gm-skill 2.0.1576 → 2.0.1578

package/AGENTS.md

@@ -118,11 +118,11 @@ Every skill's `allowed-tools:` is reduced to `Skill, Read, Write` (plus the SKIL
 
 **AGENTS.md / CLAUDE.md are inline-edited AND dual-written to the store**: edit them inline for structural rules (the only doc surviving context summarization), AND `memorize-fire` the same rule so `recall`/`auto_recall` surface it later -- complementary, not alternatives. Never `namespace:"AGENTS.md"`; load-bearing rules go to the default namespace. Mechanics in rs-learn (`recall: memorize-fire ingestion classifier`).
 
-**A memorized workaround is a tool defect; transform it, never accumulate it**: we work USING gm, not ON it, so a `recall` memo framed as a workaround, known-limitation, or internal-advice is tribal knowledge a fresh user/LLM lacks -- the tool then surprises them, and surprises are never allowed; everything must be abundantly predictable at face value. Resolve every such memo one of three ways, then prune it: (a) already covered by the standing prose (SKILL.md / instruction bundle) -> prune the redundant recall; (b) prose-worthy but absent -> add the rule to the prose, then prune; (c) genuine surprising behavior -> fix the code so it is predictable, then prune. `recall` carries project work-context (what the work surfaced about the user's problem), never tool-operation advice -- the tool's prose + behavior alone make every operation predictable. Witnessed transforms: CRLF/LF const-drift -> sync LF-normalization; codesearch cwd-scope -> the search-routing prose clause.
+**A memorized workaround is a tool defect; transform it, never accumulate it**: we work USING gm, not ON it, so a `recall` memo framed as a workaround, known-limitation, or internal-advice is tribal knowledge a fresh user/LLM lacks -- the tool then surprises them, and surprises are never allowed; everything must be abundantly predictable at face value. Resolve: (a) already in standing prose -> prune recall; (b) prose-worthy but absent -> add to prose then prune; (c) genuinely surprising behavior -> fix code so it is predictable then prune.
 
 **Behavioral discipline lives in plugkit's `instruction` verb**: dispatch `instruction` for the live phase-specific prose (Three-Layer Admission Filter, maturity-first emit, closure anti-shapes, code invariants); do not duplicate it here. Enumeration in rs-learn (`recall: instruction-verb behavioral discipline invariants`).
 
-**The agent IS the LLM rs-learn calls**: rs-learn never reaches a separate judge model for a quality score, relevance, prune, route, or loss signal -- plugkit IS the harness and the agent IS the model, each an inline decision reported through the spool. Per-core internals in rs-learn (`recall: rs-learn self-report core internals`).
+**The agent IS the LLM rs-learn calls**: no separate judge model; all decisions are inline via spool. Internals in rs-learn (`recall: rs-learn self-report core internals`).
 
 **host_exec_js is synchronous**: pass a real per-call `timeoutMs` (zero/missing is a hard error). Detail in rs-learn (`recall: host_exec_js synchronous`).
 
@@ -148,13 +148,13 @@ Push to any rs-* sibling triggers `cascade.yml` -> rs-plugkit `release.yml` -> s
 
 Orchestration state is tracked via `.gm/` marker files, not hook events; the CLI layer calls `checkDispatchGates()` before tool execution to gate Write/Edit/git. Marker set (`prd.yml, mutables.yml, needs-gm, gm-fired-<sessionId>, residual-check-fired`) + SpoolDispatcher mechanism in rs-learn (`recall: gate enforcement layer`, `recall: spool dispatch gates marker files`).
 
-**gm-skill tool-use sequencing**: `Skill(skill="gm-skill")` writes `.gm/gm-fired-<sessionId>` to clear the needs-gm gate (cleared at turn start to reset it). One shipped skill, no subagent variant.
+**gm-skill tool-use sequencing**: `Skill(skill="gm-skill")` clears the needs-gm gate. One shipped skill, no subagent variant. Marker mechanics in rs-learn (`recall: gm-skill tool-use sequencing mechanics`).
 
