gm-skill 2.0.1335 → 2.0.1337

package/bin/plugkit.version

@@ -1 +1 @@
-0.1.500
+0.1.501

package/bin/plugkit.wasm.sha256

@@ -1 +1 @@
-6661c56bb5f57b4fe9545dcb2ca5cc6ffa6e57cbac2ef3f77f03133fd55b69ae  plugkit.wasm
+242f4e3fa2b916e509aefb360e49558d7684bdbb34f3ae55e1febdaa04350a6b  plugkit.wasm

package/gm-plugkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.1335",
+  "version": "2.0.1337",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform binary, verifies SHA256, and starts the spool watcher daemon. Includes plugkit-wasm-wrapper for WASM-based spool watching.",
   "main": "index.js",
   "bin": {

package/gm-plugkit/plugkit-wasm-wrapper.js

@@ -2518,9 +2518,60 @@ async function runSpoolWatcher(instance, spoolDir) {
 
   const UPDATE_AVAILABLE_PATH = path.join(spoolDir, '.update-available.json');
   const UPDATE_CHECK_INTERVAL_MS = 5 * 60 * 1000;
+  const UPDATE_CHECK_SHARED_CACHE = path.join(GM_TOOLS_ROOT, '.update-check-cache.json');
+  const UPDATE_CHECK_CACHE_TTL_MS = 4 * 60 * 1000;
   let _lastKnownDrift = null;
+  function readSharedUpdateCache() {
+    try {
+      const content = fs.readFileSync(UPDATE_CHECK_SHARED_CACHE, 'utf-8');
+      const parsed = JSON.parse(content);
+      if (parsed && parsed.ts && parsed.latest && (Date.now() - parsed.ts) < UPDATE_CHECK_CACHE_TTL_MS) {
+        return parsed;
+      }
+    } catch (_) {}
+    return null;
+  }
+  function writeSharedUpdateCache(latest, status) {
+    try {
+      fs.mkdirSync(path.dirname(UPDATE_CHECK_SHARED_CACHE), { recursive: true });
+      const tmp = UPDATE_CHECK_SHARED_CACHE + '.tmp.' + process.pid;
+      fs.writeFileSync(tmp, JSON.stringify({ ts: Date.now(), latest, status, by_pid: process.pid }));
+      fs.renameSync(tmp, UPDATE_CHECK_SHARED_CACHE);
+    } catch (_) {}
+  }
+  function applyUpdateCheckResult(installed, latest, statusCode) {
+    if (statusCode !== 200) {
+      logEvent('plugkit', 'update.check.error', { installed, status: statusCode });
+      return;
+    }
+    if (!latest) return;
+    if (latest === installed) {
+      try { fs.unlinkSync(UPDATE_AVAILABLE_PATH); } catch (_) {}
+      if (_lastKnownDrift) {
+        logEvent('plugkit', 'update.cleared', { installed, was: _lastKnownDrift });
+        _lastKnownDrift = null;
+      }
+      return;
+    }
+    const isDrift = latest !== installed;
+    if (isDrift && _lastKnownDrift !== latest) {
+      try {
+        fs.writeFileSync(UPDATE_AVAILABLE_PATH, JSON.stringify({
+          installed, latest, ts: Date.now(),
+          update_url: `https://github.com/AnEntrypoint/plugkit-bin/releases/tag/v${latest}`,
+        }));
+      } catch (_) {}
+      logEvent('plugkit', 'update.available', { installed, latest });
+      _lastKnownDrift = latest;
+    }
+  }
   function checkForUpdate() {
     const installed = resolveVersion(instance);
+    const cached = readSharedUpdateCache();
+    if (cached) {
+      applyUpdateCheckResult(installed, cached.latest, cached.status || 200);
+      return;
+    }
     const req = https.get({
       host: 'api.github.com',
       path: '/repos/AnEntrypoint/plugkit-bin/releases/latest',
@@ -2529,7 +2580,8 @@ async function runSpoolWatcher(instance, spoolDir) {
     }, (res) => {
       if (res.statusCode !== 200) {
         res.resume();
-        logEvent('plugkit', 'update.check.error', { installed, status: res.statusCode });
+        writeSharedUpdateCache(null, res.statusCode);
+        applyUpdateCheckResult(installed, null, res.statusCode);
         return;
       }
       const chunks = [];
@@ -2540,6 +2592,7 @@ async function runSpoolWatcher(instance, spoolDir) {
           const tag = rel && rel.tag_name;
           if (!tag) return;
           const latest = tag.replace(/^v/, '');
+          writeSharedUpdateCache(latest, 200);
           if (latest === installed) {
             try { fs.unlinkSync(UPDATE_AVAILABLE_PATH); } catch (_) {}
             if (_lastKnownDrift) {

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.1335",
+  "version": "2.0.1337",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",
@@ -17,5 +17,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "plugkitVersion": "0.1.500"
+  "plugkitVersion": "0.1.501"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-skill",
-  "version": "2.0.1335",
+  "version": "2.0.1337",
   "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
   "author": "AnEntrypoint",
   "license": "MIT",

package/skills/gm-skill/SKILL.md

@@ -18,6 +18,8 @@ Every turn: dispatch `instruction` (you are the one dispatching it), read the re
 
 **Once `phase=COMPLETE` AND `prd_pending_count=0`, the chain is closed and you stop dispatching.** Polling `instruction` on a terminal chain returns the same UPDATE-DOCS prose every time and produces `turn.end dispatches:1 verbs:{instruction:1}` events in gmsniff that mark the agent as polling rather than walking. The user reactivates the chain by sending a new prompt; that prompt resets phase to PLAN on the next instruction dispatch carrying a fresh `{"prompt": "..."}` body.
 
+**Client-side edits are gated by Browser Witness (paper §23, hard rule).** If you Write or Edit any file with a client-side extension — `.html`, `.js`, `.jsx`, `.ts`, `.tsx`, `.vue`, `.svelte`, `.mjs`, `.css`, or anything loaded from an HTML entry — you dispatch the `browser` verb in the **same turn** with a `page.evaluate` body that asserts the invariant the edit establishes. The transition gate refuses `transition to=COMPLETE` until `.turn-browser-witnessed` covers every entry in `.turn-browser-edits.json` with matching sha; absence or mismatch fires `deviation.client-edit-no-witness`. There is no "validate later" — later does not arrive in the chain you are walking; the same response that contains the client-side Write/Edit also contains the `browser` Write + Read.
+
 **Boot before dispatching. Always check first.** Writing to `.gm/exec-spool/in/instruction/N.txt` while the watcher is dead is the canonical cold-start failure — the request sits forever, you read no response, you fabricate the chain from memory of the prose. The spool directory's existence does NOT mean the watcher is alive; `.status.json` mtime within the last 15s does. The leftover `.status.json` from yesterday's dead watcher is the most common trap.
 
 Your first tool call of every session is the boot probe, in one Bash invocation: