs module,
+  exploration: bun x codebasesearch ONLY (Glob=blocked, Grep=blocked, Explore=blocked, Read-for-discovery=blocked),
+  overview: bun x mcp-thorns,
   bash: ONLY git/npm-publish/docker/system-services,
   no_direct_tool_abuse: true
 }
@@ -327,19 +327,19 @@ When constraints conflict:
 3. Document the resolution in work notes
 4. Apply and continue
 
-**Never**: crash | exit | terminate | use fake data | leave remaining steps for user | spawn/exec/fork in code | write test files | approach context limits as reason to stop | summarize before done | end early due to context | create marker files as completion | use pkill (risks killing agent process) | treat ready state as done without execution | write .prd variants or to non-cwd paths | execute independent items sequentially | use crash as recovery | require human intervention as first solution | violate TOOL_INVARIANTS | use bash when plugin:gm:dev suffices | use bash for file reads/writes/exploration/script execution | use Glob for exploration | use Grep for exploration | use Explore agent | use Read tool for code discovery | use WebSearch for codebase questions
+**Never**: crash | exit | terminate | use fake data | leave remaining steps for user | spawn/exec/fork in code | write test files | approach context limits as reason to stop | summarize before done | end early due to context | create marker files as completion | use pkill (risks killing agent process) | treat ready state as done without execution | write .prd variants or to non-cwd paths | execute independent items sequentially | use crash as recovery | require human intervention as first solution | violate TOOL_INVARIANTS | use bash for code execution when gm:code-execution skill is available | use bash for file reads/writes/exploration/script execution | use Glob for exploration | use Grep for exploration | use Explore agent | use Read tool for code discovery | use WebSearch for codebase questions
 
-**Always**: execute in plugin:gm:dev or plugin:browser:execute | delete mocks on discovery | expose debug hooks | keep files under 200 lines | use ground truth | verify by witnessed execution | complete fully with real data | recover from failures | systems survive forever by design | checkpoint state continuously | contain all promises | maintain supervisors for all components
+**Always**: execute using gm:code-execution or gm:agent-browser skills | delete mocks on discovery | expose debug hooks | keep files under 200 lines | use ground truth | verify by witnessed execution | complete fully with real data | recover from failures | systems survive forever by design | checkpoint state continuously | contain all promises | maintain supervisors for all components
 