 **The skill is the driver, not a post-hoc witness**: when a request carries the standing instruction to use gm-skill (every `/loop` fire, any prompt naming `/gm-skill`), the FIRST working action is `Skill(skill="gm-skill")`, and the skill prose drives the chain PLAN->COMPLETE. Dispatching spool verbs directly without first entering the skill executes the work outside the skill the user asked to drive it; entering only at the end to confirm terminal state does NOT satisfy the instruction. The boot probe (`cat .gm/exec-spool/.status.json` ...) is prescribed by the skill and may precede invocation; everything that mutates state happens inside the skill-driven session.
 
 **Dead-watcher recovery uses `bun x gm-plugkit@latest spool`, never direct-node boot** (mechanism in rs-learn: `recall: dead-watcher recovery bun x not direct-node`).
 
-**The first verb after a genuine multi-minute IDLE is `instruction`, to reset the long-gap clock**: the gate fires on genuine idle only (>300s since the last instruction AND >300s since any verb), so active back-to-back work verbs keep the chain alive without an interleaved `instruction` -- do not inject defensive instruction dispatches between active work. A true wait (version download, overnight, long external CI watch) trips it, and the first verb back is `instruction`. When the wait is self-inflicted and predictable (a blocking `TaskOutput`/`gh run watch`), dispatch `instruction` immediately BEFORE entering the wait, not only after. "Work verbs"/"any verb" here means SPOOL dispatches -- platform `Bash`/`Read`/`Edit`/`Grep` do NOT reset the clock, so a long investigation run purely in them (the audit `gmsniff`/`ccsniff` sweep + source reading/editing exceeding 300s) trips a false `mid-chain-stall` even while actively working; interleave a `prd-add` (convert each finding as it emerges per density-grows-along-the-walk) or an `instruction` to keep the clock warm. Mechanism in rs-learn (`recall: first verb after multi-minute wait instruction long-gap`).
+**The first verb after a genuine multi-minute IDLE is `instruction`, to reset the long-gap clock**: gate fires when >300s since last instruction AND >300s since any SPOOL verb. Platform `Bash`/`Read`/`Edit`/`Grep` do NOT reset the clock -- a long investigation run in them trips a false stall; interleave `prd-add` or `instruction` to keep warm. For a predictable blocking wait (`TaskOutput`/`gh run watch`), dispatch `instruction` BEFORE entering the wait. Detail + platform-tool exception in rs-learn (`recall: first verb after multi-minute wait instruction long-gap`).
 
 **A stop-hook firing on a terminal chain does not authorize re-polling**: when a stop-hook fires while already at `phase=COMPLETE` AND `prd_pending_count=0`, re-dispatching `instruction`/`phase-status` to "re-confirm" is a deviation (`deviation.complete-chain-poll`, `instructions/mod.rs`). Two admissible responses: (a) a prose-only turn (COMPLETE is in hand), or (b) genuinely new planned work opened with a FRESH `{"prompt":...}` body (resets phase to PLAN, driven through the skill). Repeatedly answering the same hook is a loop; state the terminal facts once and stop, or open new work.
 

package/gm-plugkit/bootstrap.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 'use strict';
 
 const fs = require('fs');
@@ -7,10 +7,6 @@ const os = require('os');
 const crypto = require('crypto');
 const { spawn, spawnSync } = require('child_process');
 
