gm-skill 2.0.1206 → 2.0.1208

package/README.md

@@ -1,6 +1,6 @@
 # gm-skill — Canonical Universal Harness
 
-The single shipped skill for gm. Install into any harness that loads Claude-style skill directories — Claude Code, OpenCode, Cursor, Zed, VS Code, Codex, Kilo, JetBrains, Copilot CLI, Antigravity, Windsurf, Gemini CLI — and plugkit serves every phase instruction, mutables row, and guardrail on demand via the spool.
+The single shipped skill for gm. Install into any harness that loads Claude-style skill directories — Claude Code, OpenCode, Cursor, Zed, VS Code, Codex, Kilo, JetBrains, Copilot CLI, Antigravity, Windsurf, Gemini CLI — and you dispatch the `instruction` verb each turn to read every phase directive, mutables row, and guardrail from plugkit via the spool. You are the state machine; plugkit serves the response the moment you write the request.
 
 ## What this is
 
@@ -35,7 +35,7 @@ An earlier generation fanned out fifteen per-platform downstream repos (gm-cc, g
 
 ## Version
 
-`2.0.1206` — auto-bumped from the canonical `gm` repo. Every push to `AnEntrypoint/gm` (or any cascading sibling crate) republishes this package.
+`2.0.1208` — auto-bumped from the canonical `gm` repo. Every push to `AnEntrypoint/gm` (or any cascading sibling crate) republishes this package.
 
 ## Source of truth
 

package/bin/plugkit.version

@@ -1 +1 @@
-0.1.443
+0.1.444

package/bin/plugkit.wasm.sha256

@@ -1 +1 @@
-9ae6f13ee3e4f2c3da128f4ed268ed2a56b370488cd2c937d51f7eecfd5ebad6  plugkit.wasm
+c15068d2910d08d9a1de8cecd05e658f553f0e77af3ed6848b4a76485880d580  plugkit.wasm

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.1206",
+  "version": "2.0.1208",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",
@@ -17,5 +17,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "plugkitVersion": "0.1.443"
+  "plugkitVersion": "0.1.444"
 }

package/lib/spool-dispatch.js

@@ -185,6 +185,26 @@ function markInstructionSeen(sessionId) {
   } catch (_) {}
 }
 
+const SPOOL_POLL_PATTERNS = [
+  /\bsleep\s+\d+(?:\.\d+)?\s*[;&]+\s*(?:cat|ls|tail|head|find|test|grep)\b[^|]*\.gm[\\/](?:exec-spool|spool)/i,
+  /\bStart-Sleep\b[^;|]*?[;|]\s*(?:Get-Content|Test-Path|Get-ChildItem|cat|ls|gci|gc|tp)\b[^|]*\.gm[\\/](?:exec-spool|spool)/i,
+  /\b(?:cat|ls|tail|head|Get-Content|Test-Path|Get-ChildItem)\b[^|]*\.gm[\\/](?:exec-spool|spool)[^|]*?[;&|]+\s*(?:sleep|Start-Sleep)\b/i,
+  /\bwhile\b[^;]*?(?:!|-not)\s*(?:-(?:f|e)\s+|Test-Path\s+)[^;]*?\.gm[\\/](?:exec-spool|spool)/i,
+  /\buntil\b[^;]*?(?:-f|-e|Test-Path)\s+[^;]*?\.gm[\\/](?:exec-spool|spool)/i,
+  /\bfor\s+i\s+in\b[^;]*?;\s*do\b[^;]*?(?:sleep|Start-Sleep)[^;]*?\.gm[\\/](?:exec-spool|spool)/i,
+];
+
+const SPOOL_POLL_REASON = 'spool polling is forbidden — plugkit is synchronous from your view. Read the response file at .gm/exec-spool/out/<verb>-<N>.json directly with the Read tool. If it does not exist, the watcher is either dead (check .gm/exec-spool/.status.json mtime) or the verb is genuinely slow (read .gm/exec-spool/.watcher.log for the dispatch trace). Polling with sleep+cat/ls/Test-Path treats plugkit as an async worker; it is not. You are the state machine; plugkit serves the response the moment you write the request.';
+
+function isSpoolPollCommand(command) {
+  if (!command) return null;
+  const s = String(command);
+  for (const re of SPOOL_POLL_PATTERNS) {
+    if (re.test(s)) return re.source;
+  }
+  return null;
+}
+
 const DEFER_MARKERS = [
   'next pass', 'next session', 'next turn',
   'defer to later', 'deferred to later', 'deferred for later',
@@ -256,6 +276,14 @@ function checkDispatchGates(sessionId, operation, extra) {
     logDeviation('deviation.write-before-instruction', { operation, sessionId });
   }
 
+  if (operation === 'bash' && extra && extra.command) {
+    const pattern = isSpoolPollCommand(extra.command);
+    if (pattern) {
+      logDeviation('deviation.spool-poll', { operation, pattern, command_excerpt: String(extra.command).slice(0, 200) });
+      return { allowed: false, reason: SPOOL_POLL_REASON };
+    }
+  }
+
   if (operation === 'mutable-resolve' && extra && (!extra.witness_evidence || String(extra.witness_evidence).trim() === '')) {
     logDeviation('deviation.mutable-without-evidence', { mutable_id: extra.id || null });
   }
@@ -291,4 +319,4 @@ function checkDispatchGates(sessionId, operation, extra) {
   return { allowed: true };
 }
 
-module.exports = { dispatchSpool, checkDispatchGates, isWorktreeDirty, hasUnpushedCommits, unsolicitedDocs, logDeviation, markInstructionSeen, hasDispatchedInstruction };
+module.exports = { dispatchSpool, checkDispatchGates, isWorktreeDirty, hasUnpushedCommits, unsolicitedDocs, logDeviation, markInstructionSeen, hasDispatchedInstruction, isSpoolPollCommand, SPOOL_POLL_REASON };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-skill",
-  "version": "2.0.1206",
+  "version": "2.0.1208",
   "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
   "author": "AnEntrypoint",
   "license": "MIT",
@@ -39,7 +39,7 @@
     "gm.json"
   ],
   "dependencies": {
-    "gm-plugkit": "^2.0.1206"
+    "gm-plugkit": "^2.0.1208"
   },
   "engines": {
     "node": ">=16.0.0"