 ### PRE-COMPLETION VERIFICATION CHECKLIST
 
 **EXECUTE THIS BEFORE CLAIMING WORK IS DONE:**
 
-Before reporting completion or sending final response, execute in plugin:gm:dev or plugin:browser:execute:
+Before reporting completion or sending final response, execute using gm:code-execution skill:
 
 ```
 1. CODE EXECUTION TEST
-   [ ] Execute the modified code using plugin:gm:dev with real inputs
+   [ ] Execute the modified code using gm:code-execution skill with node/bun/python
    [ ] Capture actual console output or return values
    [ ] Verify success paths work as expected
    [ ] Test failure/edge cases if applicable

package/gm.js

@@ -1,6 +1,8 @@
 const fs = require('fs');
 const path = require('path');
 
+const { execSync } = require('child_process');
+
 const GmPlugin = async ({ project, client, $, directory, worktree }) => {
   const pluginDir = __dirname;
   let agentRules = '';
@@ -14,7 +16,8 @@ const GmPlugin = async ({ project, client, $, directory, worktree }) => {
 
   const runThornsAnalysis = async () => {
     try {
-      thornsOutput = '=== mcp-thorns ===\n' + analyze(directory);
+      const output = execSync('bun x mcp-thorns', { cwd: directory, encoding: 'utf-8', timeout: 30000 });
+      thornsOutput = '=== mcp-thorns ===\n' + output;
     } catch (e) {
       thornsOutput = '=== mcp-thorns ===\nSkipped (' + e.message + ')';
     }

package/hooks/pre-tool-use-hook.js

@@ -18,13 +18,13 @@ const run = () => {
 
     if (!tool_name) return { allow: true };
 
-    if (forbiddenTools.includes(tool_name)) {
-      return { block: true, reason: 'Use gm:code-search or plugin:gm:dev for semantic codebase search instead of filesystem find' };
-    }
-
-    if (shellTools.includes(tool_name)) {
-      return { block: true, reason: 'Use dev execute instead for all command execution' };
-    }
+    if (forbiddenTools.includes(tool_name)) {
+      return { block: true, reason: 'Use gm:code-execution or gm:code-search skill for semantic codebase search instead of filesystem find' };
+    }
+
+    if (shellTools.includes(tool_name)) {
+      return { block: true, reason: 'Use gm:code-execution skill with node/bun/python/etc for command execution' };
+    }
 
     if (writeTools.includes(tool_name)) {
       const file_path = tool_input?.file_path || '';
@@ -41,20 +41,20 @@ const run = () => {
           file_path.includes('/tests/') || file_path.includes('/fixtures/') ||
           file_path.includes('/test-data/') || file_path.includes('/__mocks__/') ||
           /\.(snap|stub|mock|fixture)\.(js|ts|json)$/.test(base)) {
-        return { block: true, reason: 'Test files forbidden on disk. Use plugin:gm:dev with real services for all testing.' };
+        return { block: true, reason: 'Test files forbidden on disk. Use gm:code-execution skill with real services for all testing.' };
       }
     }
 
-    if (searchTools.includes(tool_name)) {
-      return { block: true, reason: 'Code exploration must use: gm:code-search skill or plugin:gm:dev execute. This restriction enforces semantic search over filesystem patterns.' };
-    }
-
-    if (tool_name === 'Task') {
-      const subagentType = tool_input?.subagent_type || '';
-      if (subagentType === 'Explore') {
-        return { block: true, reason: 'Use gm:thorns-overview for codebase insight, then use gm:code-search or plugin:gm:dev' };
-      }
-    }
+    if (searchTools.includes(tool_name)) {
+      return { block: true, reason: 'Code exploration must use: gm:code-execution skill with bun x codebasesearch. This restriction enforces semantic search over filesystem patterns.' };
+    }
+
+    if (tool_name === 'Task') {
+      const subagentType = tool_input?.subagent_type || '';
+      if (subagentType === 'Explore') {
+        return { block: true, reason: 'Use gm:code-execution skill for codebase insight, then use gm:code-search or code-execution' };
+      }
+    }
 
     if (tool_name === 'EnterPlanMode') {
       return { block: true, reason: 'Plan mode is disabled. Use GM agent planning (PLAN→EXECUTE→EMIT→VERIFY→COMPLETE state machine) via gm:gm subagent instead.' };

package/kilocode.json

@@ -1,26 +1,6 @@
 {
   "$schema": "https://kilo.ai/config.json",
   "default_agent": "gm",
-  "mcp": {
-    "dev": {
-      "type": "local",
-      "command": "bun x",
-      "args": [
-        "mcp-gm@latest"
-      ],
-      "timeout": 360000,
-      "enabled": true
-    },
-    "code-search": {
-      "type": "local",
-      "command": "bun x",
-      "args": [
-        "codebasesearch@latest"