-// Resolve a bare command name to its actual .exe on Windows. cmd.exe + .cmd
-// shim chains re-enter conhost (visible window flash) even with
-// windowsHide:true on the parent. Spawning the real .exe directly lets
-// CREATE_NO_WINDOW propagate. See [[windows-spawn-cmd-shim-flash]].
 function resolveWindowsExe(cmd) {
   if (process.platform !== 'win32') return cmd;
   try {
@@ -683,11 +679,6 @@ function copyWasmToGmTools(wasmPath, version) {
     } catch (_) {}
   }
   if (!wasmFresh) {
-    // copyFileSync truncates the target before streaming ~149MB, leaving a window where
-    // a crash or a concurrent watcher load sees a truncated/absent wasm (the
-    // "self-heal: wasm not installed" crash-loop during an upgrade). Copy to a
-    // pid-suffixed temp and rename over the target: same-volume rename is atomic,
-    // with the Windows EEXIST/EPERM unlink+retry.
     const tmp = `${target}.partial-${process.pid}`;
     fs.copyFileSync(wasmPath, tmp);
     try { fs.renameSync(tmp, target); }

package/gm-plugkit/lang-host-runner.js

@@ -1,7 +1,4 @@
 #!/usr/bin/env node
-// Legacy fallback. The canonical surface for lang/*.js plugins is the wasm
-// `lang` verb in rs-plugkit, dispatched via .gm/exec-spool/in/lang/<N>.txt.
-// This standalone runner is kept for direct CLI debug + pre-cascade situations.
 'use strict';
 const fs = require('fs');
 const path = require('path');

package/gm-plugkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.1576",
+  "version": "2.0.1578",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform binary, verifies SHA256, and starts the spool watcher daemon. Includes plugkit-wasm-wrapper for WASM-based spool watching.",
   "main": "index.js",
   "bin": {

package/gm-plugkit/plugkit-wasm-wrapper.js

@@ -1,4 +1,4 @@
-import fs from 'fs';
+import fs from 'fs';
 import path from 'path';
 import os from 'os';
 import crypto from 'crypto';
@@ -13,16 +13,8 @@ const _httpModule = http;
 const _httpsModule = https;
 import { fileURLToPath } from 'url';
 
-// Set by the spool watcher's writeStatus closure once it is live. Lets long synchronous verbs
-// (browser/chromium spawn, long exec) stamp a busy_until window into .status.json before the
-// blocking call, so a liveness probe reads "busy" not "dead" while the event loop is blocked.
 let _writeStatusBusy = () => {};
-// Latest busy_until epoch ms stamped by a long synchronous verb (codesearch rebuild, chromium
-// spawn). scanStalledTurns reads it so a busy watcher is not mis-flagged as an idle stall.
 let _lastBusyUntil = 0;
-// First 12 hex of sha256 of this watcher's own gmTools wrapper. Module-scoped so writeStatus
-// (a different function scope) can stamp status.wrapper_sha, which the supervisor compares
-// against the on-disk wrapper to recycle a watcher running a stale wrapper-only fix.
 let _ownWrapperSha12 = '';
 
 function spawnSync(cmd, args, opts) {
@@ -346,18 +338,12 @@ function turnTick(sess, verb, taskBase, phase, prdPending) {
   const key = sess || '(no-session)';
   const now = Date.now();
   let t = _turns.get(key);
-  // Any verb arriving after an idle gap closes the stale turn -- not just instruction.
-  // Otherwise a non-instruction verb (prd-add, mutable-resolve, transition) landing
-  // after an overnight sleep stamps t.lastTs forward without splitting, and dur_ms
-  // (lastTs - startTs) balloons to wall-clock-with-sleep instead of active work time.
   if (t && (now - t.lastTs) > TURN_IDLE_MS) {
     endTurn(sess, t, true);
     _turns.delete(key);
     t = null;
   }
   if (!t) {
-    // Only an instruction dispatch opens a new turn; a stray non-instruction verb after
-    // idle is recorded against no turn (the next instruction starts the real turn).
     if (verb !== 'instruction') return;
     const idx = ((_turns.get(key + ':lastIdx') || 0) + 1);
     _turns.set(key + ':lastIdx', idx);
@@ -367,27 +353,15 @@ function turnTick(sess, verb, taskBase, phase, prdPending) {
   }
   t.lastTs = now;
   t.dispatches++;
-  // A verb arriving resumes the turn -- clear any prior stall flag so a later re-stall
-  // is a fresh episode, not silently suppressed by the one-shot guard.
   t.stallEmitted = false;
   t.verbs.set(verb, (t.verbs.get(verb) || 0) + 1);
   if (phase) { t.phases.add(phase); t.lastPhase = phase; }
   if (typeof prdPending === 'number') t.prdPending = prdPending;
 }
 
