gm-plugkit 2.0.1616 → 2.0.1618

package/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: gm-skill
+name: gm
 description: Plugkit-served instruction stream. Three-layer admission (witness, single-writer, direction) over every possible mutation; effort unbounded, never gated on cost. Closure on first emit; partial = non-monotonic.
 allowed-tools: Skill, Read, Write, Bash(bun *), Bash(npx *)
 ---

package/bootstrap.js

@@ -768,9 +768,9 @@ function ensureSkillMdFresh() {
   try {
     const candidates = [
       path.join(__dirname, 'SKILL.md'),
-      path.join(__dirname, '..', 'gm-skill', 'skills', 'gm-skill', 'SKILL.md'),
-      path.join(__dirname, '..', '..', 'gm-skill', 'skills', 'gm-skill', 'SKILL.md'),
-      path.join(__dirname, '..', 'skills', 'gm-skill', 'SKILL.md'),
+      path.join(__dirname, '..', 'gm-skill', 'skills', 'gm', 'SKILL.md'),
+      path.join(__dirname, '..', '..', 'gm-skill', 'skills', 'gm', 'SKILL.md'),
+      path.join(__dirname, '..', 'skills', 'gm', 'SKILL.md'),
     ];
     const bundledPath = candidates.find(p => {
       try { return fs.existsSync(p); } catch (_) { return false; }
@@ -787,9 +787,15 @@ function ensureSkillMdFresh() {
     const bundledHash = crypto.createHash('sha256').update(_norm(bundled)).digest('hex');
     const home = process.env.HOME || process.env.USERPROFILE || require('os').homedir();
     const targets = [
-      path.join(home, '.agents', 'skills', 'gm-skill', 'SKILL.md'),
-      path.join(home, '.claude', 'skills', 'gm-skill', 'SKILL.md'),
+      path.join(home, '.agents', 'skills', 'gm', 'SKILL.md'),
+      path.join(home, '.claude', 'skills', 'gm', 'SKILL.md'),
     ];
+    for (const legacy of [
+      path.join(home, '.agents', 'skills', 'gm-skill'),
+      path.join(home, '.claude', 'skills', 'gm-skill'),
+    ]) {
+      try { if (fs.existsSync(legacy)) fs.rmSync(legacy, { recursive: true, force: true }); } catch (_) {}
+    }
     const refreshed = [];
     for (const target of targets) {
       try {

package/instructions/browser.md

@@ -23,12 +23,15 @@ session close <id>
 url=<url>\n<expression>
 timeout=<ms>\n<expression>
 capture\n<expression>
+profile\n<expression>
 ```
 
 **Open on the page you want to test, not a blank one.** A bare `https://...` URL body navigates the session straight to that page and returns `{url, title}` -- the simplest "show me this page." `url=<url>\n<expression>` navigates first, then runs your expression on the loaded page, so the global/DOM you assert is already there in one dispatch instead of a blank surface you must `page.goto` yourself. `url=` composes with `timeout=` and `capture` -- stack the prefix lines in order `timeout=`, then `url=`, then `capture`, the expression last; the prepended `page.goto` rides inside the capture so its navigation console/network is captured too. A bare expression with no URL prefix and no live session opens against `about:blank`; with a live session it reuses it. `session new` returns the id you carry; with more than one open, target it via `session=<id>\n<expr>`. (`session close` and `session kill` are aliases.) Default per-eval timeout 120000ms; operations that legitimately exceed it prefix `timeout=<ms>\n` (wrapper clamps to 120000ms). The response carries `timeout_ms_used`; `browser.runner-timeout` fires at the cap -- read `stderr`, narrow or raise, never retry blind at the same budget.
 
 **`capture\n<expression>` is the zero-boilerplate debug path -- prefer it.** Prefix your script with `capture` (or `profile`) on its own line and the wrapper auto-attaches `page.on('console'|'pageerror'|'requestfinished')` before your code runs, runs your script in an async wrapper (your top-level `await`/`return` work unchanged), and returns `{result: <your return>, debug: {console, pageErrors, network, performance}}` -- page console logs, uncaught errors, per-request network timing, and navigation performance, captured for free. Combine with timeout via `timeout=<ms>\ncapture\n<expr>`. Use the bare expression only when you do not want the capture overhead.