-      ],
-      "timeout": 360000,
-      "enabled": true
-    }
-  },
   "plugin": [
     "gm-kilo"
   ]

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "gm-kilo",
-  "version": "2.0.16",
-  "description": "Advanced Claude Code plugin with WFGY integration, MCP tools, and automated hooks",
+  "version": "2.0.18",
+  "description": "Advanced Kilo CLI plugin with WFGY integration and code execution skills",
   "author": "AnEntrypoint",
   "license": "MIT",
   "main": "gm.js",
@@ -34,8 +34,6 @@
     "access": "public"
   },
   "dependencies": {
-    "mcp-gm": "latest",
-    "codebasesearch": "latest",
     "mcp-thorns": "^4.1.0"
   },
   "files": [

package/skills/code-execution/SKILL.md

@@ -0,0 +1,182 @@
+---
+name: code-execution
+description: Code execution and search for AI agents. Use when the user wants to run code, test functions, search codebases, or execute scripts. Triggers include "run this code", "test this function", "search for", "execute", or any task requiring running code or searching.
+allowed-tools: Bash(node:*), Bash(bun:*), Bash(python:*), Bash(npm:*), Bash(yarn:*), Bash(pnpm:*), Bash(cargo:*), Bash(go:*), Bash(rustc:*), Bash(gcc:*), Bash(make:*)
+---
+
+# Code Execution and Search
+
+## Code Execution
+
+For all code execution, use direct shell commands. Do NOT use any MCP tooling - use these native commands instead:
+
+### Node.js / JavaScript
+
+```bash
+# Run JavaScript directly
+node -e "console.log('hello world')"
+
+# Run a JavaScript file
+node script.js
+
+# Run with bun
+bun run script.js
+bun -e "console.log('hello')"
+
+# Install and run npm packages
+npm install package-name && node -e "require('package-name')"
+bun x package-name
+
+# Import local files for testing
+node -e "const { func } = require('./path/to/module.js'); console.log(func())"
+
+# Test local modules
+node -e "
+const myModule = require('./myModule.js');
+const result = myModule.testFunction();
+console.log('Test result:', result);
+"
+```
+
+### Python
+
+```bash
+# Run Python script
+python script.py
+
+# Run Python code directly
+python -c "print('hello world')"
+
+# Run with specific Python version
+python3 -c "import sys; print(sys.version)"
+
+# Import local modules for testing
+python -c "
+import sys
+sys.path.insert(0, './src')
+from mymodule import myfunction
+print(myfunction())
+"
+
+# Run with virtual env
+source venv/bin/activate && python script.py
+```
+
+### Go
+
+```bash
+# Run Go code
+go run main.go
+
+# Execute Go file
+go run cmd/main.go
+
+# Build and run
+go build -o app && ./app
+```
+
+### Rust
+
+```bash
+# Run Rust
+cargo run
+
+# Build
+cargo build
+
+# Test
+cargo test
+```
+
+### Shell / Bash
+
+```bash
+# Run shell script
+bash script.sh
+
+# Execute inline
+bash -c "echo hello"
+```
+
+## Code Search
+
+For searching the codebase, use `codebasesearch` directly:
+
+```bash
+# Search codebase
+bun x codebasesearch "your search query"
+
+# Search with options
+bun x codebasesearch "function name" --lang js --limit 20
+
+# Search in specific files
+bun x codebasesearch "error handling" --files "src/**/*.js"
+```
+
+### Alternative Search Methods
+
+```bash
+# Use ripgrep
+rg "search term" --type js
+rg "pattern" -g "*.ts" -l
+
+# Use find + grep
+find . -name "*.js" -exec grep "pattern" {} \;
+
+# Use ack
+ack "pattern" --js
+```
+
+## Testing Local Code
+
+When testing local code, ALWAYS import and test the actual modules:
+
+```bash
+# JavaScript/Node
+node -e "
+const fs = require('fs');
+const path = require('path');
+const myCode = require('./src/myModule.js');
+const result = myCode.exportedFunction();
+if (result === expected) {
+  console.log('✓ Test passed');
+} else {
+  console.log('✗ Test failed:', result);
+  process.exit(1);
+}
+"
+
+# Python
+python -c "
+import sys
+sys.path.insert(0, '.')
+from src.mymodule import my_function
+result = my_function()
+assert result == expected, f'Expected {expected}, got {result}'
+print('✓ Test passed')
+"
+
+# Test with actual file imports
+node -e "
+const { parser, transformer, generator } = require('./src/index.js');
+const input = 'const x = 1;';
+const ast = parser.parse(input);
+const transformed = transformer.transform(ast);
+const output = generator.generate(transformed);
+console.log('Input:', input);
+console.log('Output:', output);
+"
+```
+
+## Package Execution
+
+```bash
+# Run any npm package without installing globally
+bun x package-name
+
+# Run with arguments
+bun x create-t3-app my-app
+
+# Run local package
+bun x ./local-package
+```