-// turn.end fires only when a NEW verb arrives after idle, so a turn that simply never
-// receives another verb stays open forever and emits no signal -- a permanent stall is
-// silence, not an event, which is how a mid-EXECUTE stop stays invisible for days. The
-// heartbeat scan closes that hole: for each open turn idle past STALL_MS whose last phase
-// is non-terminal (or carries open PRD rows), emit turn.stalled once. One-shot per episode
-// (stallEmitted), reset when a verb resumes the turn. A COMPLETE turn with no open rows
-// idling is the authorized prose-only state and never stalls.
 const STALL_MS = 300_000;
 function scanStalledTurns() {
   const now = Date.now();
-  // A long synchronous verb (codesearch index rebuild, chromium spawn) stamps busy_until and
-  // blocks the spool -- the agent is legitimately waiting, not stalled. Honor it exactly as
-  // supervisor.js checkWatcherHealth does, so a busy watcher never emits a false mid-chain-stall.
   if (_lastBusyUntil && _lastBusyUntil > now) return;
   for (const [key, t] of _turns) {
     if (!t || typeof t !== 'object' || !Number.isFinite(t.startTs)) continue;
@@ -396,9 +370,6 @@ function scanStalledTurns() {
     const terminal = t.lastPhase === 'COMPLETE' && (t.prdPending === 0 || t.prdPending == null);
     if (terminal) continue;
     t.stallEmitted = true;
-    // key is the _turns map key (sess || '(no-session)'). When it is the sentinel, the turn was
-    // unattributed, so do not override logEvent's own cwd+sess base fields with '(no-session)' --
-    // let the cwd-based attribution stand. Pass an explicit sess only when key is a real session.
     const fields = {
       turn_idx: t.idx,
       ended_in_phase: t.lastPhase || null,
@@ -411,10 +382,6 @@ function scanStalledTurns() {
   }
 }
 
-// Every spool dispatch is the agent actively driving the chain, including wasm-direct verbs
-// (recall/codesearch/exec_js/git/fetch) that never reach turnTick. Refresh the open turn's stall
-// clock so a Bash-free stretch of pure wasm-direct verbs does not trip a false mid-chain-stall
-// (the recurring audit-fire own-defect). Never create or split a turn -- that stays turnTick's job.
 function touchActiveTurn(sess) {
   const t = _turns.get(sess || '(no-session)');
   if (!t) return;
@@ -888,8 +855,6 @@ function runBrowserRunner(pw, args, timeoutMs, cwd, claudeSessionId) {
   const sockDir = playwriterHomeFor(cwd, claudeSessionId);
   try { fs.mkdirSync(sockDir, { recursive: true }); } catch (_) {}
   env.PLAYWRITER_HOME = sockDir;
-  // Stamp a busy window before the synchronous spawn so the blocked event loop's stale heartbeat
-  // is not misread as a dead watcher. Pad past the spawn timeout for teardown.
   _writeStatusBusy((timeoutMs || 30000) + 5000);
   return spawnSync(spawnCmd, spawnArgs, {
     encoding: 'utf-8',
@@ -911,9 +876,6 @@ function scrubBrowserRunnerText(s) {
   return t;
 }
 
-// Standard OS install locations for a Chrome/Chromium that speaks CDP. Used as a
-// fallback when the managed ms-playwright cache is absent (e.g. cache evicted),
-// so the browser verb keeps working off the system browser instead of failing.
 function findSystemChromiumBinary() {
   const candidates = process.platform === 'win32'
     ? [
@@ -1721,8 +1683,6 @@ function makeHostFunctions(instanceRef) {
         const key = readWasmStr(instanceRef.value, keyPtr, keyLen);
         if (!ns || !key) return 0;
         let removed = 0;
-        // Delete the key from the namespace AND its -vec sibling across every enabled discipline dir,
-        // so a pruned memory leaves no orphan embedding that host_vec_search would still surface.
         for (const baseNs of [ns, `${ns}-vec`]) {
           for (const dir of kvNamespaceDirs(baseNs)) {
             const fp = path.join(dir, safeName(key) + '.json');
@@ -2139,8 +2099,8 @@ async function runSpoolWatcher(instance, spoolDir) {
   }
   function lockBody() { return `${process.pid}|${Date.now()}|${_ownWrapperSha12}`; }
   function acquireLock() {
-    try {
-      if (fs.existsSync(LOCK_PATH)) {
+    function checkExistingHolder() {
+      try {
         const content = fs.readFileSync(LOCK_PATH, 'utf-8').trim();
         const parts = content.split('|');
         const pidStr = parts[0];
@@ -2164,6 +2124,7 @@ async function runSpoolWatcher(instance, spoolDir) {
               }));
             } catch (_) {}
             try { process.kill(parseInt(pidStr, 10), 'SIGTERM'); } catch (_) {}
+            return 'takeover';
           } else {
             const msg = JSON.stringify({ ok: false, reason: 'another-watcher-active', pid: pidStr, age_ms: age });
             console.error(`[plugkit-wasm] ${msg}; refusing to start`);
@@ -2181,11 +2142,32 @@ async function runSpoolWatcher(instance, spoolDir) {
         } else if (!holderAlive) {
           console.error(`[plugkit-wasm] stale lock (holder pid=${pidStr} dead, age=${age}ms); taking over`);
           try { logEvent('plugkit', 'watcher.lock-pid-dead-takeover', { stale_pid: pidStr, lock_age_ms: age }); } catch (_) {}
+          return 'takeover';
         } else {
           console.error(`[plugkit-wasm] stale lock (age=${age}ms); taking over`);
+          return 'takeover';
         }
+      } catch (_) {
+        return 'takeover';
+      }
+    }
+    try {
+      let fd;
+      try {
+        fd = fs.openSync(LOCK_PATH, 'wx');
+      } catch (e) {
+        if (e.code !== 'EEXIST') throw e;
+        const action = checkExistingHolder();
+        if (action !== 'takeover') return;
+        try { fs.unlinkSync(LOCK_PATH); } catch (_) {}
+        fd = fs.openSync(LOCK_PATH, 'wx');
+      }
+      try {
+        const body = Buffer.from(lockBody(), 'utf-8');
+        fs.writeSync(fd, body);
+      } finally {
+        fs.closeSync(fd);
       }
-      fs.writeFileSync(LOCK_PATH, lockBody());
     } catch (e) {
       console.error(`[plugkit-wasm] lock acquire failed: ${e.message}`);
       process.exit(1);
@@ -2227,13 +2209,6 @@ async function runSpoolWatcher(instance, spoolDir) {
           detected_at: Date.now(),
         });
         try { console.error(`[plugkit-wasm] VERB ABORT detected: prior watcher pid=${priorVerb.pid} died inside verb=${priorVerb.verb} task=${priorVerb.task}`); } catch (_) {}
-        // The aborted dispatch otherwise gets NO response file: the in-file was consumed,
-        // the prior watcher died before writing out/, and the agent waits forever on a
-        // Read that never lands (then must git-archaeology whether the verb's side effects
-        // happened). Write a definite failure response so the agent's Read returns
-        // immediately and it re-dispatches. Both out-name shapes are written because
-        // .verb-active.json does not record whether the dispatch was root or nested;
-        // the agent reads whichever its dispatch shape expects, the other is swept.
         if (priorVerb.verb && priorVerb.task) {
           try {
             const abortBody = JSON.stringify({
@@ -2513,10 +2488,6 @@ async function runSpoolWatcher(instance, spoolDir) {
                 child.unref();
                 try { logEvent('plugkit', 'gm-plugkit.self-stale-respawn', { running_version: own, latest_version: latest, cache_busted: bustCache, attempt: (respawnGuard.attempts || 0) + 1 }); } catch (_) {}
                 try { fs.writeFileSync(path.join(spoolDir, '.shutdown-reason.json'), JSON.stringify({ reason: 'gm-plugkit-self-stale', ts: Date.now(), pid: process.pid, running_version: own, latest_version: latest })); } catch (_) {}
-                // Wait for the replacement's fresh heartbeat before exiting (mirror the
-                // version-drift path) instead of a blind 2s exit: the gm-plugkit download can
-                // take many seconds, and exiting early lets the supervisor relaunch the SAME
-                // stale version before the new one lands, so the update never sticks.
                 const myPid = process.pid;
                 const respawnDeadline = Date.now() + 90000;
                 const exitSelfStale = () => { try { process.exit(0); } catch (_) {} };
@@ -2575,11 +2546,6 @@ async function runSpoolWatcher(instance, spoolDir) {
   setTimeout(probeGmPlugkitSelfStale, 5000);
   setInterval(probeGmPlugkitSelfStale, 300_000);
 
-  // A supervised watcher self-exits on drift assuming the supervisor respawns it. If the
-  // supervisor has died, that bare exit leaves the spool dead (worse than staying up). Treat a
-  // dead/absent supervisor as unsupervised so the drift loops take the self-respawn-and-wait path
-  // (spawn replacement, wait for its heartbeat, then exit) instead. False-negative is self-correcting:
-  // if both the supervisor and this watcher respawn, the single-instance lock admits exactly one.
   function _supervisorIsDead() {
     try {
       const sp = parseInt(fs.readFileSync(path.join(spoolDir, '.supervisor.pid'), 'utf8').trim(), 10);
@@ -3051,11 +3017,6 @@ async function runSpoolWatcher(instance, spoolDir) {
       const relPath = path.relative(inDir, filePath);
       const dir = path.dirname(relPath);
       const verb = dir === '.' ? path.basename(filePath, path.extname(filePath)) : dir;
-      // Defense-in-depth beyond walkDir's dot-dir skip: a real verb is a single clean
-      // segment (e.g. instruction, prd-resolve). A derived verb containing a path
-      // separator or a dot-segment means the file lives under a stray nested spool
-      // (in/prd-resolve/.gm/exec-spool/...); dispatching it builds a bogus verb+outName
-      // and ENOENT-storms every tick. Skip + unmark so it never re-enters the loop.
       if (/[\\/]/.test(verb) || verb.split(/[\\/]/).some(seg => seg.startsWith('.'))) {
         try { logEvent('plugkit', 'spool.skip-nested-verb', { rel: relPath, derived_verb: verb }); } catch (_) {}
         unmarkProcessed(key);
@@ -3075,15 +3036,6 @@ async function runSpoolWatcher(instance, spoolDir) {
       console.log(`[dispatch] -> verb=${verb} task=${taskBase} body=${bodyBytes.length}b`);
       logEvent('plugkit', 'dispatch.start', { verb, task: taskBase, body_bytes: bodyBytes.length, cwd: process.cwd() });
 