 
+**`profile\n<expression>` is the bottom-up CPU profiler -- worst-20 culprits by file location across init and code-execution.** Prefix your script with `profile` on its own line: the wrapper opens a CDP `Profiler` (`newCDPSession` + `Profiler.start` BEFORE the prepended `page.goto`, so navigation, script-parse, and init are sampled, not only steady-state), runs your script, `Profiler.stop`s, and aggregates the v8 CPU profile into `{result, profile: {timeframe: {start_us, end_us, total_us, sample_count}, culprits: [{location, function, self_us, self_pct, hits}]}, profile_error, debug: {...}}`. `culprits` is the bottom-up self-time ranking capped at the worst 20 `url:line` locations; `timeframe` is the capture window in microseconds. Composes with `url=`/`timeout=` in the same prefix order. Page scripts loaded from `.js` files carry real `file:line`; `page.evaluate` anonymous frames bucket to `(program)`/`(native)`. On a CDP failure `profile` is `null` with `profile_error` set and your `result` still returns. The identical `{timeframe, culprits}` shape comes back from `exec_js` with `opts.profile:true`, so the cli and browser bottom-up views read the same.
+
 ## Envelope
 
 `{ok, stdout, stderr, exit_code, session_id?}`. `stdout` = stringified eval result; `stderr` = page errors + launch diagnostics; `exit_code` non-zero = the dispatch did not land -- read `stderr` and re-dispatch, never blind.

package/instructions/emit.md

@@ -14,7 +14,7 @@ Feed search outputs into EMIT only when the digest matches the live filesystem;
 
 ## Write-then-verify
 
-One write per artifact, then a disk Read against every touched path to assert the change -- verified disk state IS the witness, not the tool-call return. On discrepancy, regress to root cause, do not retry.
+One write per artifact, then a disk Read against every touched path to assert the change -- you do not reason that the write succeeded, you run the read and witness it. Verified disk state IS the witness, not the tool-call return. On discrepancy, regress to root cause, do not retry.
 
 **Client-side artifacts: write-then-browser-witness, same turn.** If the artifact is `.html .js .jsx .ts .tsx .vue .svelte .mjs .css` or any browser-loaded path, the disk Read is necessary but not sufficient -- also dispatch a `browser` verb that `page.evaluate`s the invariant the artifact establishes (the page-side assertion is the real witness; the disk Read only witnesses serialization). Skipping it ships a green-checked stub. The COMPLETE gate refuses while any client-side file edited this session lacks its paired browser-witness (`deviation.client-edit-no-witness`, gates.rs); the missing witness is the next dispatch.
 

package/instructions/entry.md

@@ -41,11 +41,11 @@ The five phases are scheduling; the filter is the engine on every candidate, gat
 
 ## Token Discipline
 
-English describing intent is liability when code can encode it; comments are liability when names + structure encode the same; duplication that must sync is liability. Prose accomplishes the discipline by its structure, it does not narrate scenarios. Recognize the closure anti-shape by structure (a claim composed in prose displacing a dispatch). The response body is not a mutation surface.
+English describing intent is liability when code can encode it; comments are liability when names + structure encode the same; duplication that must sync is liability. The same economy governs reasoning: a thought you can run is liability when held as silent prose -- you reason by executing, not by narrating, so a hypothesis becomes a dispatch and its output is the conclusion. Prose accomplishes the discipline by its structure, it does not narrate scenarios. Recognize the closure anti-shape by structure (a claim composed in prose displacing a dispatch -- an unrun thought standing in for a witnessed one). The response body is not a mutation surface.
 
 ## Install
 
-`bun x skills add AnEntrypoint/gm-skill` -> `~/.agents/skills/<name>/SKILL.md` symlinked into `~/.claude/skills/<name>/`.
+`npx gm-skill install` copies the skill directory into `~/.claude/skills/gm/` (and `~/.agents/skills/gm/`), installed as `/gm`; `--yes` is the non-interactive form. No `skills` library.
