gm-plugkit 2.0.1635 → 2.0.1637

package/SKILL.md

@@ -34,7 +34,7 @@ Every turn: dispatch `instruction`, read it, follow the imperative, dispatch the
 cat .gm/exec-spool/.status.json 2>/dev/null; echo ---; cat .gm/exec-spool/.turn-summary.json 2>/dev/null; echo ---; date +%s%3N
 ```
 
-`.turn-summary.json` carries `phase`, `last_skill`, `prd_pending`, `last_instruction_ts`, `last_instruction_age_ms`, `long_gap_threshold_ms`, `browser_sessions_alive`, `update_available`, `deviations_30m`, `watcher_uptime_ms`. Age over threshold: your next non-orienting verb is gated, dispatch `instruction` first. `update_available` non-null: eager-upgrade with `bun x gm-plugkit@latest --kill-stale-watchers; bun x gm-plugkit@latest spool` (the spool call blocks until serving), then read `.status.json` to confirm `version`. `deviations_30m` non-zero indicates active drift to investigate before continuing.
+`.turn-summary.json` carries `phase`, `last_skill`, `prd_pending`, `last_instruction_ts`, `last_instruction_age_ms`, `long_gap_threshold_ms`, `browser_sessions_alive`, `update_available`, `deviations_30m`, `watcher_uptime_ms`. Age over threshold: your next non-orienting verb is gated, dispatch `instruction` first. `update_available` non-null: the watcher auto-updates itself when idle (cache-busted self-respawn to latest), so it usually clears on its own within a few minutes -- keep working. To land it immediately, just re-run the idempotent `bun x gm-plugkit@latest spool` (blocks until serving); only add `--kill-stale-watchers` first if it stays stuck across several turns. `PLUGKIT_NO_AUTO_UPDATE=1` pins the version. `deviations_30m` non-zero indicates active drift to investigate before continuing.
 
 Compare `.status.json` `ts` to the printed epoch: gap > 15000 = dead, boot it. Exception: a future `busy_until` means a long verb (browser/chromium spawn blocks the heartbeat ~15-18s) -- wait, do not boot a second watcher.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.1635",
+  "version": "2.0.1637",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform binary, verifies SHA256, and starts the spool watcher daemon. Includes plugkit-wasm-wrapper for WASM-based spool watching.",
   "main": "index.js",
   "bin": {

package/plugkit-wasm-wrapper.js

@@ -308,7 +308,7 @@ function injectUpdateWarning(parsed) {
   if (!upd || !upd.installed || !upd.latest || upd.installed === upd.latest) return;
   const target = (parsed.data && typeof parsed.data === 'object') ? parsed.data : parsed;
   target.update_available = { installed: upd.installed, latest: upd.latest, update_url: upd.update_url || null };
-  target.update_warning = `STALE RUNTIME: running plugkit ${upd.installed} but ${upd.latest} is published and not yet running. Restart onto the new version now: bun x gm-plugkit@latest --kill-stale-watchers; bun x gm-plugkit@latest spool. This warning repeats every turn until the running version catches up.`;
+  target.update_warning = `STALE RUNTIME: running plugkit ${upd.installed} but ${upd.latest} is published. The watcher auto-updates when idle (cache-busted self-respawn to latest), so this usually clears on its own within a few minutes; just keep working. If it persists, re-run the idempotent boot to land latest now: bun x gm-plugkit@latest spool (add --kill-stale-watchers first only if it stays stuck). Set PLUGKIT_NO_AUTO_UPDATE=1 to pin. This warning repeats until the running version catches up.`;
 }
 
 function mergeAutoRecallIntoInstructionResponse(resultStr, autoRecall) {
@@ -1457,8 +1457,9 @@ function createWasiShim(instanceRef) {
         const dv = new DataView(buf);
         const chunks = [];
         let total = 0;
+        const iovsBase = iovs_ptr >>> 0;   // >>>0: high-bit iovs pointer is negative in JS -> getUint32 would throw
         for (let i = 0; i < iovs_len; i++) {
-          const base = iovs_ptr + i * 8;
+          const base = iovsBase + i * 8;
           const ptr = dv.getUint32(base, true);
           const len = dv.getUint32(base + 4, true);
           if (len > 0 && ptr + len <= buf.byteLength) {
@@ -1480,7 +1481,7 @@ function createWasiShim(instanceRef) {
     },
     random_get: (buf_ptr, buf_len) => {
       try {
-        crypto.randomFillSync(new Uint8Array(getMemory(), buf_ptr, buf_len));
+        crypto.randomFillSync(new Uint8Array(getMemory(), buf_ptr >>> 0, buf_len >>> 0));   // >>>0: high-bit ptr is negative in JS
         return 0;
       } catch (e) {
         return 28;
@@ -1489,7 +1490,7 @@ function createWasiShim(instanceRef) {
     clock_time_get: (clock_id, precision, time_ptr) => {
       try {
         const ns = BigInt(Date.now()) * 1000000n;
-        new DataView(getMemory()).setBigUint64(time_ptr, ns, true);
+        new DataView(getMemory()).setBigUint64(time_ptr >>> 0, ns, true);   // >>>0: high-bit ptr is negative in JS
         return 0;
       } catch (e) {
         return 28;
@@ -1548,8 +1549,15 @@ function decodeWasmResult(instance, result, where) {
 
 function writeWasmInput(instance, bytes, where) {
   if (bytes.length === 0) return 0;
-  const ptr = instance.exports.plugkit_alloc(bytes.length);
+  // COERCE the alloc pointer to UNSIGNED 32-bit: a wasm i32 return with the high bit set (a pointer
+  // > 0x7fffffff, which occurs once the linear memory grows past ~2GB in a long session) arrives in JS
+  // as a NEGATIVE number, and new Uint8Array(buffer, negativePtr, len) throws the raw V8 "Start offset
+  // <neg> is outside the bounds of the buffer" -- the deterministic long-session corruption that blocked
+  // dispatches. >>>0 reinterprets the i32 as the true unsigned offset. Guard the range too so a genuinely
+  // bad (ptr,len) raises the clean wasm-memory-read-out-of-bounds error instead of a raw typed-array throw.