-      // Network-bound git verbs block the event loop for the duration of a push/fetch (~30s),
-      // so the 5s heartbeat cannot fire and the supervisor would reap the watcher as hung
-      // (the VERB ABORT). Stamp a busy_until window before the synchronous dispatch so the
-      // supervisor's heartbeat-stale check honors it, exactly as the browser runner does.
-      // codesearch is the longest synchronous verb: a cold first call loads the 133MB bge-small
-      // bert model AND re-indexes the tree. A cold build was witnessed at ~252s (dispatch log
-      // codesearch ms=251772), so a 180s window let the supervisor reap the watcher mid-index and
-      // respawn it, cold-loading again = respawn-thrash that never completes (the codeinsight-stale
-      // symptom). codesearch gets a 360s window; the bounded git verbs keep 180s.
       if (verb === 'codesearch') {
         try { _writeStatusBusy(360000); } catch (_) {}
       } else if (verb === 'git_finalize' || verb === 'git_push' || verb === 'git_fetch') {
@@ -3188,11 +3140,6 @@ async function runSpoolWatcher(instance, spoolDir) {
     try {
       for (const entry of fs.readdirSync(dir)) {
         if (/\.tmp\.\d+(\.|$)/.test(entry)) continue;
-        // The verb tree is in/<verb>/[<sub>/]<N>.<ext> -- at most two levels deep. A
-        // dot-prefixed dir (e.g. a stray nested .gm/exec-spool/ created by a misfire)
-        // is never a verb dir; recursing into it derives a bogus verb like
-        // `prd-resolve\.gm\exec-spool` and dispatch-errors on every tick forever.
-        // Skip dot-dirs and cap depth so a spool-inside-spool cannot wedge the watcher.
         if (entry.startsWith('.')) continue;
         const fullPath = path.join(dir, entry);
         let stat;
@@ -3229,12 +3176,6 @@ async function runSpoolWatcher(instance, spoolDir) {
         wrapper_sha: _ownWrapperSha12 || null,
         idle_limit_ms: IDLE_LIMIT_MS,
       };
-      // A synchronous verb (chromium spawn, long exec) blocks the event loop, so the 5s
-      // heartbeat interval cannot fire for the duration. Without a hint, a liveness probe that
-      // checks ts-within-15s reads the busy watcher as dead and may kill/respawn it mid-verb.
-      // busy_until tells probes "alive but synchronously busy until this epoch ms" -- read it
-      // alongside ts: a stale ts whose busy_until is still in the future is a busy watcher, not
-      // a dead one. The pre-verb writeStatus(busyMs) stamps it before the blocking call.
       if (busyMs && busyMs > 0) { rec.busy_until = now + busyMs; _lastBusyUntil = rec.busy_until; }
       fs.writeFileSync(STATUS_PATH, JSON.stringify(rec));
     } catch (_) {}
@@ -3435,9 +3376,6 @@ async function runSpoolWatcher(instance, spoolDir) {
       logEvent('plugkit', 'update.available', { installed, latest });
       _lastKnownDrift = latest;
     }
-    // NOTE: no version-file bump here either -- see the network-path comment above. Bumping the version
-    // file ahead of a verified binary download poisons installedVersionAtTools() and causes an infinite
-    // drift-respawn thrash. Auto-update is notify-only until a sha-verified force-download path exists.
   }
   function checkUpdateViaNpm(installed) {
     const req = https.get({
@@ -3615,9 +3553,6 @@ async function runSpoolWatcher(instance, spoolDir) {
   watch(inDir, { recursive: true }, (eventType, filename) => {
     if (!filename) return;
     if (/\.tmp\.\d+(\.|$)/.test(filename)) return;
-    // Skip any path with a dot-prefixed segment (e.g. a stray nested
-    // prd-resolve/.gm/exec-spool/...): it is not a real verb dispatch and walking it
-    // derives a bogus verb that dispatch-errors on every tick. Matches walkDir's guard.
     if (filename.split(/[\\/]/).some(seg => seg.startsWith('.'))) return;
     const fullPath = path.join(inDir, filename);
     markActivity('watch');
@@ -3681,11 +3616,6 @@ async function selfHealFromGithubReleases() {
         }
         const toolsDir = GM_TOOLS_ROOT;
         fs.mkdirSync(toolsDir, { recursive: true });
-        // Replace the live wasm atomically. A direct writeFileSync truncates the target
-        // before streaming ~149MB, so a crash mid-write or a concurrent watcher load in
-        // that window sees a truncated or absent wasm ("self-heal: wasm not installed"
-        // crash-loop). Write to a pid-suffixed temp and rename over the target; rename
-        // on the same volume is atomic, with the Windows EEXIST/EPERM unlink+retry.
         const wasmTarget = path.join(toolsDir, 'plugkit.wasm');
         const wasmTmp = `${wasmTarget}.partial-${process.pid}`;
         fs.writeFileSync(wasmTmp, wasm);
@@ -3738,10 +3668,6 @@ async function tryInstantiate(wasmPath) {
   return { instance, instanceRef };
 }
 