 
 ## Bootstrap
 

package/instructions/execute.md

@@ -12,7 +12,9 @@ Every code/file/symbol lookup is a `codesearch` dispatch -- never a platform Exp
 
 ## Witness
 
-The witness IS the distance measurement: artifact present in observable state means `d(state, goal)` decreased. An artifact composed only in prose, or success returned without doing the work, sits at high distance regardless of structure -- L3 rejects the next dispatch.
+You still reason as hard as ever -- you just think in code rather than in silent prose. A thought you cannot run is a guess; the hypothesis you form becomes an `exec_js`, a `codesearch`, a `page.evaluate`, and its output is the conclusion. The internal monologue that used to argue both sides of an unknown is replaced by the cheaper, truthful move: run it and read the real result. Hypothesize, execute, witness -- that loop IS your reasoning, and it leaves an artifact the next agent can trust.
+
+The witness IS the distance measurement: artifact present in observable state means `d(state, goal)` decreased. An artifact composed only in prose, or success returned without doing the work, sits at high distance regardless of structure -- a conclusion reasoned-to but never run-to is exactly that unwitnessed prose; L3 rejects the next dispatch.
 
 Witness code running on a non-default surface on that surface in the same turn; a passing test on surface A is not witness for code on surface B. For the browser surface, dispatch the `browser` verb (`in/browser/<N>.txt`, raw JS, globals `page`/`snapshot`/`screenshotWithAccessibilityLabels`/`state`; `session new|list|close <id>`).
 
@@ -36,7 +38,7 @@ First emit = closure of the transform; scaffold + IOU externalizes residual cost
 
 Data first -- get the structures and their invariants right and the code writes itself; convoluted control flow means the data model is wrong, so fix the model. Make invalid state unrepresentable -- pass parameters over hidden globals, encode the constraint in the type/shape so the bad combination cannot be constructed. Reason from physical constraints (latency, bandwidth, memory, coordination, the worst node) before designing within them. Keep the spine flat, each unit single-focus and understandable at its call site. Make misuse structurally impossible, not documented-against. Optimize the worst case, not the average; design every failure path explicitly (full -> degraded -> safe-fail -> explicit-error), never a silent catastrophic mode. Measure, do not assume -- profile before optimizing, implement both and compare on real input when in genuine dispute. When a change regresses something that worked, revert first and investigate second: restore green, then diagnose from a known-good base. Fail fast and loud over limping on bad state.
 
-**Process of elimination is the debugging paradigm on every surface, and manual labour against real services is how you witness.** Never guess-and-restart, a/b-test, or shotgun variants: enumerate the candidate causes as mutables, then eliminate each by a witness read against REAL input -- `exec_js` against the real service, `codesearch`/`Read` against the real source, the `browser` verb's `page.evaluate` against a `window.*` global on the live page. Each elimination reveals the next mutable; record it and keep going until one cause survives every other's refutation. Reading the live runtime once observes more than a hundred blind restarts. Profile on the real surface, not from intuition: wrap the suspect node and read the live numbers. In node, `exec_js` carries `duration_ms` for free, surfaces your own timing and `process.memoryUsage()` on stdout, and lands the thrown-error `stack` on stderr -- read both channels (numbers on stdout, stack on stderr). In the browser, a body prefixed `capture\n<script>` auto-returns `{result, debug:{console, pageErrors, network, performance}}` with zero boilerplate. Profile to LOCATE the slow/broken node, then eliminate hypotheses by live measurement. Verification is the same labour: run the real thing and witness the real output (the single mock-free `test.js`, the live page, the real service), never an automated unit/mock harness standing in for the real-services witness. Apparent tooling failure is part of this -- it is your mechanical self-recovery by elimination, never a question for the user.
+**Process of elimination is the debugging paradigm on every surface, and manual labour against real services is how you witness.** This is thinking-in-code at its sharpest: each candidate cause is a hypothesis, and you test the hypothesis by running it, not by reasoning around it. Never guess-and-restart, a/b-test, or shotgun variants: enumerate the candidate causes as mutables, then eliminate each by a witness read against REAL input -- `exec_js` against the real service, `codesearch`/`Read` against the real source, the `browser` verb's `page.evaluate` against a `window.*` global on the live page. Each elimination reveals the next mutable; record it and keep going until one cause survives every other's refutation. Reading the live runtime once observes more than a hundred blind restarts. Profile on the real surface, not from intuition: wrap the suspect node and read the live numbers. In node, `exec_js` carries `duration_ms` for free, surfaces your own timing and `process.memoryUsage()` on stdout, and lands the thrown-error `stack` on stderr -- read both channels (numbers on stdout, stack on stderr). In the browser, a body prefixed `capture\n<script>` auto-returns `{result, debug:{console, pageErrors, network, performance}}` with zero boilerplate. When the slow node is not obvious, sample it bottom-up: `exec_js` with `opts.profile:true` and the browser `profile\n<script>` prefix both return `{result, profile:{timeframe:{start_us,end_us,total_us,sample_count}, culprits:[{location,function,self_us,self_pct,hits}]}}` -- the worst-20 `file:line` by self-time across init and code-execution, identical shape on both surfaces, so the culprit ranking points straight at the line to fix. Profile to LOCATE the slow/broken node, then eliminate hypotheses by live measurement. Verification is the same labour: run the real thing and witness the real output (the single mock-free `test.js`, the live page, the real service), never an automated unit/mock harness standing in for the real-services witness. Apparent tooling failure is part of this -- it is your mechanical self-recovery by elimination, never a question for the user.
 
 ## Memorize
 

package/instructions/plan.md

@@ -6,7 +6,7 @@ L1 baseline + L2 covering family. You loaded prior memory on entry via `instruct
 
 ## Orient
 
-First non-trivial dispatch = a single-message parallel fan-out of `recall` + `codesearch` against the request's nouns. Hits are your baseline; misses delimit fresh ground to investigate. Skip orient and you commit to an unobserved envelope.
+First non-trivial dispatch = a single-message parallel fan-out of `recall` + `codesearch` against the request's nouns. This is where planning-thought becomes executed query rather than recalled-from-memory assumption: what you would otherwise assume about the codebase, you instead hypothesize and look up. Hits are your baseline; misses delimit fresh ground to investigate. Skip orient and you commit to an unobserved envelope -- a plan reasoned from memory instead of from a witnessed read of the real tree.
 
 ## Cover
 

package/instructions/verify.md

@@ -16,7 +16,7 @@ The `git_push` verb is the only admissible push surface, any repo, any cwd; it r
 
 ## CI
 
-The push IS the validation dispatch. Local proof covers one platform; the matrix covers all. Red = a divergent observation that holds the trajectory until you name the cause and push green; toolchain skew is an observation to converge, not stop.
+Verification is thinking run rather than reasoned: the question "is this correct?" is not argued in prose, it is executed -- the real test, the real matrix, the real page answer it. The push IS the validation dispatch. Local proof covers one platform; the matrix covers all. Red = a divergent observation that holds the trajectory until you name the cause and push green; toolchain skew is an observation to converge, not stop.
 
 ## Integration witness
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.1616",
+  "version": "2.0.1618",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform binary, verifies SHA256, and starts the spool watcher daemon. Includes plugkit-wasm-wrapper for WASM-based spool watching.",
   "main": "index.js",
   "bin": {

package/plugkit-wasm-wrapper.js

@@ -621,6 +621,56 @@ function writeJsonFile(fp, value) {
   try { atomicWriteJson(fp, value); } catch (_) {}
 }
 
+const AGGREGATE_CPU_PROFILE_SRC = `function aggregateCpuProfile(profile, topN) {
+  const N = topN || 20;
+  if (!profile || !Array.isArray(profile.nodes) || !Array.isArray(profile.samples)) {
+    return { timeframe: null, culprits: [] };
+  }
+  const byId = new Map();
+  for (const node of profile.nodes) byId.set(node.id, node);
+  const deltas = Array.isArray(profile.timeDeltas) ? profile.timeDeltas : [];
+  const acc = new Map();
+  let total = 0;
+  const sampleCount = profile.samples.length;
+  for (let i = 0; i < profile.samples.length; i++) {
+    const node = byId.get(profile.samples[i]);
+    const dt = deltas[i] || 0;
+    total += dt;
+    if (!node) continue;
+    const cf = node.callFrame || {};
+    let url = cf.url || '';
+    if (!url) url = cf.functionName ? '(native)' : '(program)';
+    const line = (typeof cf.lineNumber === 'number' && cf.lineNumber >= 0) ? cf.lineNumber + 1 : 0;
+    const loc = url + ':' + line;
+    let e = acc.get(loc);
+    if (!e) { e = { location: loc, function: cf.functionName || '(anonymous)', self_us: 0, hits: 0 }; acc.set(loc, e); }
+    e.self_us += dt;
+    e.hits += 1;
+  }
+  const culprits = Array.from(acc.values())
+    .sort((a, b) => b.self_us - a.self_us)
+    .slice(0, N)
+    .map(c => ({ location: c.location, function: c.function, self_us: c.self_us, self_pct: total ? Math.round((c.self_us / total) * 1000) / 10 : 0, hits: c.hits }));
+  return {
+    timeframe: {
+      start_us: typeof profile.startTime === 'number' ? profile.startTime : 0,
+      end_us: typeof profile.endTime === 'number' ? profile.endTime : 0,
+      total_us: total,
+      sample_count: sampleCount,
+    },
+    culprits,
+  };
+}`;
+
+let execProfileSeq = 0;
+let _aggregateCpuProfileFn = null;
+function aggregateCpuProfile(profile, topN) {
+  if (!_aggregateCpuProfileFn) {
+    _aggregateCpuProfileFn = new Function(AGGREGATE_CPU_PROFILE_SRC + '\nreturn aggregateCpuProfile;')();
+  }
+  return _aggregateCpuProfileFn(profile, topN);
+}
+
 const BROWSER_RUNNER_BIN = process.env.GM_BROWSER_RUNNER_BIN || 'playwriter';
 
 function findBrowserRunner() {
@@ -1870,14 +1920,62 @@ function makeHostFunctions(instanceRef) {
           });
         }
         const timeoutMs = rawTimeout;
+        const wantProfile = opts.profile === true && (lang === 'nodejs' || lang === 'js' || lang === undefined);
+        let profileUserFile = null;
         let cmd, args;
-        if (lang === 'nodejs' || lang === 'js') { cmd = process.execPath; args = ['-e', code]; }
+        if (lang === 'nodejs' || lang === 'js') {
+          if (wantProfile) {
+            profileUserFile = path.join(os.tmpdir(), `gm-prof-${process.pid}-${execProfileSeq++}.js`);
+            fs.writeFileSync(profileUserFile, `module.exports = (async () => {\n${code}\n});`, 'utf-8');
+            const runnerCode = `${AGGREGATE_CPU_PROFILE_SRC}\n`
+              + `const __inspector = require('inspector');\n`
+              + `const __session = new __inspector.Session();\n`
+              + `__session.connect();\n`
+              + `const __post = (m, p) => new Promise((res, rej) => __session.post(m, p || {}, (e, r) => e ? rej(e) : res(r)));\n`
+              + `(async () => {\n`
+              + `  let __profile = null, __profileError = null, __userResult = null, __userError = null;\n`
+              + `  try {\n`
+              + `    await __post('Profiler.enable');\n`