+  const ptr = instance.exports.plugkit_alloc(bytes.length) >>> 0;
   if (ptr === 0) throw new Error(`wasm-alloc-failed at ${where}: plugkit_alloc returned 0 (wasm OOM)`);
+  guardWasmRange(instance.exports.memory.buffer, ptr, bytes.length, `${where}:writeWasmInput`);
   new Uint8Array(instance.exports.memory.buffer, ptr, bytes.length).set(bytes);   // fresh buffer post-alloc
   return ptr;
 }
@@ -1571,8 +1579,11 @@ function readWasmStr(instance, ptr, len) {
 
 function writeWasmBytes(instance, bytes) {
   if (bytes.length === 0) return 0n;
-  const ptr = instance.exports.plugkit_alloc(bytes.length);
+  // >>>0: same signed-pointer fix as writeWasmInput -- a high-bit alloc pointer is negative in JS and
+  // throws "Start offset <neg> is outside the bounds" on the Uint8Array write below.
+  const ptr = instance.exports.plugkit_alloc(bytes.length) >>> 0;
   if (ptr === 0) return 0n;
+  guardWasmRange(instance.exports.memory.buffer, ptr, bytes.length, 'writeWasmBytes');
   new Uint8Array(instance.exports.memory.buffer, ptr, bytes.length).set(bytes);
   return (BigInt(ptr) & 0xffffffffn) | (BigInt(bytes.length) << 32n);
 }
@@ -2256,7 +2267,7 @@ function makeHostFunctions(instanceRef) {
     host_random_fill: (ptr, len) => {
       try {
         const buf = instanceRef.value.exports.memory.buffer;
-        crypto.randomFillSync(new Uint8Array(buf, ptr, len));
+        crypto.randomFillSync(new Uint8Array(buf, ptr >>> 0, len >>> 0));   // >>>0: high-bit ptr is negative in JS
         return 1;
       } catch (_) {
         return 0;
@@ -2904,6 +2915,10 @@ async function runSpoolWatcher(instance, spoolDir) {
   let _selfStaleProbeErrorLogged = false;
   function probeGmPlugkitSelfStale() {
     try {
+      if (process.env.PLUGKIT_NO_AUTO_UPDATE === '1') return;
+      const { sids: _ifSids } = (typeof inflightPids === 'function') ? inflightPids() : { sids: new Set() };
+      if (_ifSids.size > 0) return;
+      if ((Date.now() - lastActivityMs) < 30000) return;
       const ownPkgVersionFile = path.join(GM_TOOLS_ROOT, 'gm-plugkit.version');
       const ownPkgJsonFile = path.join(__dirname, 'package.json');
       let own = null;
@@ -2975,7 +2990,7 @@ async function runSpoolWatcher(instance, spoolDir) {
               try {
                 const cp = _childProcess;
                 const bunPath = process.env.GM_BUN_PATH || 'bun';
-                const bustCache = sameStaleAsBefore || cameFromSelfRespawn;
+                const bustCache = true;
                 if (bustCache) {
                   try { cp.execFileSync(bunPath, ['pm', 'cache', 'rm'], { stdio: 'ignore', timeout: 30000, windowsHide: true }); } catch (_) {}
                   try {
@@ -3002,7 +3017,7 @@ async function runSpoolWatcher(instance, spoolDir) {
                   env: { ...process.env, PLUGKIT_BOOT_REASON: 'self-respawn-from-self-stale' },
                 });
                 child.unref();
-                try { logEvent('plugkit', 'gm-plugkit.self-stale-respawn', { running_version: own, latest_version: latest, cache_busted: bustCache, attempt: (respawnGuard.attempts || 0) + 1 }); } catch (_) {}
+                try { logEvent('plugkit', 'update.auto-applying', { running_version: own, latest_version: latest, cache_busted: bustCache, attempt: (respawnGuard.attempts || 0) + 1, note: 'auto-update: cache-busted self-respawn to latest' }); } catch (_) {}
                 try { fs.writeFileSync(path.join(spoolDir, '.shutdown-reason.json'), JSON.stringify({ reason: 'gm-plugkit-self-stale', ts: Date.now(), pid: process.pid, running_version: own, latest_version: latest })); } catch (_) {}
                 const myPid = process.pid;
                 const respawnDeadline = Date.now() + 90000;