+              + `    await __post('Profiler.setSamplingInterval', { interval: ${Number.isFinite(opts.sampleIntervalUs) && opts.sampleIntervalUs > 0 ? Math.floor(opts.sampleIntervalUs) : 100} });\n`
+              + `    await __post('Profiler.start');\n`
+              + `    try { __userResult = await require(${JSON.stringify(profileUserFile)})(); } catch (ue) { __userError = String(ue && ue.stack || ue); }\n`
+              + `    const __r = await __post('Profiler.stop');\n`
+              + `    __profile = __r && __r.profile || null;\n`
+              + `  } catch (pe) { __profileError = String(pe && pe.message || pe); }\n`
+              + `  const __agg = __profile ? aggregateCpuProfile(__profile) : { timeframe: null, culprits: [] };\n`
+              + `  process.stdout.write('__GM_PROFILE__' + JSON.stringify({ result: __userResult, user_error: __userError, profile: __agg, profile_error: __profileError }));\n`
+              + `  __session.disconnect();\n`
+              + `})();\n`;
+            cmd = process.execPath; args = ['-e', runnerCode];
+          } else {
+            cmd = process.execPath; args = ['-e', code];
+          }
+        }
         else if (lang === 'python') { cmd = 'python'; args = ['-c', code]; }
         else if (lang === 'bash') { cmd = 'bash'; args = ['-c', code]; }
         else if (lang === 'deno') { cmd = 'deno'; args = ['eval', code]; }
         else { return writeWasmJson(instanceRef.value, { ok: false, error: `unsupported lang: ${lang}` }); }
         const __execT0 = Date.now();
         const result = spawnSync(cmd, args, { encoding: 'utf-8', timeout: timeoutMs, cwd, env: process.env });
+        if (profileUserFile) { try { fs.unlinkSync(profileUserFile); } catch (_) {} }
+        if (wantProfile) {
+          const raw = result.stdout || '';
+          const idx = raw.indexOf('__GM_PROFILE__');
+          let parsed = null;
+          if (idx >= 0) { try { parsed = JSON.parse(raw.slice(idx + '__GM_PROFILE__'.length)); } catch (_) {} }
+          return writeWasmJson(instanceRef.value, {
+            ok: result.status === 0 && parsed !== null && !parsed.user_error,
+            stdout: idx >= 0 ? raw.slice(0, idx) : raw,
+            stderr: result.stderr || '',
+            exit_code: result.status === null ? -1 : result.status,
+            timed_out: result.signal === 'SIGTERM',
+            duration_ms: Date.now() - __execT0,
+            result: parsed ? parsed.result : null,
+            profile: parsed ? parsed.profile : { timeframe: null, culprits: [] },
+            profile_error: parsed ? parsed.profile_error : 'profile sentinel not found in stdout',
+            user_error: parsed ? parsed.user_error : null,
+          });
+        }
         return writeWasmJson(instanceRef.value, {
           ok: result.status === 0,
           stdout: result.stdout || '',
@@ -2016,15 +2114,30 @@ function makeHostFunctions(instanceRef) {
         const gotoPrefix = startUrl
           ? `await page.goto(${JSON.stringify(startUrl)},{waitUntil:'load',timeout:${navTimeout}});\n`
           : '';
-        const captureMatch = evalBody.match(/^(?:capture|profile)[ \t]*\n([\s\S]*)$/);
-        if (captureMatch) {
-          const userScript = captureMatch[1];
-          evalBody = `const __logs=[],__errs=[],__net=[];\n`
-            + `try{page.on('console',m=>{try{__logs.push({type:m.type(),text:m.text()});}catch(_){}});`
-            + `page.on('pageerror',e=>{try{__errs.push(String(e&&e.message||e));}catch(_){}});`
-            + `page.on('requestfinished',r=>{try{const t=r.timing();__net.push({url:String(r.url()).slice(0,120),dur_ms:Math.round(t.responseEnd),ttfb_ms:Math.round(t.responseStart)});}catch(_){}});}catch(_){}\n`
+        const modeMatch = evalBody.match(/^(capture|profile)[ \t]*\n([\s\S]*)$/);
+        const debugSetup = `const __logs=[],__errs=[],__net=[];\n`
+          + `try{page.on('console',m=>{try{__logs.push({type:m.type(),text:m.text()});}catch(_){}});`
+          + `page.on('pageerror',e=>{try{__errs.push(String(e&&e.message||e));}catch(_){}});`
+          + `page.on('requestfinished',r=>{try{const t=r.timing();__net.push({url:String(r.url()).slice(0,120),dur_ms:Math.round(t.responseEnd),ttfb_ms:Math.round(t.responseStart)});}catch(_){}});}catch(_){}\n`;
+        const perfRead = `let __perf=null;try{__perf=await page.evaluate(()=>{const n=performance.getEntriesByType('navigation')[0];return n?{load_ms:Math.round(n.loadEventEnd||0),dcl_ms:Math.round(n.domContentLoadedEventEnd||0),resources:performance.getEntriesByType('resource').length,now:Math.round(performance.now())}:null;});}catch(_){}\n`;
+        if (modeMatch && modeMatch[1] === 'profile') {
+          const userScript = modeMatch[2];
+          const intervalUs = 100;
+          evalBody = debugSetup
+            + `let __profile=null,__profileError=null;\n`
+            + `let __cdp=null;\n`
+            + `try{__cdp=await page.context().newCDPSession(page);await __cdp.send('Profiler.enable');await __cdp.send('Profiler.setSamplingInterval',{interval:${intervalUs}});await __cdp.send('Profiler.start');}catch(e){__profileError=String(e&&e.message||e);__cdp=null;}\n`
+            + `const __result = await (async () => {\n${gotoPrefix}${userScript}\n})();\n`
+            + `if(__cdp){try{const __r=await __cdp.send('Profiler.stop');__profile=__r&&__r.profile||null;}catch(e){__profileError=String(e&&e.message||e);}}\n`
+            + perfRead
+            + AGGREGATE_CPU_PROFILE_SRC + `\n`
+            + `const __agg = __profile ? aggregateCpuProfile(__profile) : {timeframe:null,culprits:[]};\n`
+            + `return {result:__result,profile:__agg,profile_error:__profileError,debug:{console:__logs,pageErrors:__errs,network:__net.slice(0,30),performance:__perf}};`;
+        } else if (modeMatch && modeMatch[1] === 'capture') {
+          const userScript = modeMatch[2];
+          evalBody = debugSetup
             + `const __result = await (async () => {\n${gotoPrefix}${userScript}\n})();\n`
-            + `let __perf=null;try{__perf=await page.evaluate(()=>{const n=performance.getEntriesByType('navigation')[0];return n?{load_ms:Math.round(n.loadEventEnd||0),dcl_ms:Math.round(n.domContentLoadedEventEnd||0),resources:performance.getEntriesByType('resource').length,now:Math.round(performance.now())}:null;});}catch(_){}\n`
+            + perfRead
             + `return {result:__result,debug:{console:__logs,pageErrors:__errs,network:__net.slice(0,30),performance:__perf}};`;
         } else if (startUrl) {
           evalBody = `${gotoPrefix}${evalBody}`;
@@ -3485,9 +3598,9 @@ async function runSpoolWatcher(instance, spoolDir) {
     try {
       const skillCandidates = [
         path.join(wrapperDir, 'SKILL.md'),
-        path.join(wrapperDir, '..', 'gm-skill', 'skills', 'gm-skill', 'SKILL.md'),
-        path.join(wrapperDir, '..', '..', 'gm-skill', 'skills', 'gm-skill', 'SKILL.md'),
-        path.join(wrapperDir, '..', 'skills', 'gm-skill', 'SKILL.md'),
+        path.join(wrapperDir, '..', 'gm-skill', 'skills', 'gm', 'SKILL.md'),
+        path.join(wrapperDir, '..', '..', 'gm-skill', 'skills', 'gm', 'SKILL.md'),
+        path.join(wrapperDir, '..', 'skills', 'gm', 'SKILL.md'),
       ];
       const bundledPath = skillCandidates.find(p => { try { return fs.existsSync(p); } catch (_) { return false; } });
       if (!bundledPath) return;
@@ -3495,8 +3608,8 @@ async function runSpoolWatcher(instance, spoolDir) {
       const bundledHash = crypto.createHash('sha256').update(bundled).digest('hex');
       const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
       const targets = [
-        path.join(home, '.agents', 'skills', 'gm-skill', 'SKILL.md'),
-        path.join(home, '.claude', 'skills', 'gm-skill', 'SKILL.md'),
+        path.join(home, '.agents', 'skills', 'gm', 'SKILL.md'),
+        path.join(home, '.claude', 'skills', 'gm', 'SKILL.md'),
       ];
       const refreshed = [];
       for (const target of targets) {