-// In-process API. Lets a host (e.g. freddie) drive memorize/recall/auto-recall against
-// .gm/rs-learn.db WITHOUT running the spool daemon loop: the wasm instance is created once
-// and cached, and dispatch() returns parsed JSON. The wasm host functions resolve the project
-// .gm dir from CLAUDE_PROJECT_DIR/cwd, so set those in the host process before first dispatch.
 let _sharedPlugkit = null;
 export async function createPlugkit(opts = {}) {
   if (_sharedPlugkit && !opts.fresh) return _sharedPlugkit;

package/gm-plugkit/supervisor.js

@@ -50,7 +50,7 @@ function logEvent(event, fields) {
       ...fields,
     }) + '\n';
     fs.appendFileSync(path.join(dir, 'plugkit.jsonl'), line);
-  } catch (_) {}
+  } catch (e) { try { console.error('[supervisor] logEvent write failed:', e); } catch (_) {} }
 }
 
 function writeSupervisorStatus(state, extra) {
@@ -69,14 +69,7 @@ function pidAlive(pid) {
   try { process.kill(pid, 0); return true; } catch (_) { return false; }
 }
 
-// Single-instance guard. findSupervisorPid (skill-bootstrap.js) reads .supervisor.pid to early-return
-// when a supervisor is already running; without it every bootstrap spawns a duplicate supervisor,
-// and duplicates spawn duplicate watchers that lock-fight in an endless spawn-reject churn. Write the
-// pid file on startup and refuse to start if a live peer already holds it.
 function acquireSingleInstance() {
-  // Atomic via O_EXCL ('wx'): exclusive-create fails if the file exists, so when N supervisors
-  // race to start in the same instant exactly one wins. A plain existsSync->write is TOCTOU and
-  // lets a concurrent burst all pass, which is the duplicate-supervisor churn this guards against.
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
       const fd = fs.openSync(SUPERVISOR_PID_PATH, 'wx');
@@ -87,13 +80,6 @@ function acquireSingleInstance() {
         let other = NaN;
         try { other = parseInt(fs.readFileSync(SUPERVISOR_PID_PATH, 'utf-8').trim(), 10); } catch (_) {}
         if (Number.isFinite(other) && other !== process.pid && pidAlive(other)) {
-          // An alive holder pid is not the same as a working holder: a wedged supervisor
-          // (event loop stuck, watcher dead, neither .supervisor.json nor .status.json
-          // advancing) blocks every newcomer forever under a pidAlive-only check, forcing
-          // manual process kills to recover the spool. Discriminate by progress, not
-          // liveness: holder is wedged only when its own status heartbeat AND the spool
-          // status are both stale past the takeover window, honoring a future busy_until
-          // exactly as checkWatcherHealth does.
           const TAKEOVER_STALE_MS = 45_000;
           const now = Date.now();
           let supTs = 0;
@@ -119,7 +105,6 @@ function acquireSingleInstance() {
             try { spawnSync('taskkill', ['/F', '/T', '/PID', String(other)], { stdio: 'ignore', windowsHide: true, timeout: 3000 }); } catch (_) {}
           }
         }
-        // Holder is dead/stale/wedged: remove and retry the exclusive create once.
         try { fs.unlinkSync(SUPERVISOR_PID_PATH); } catch (_) {}
         continue;
       }
@@ -298,10 +283,6 @@ function checkWatcherHealth() {
     return;
   }
   const now = Date.now();
-  // A long synchronous verb (git_finalize's ~30s network push, a chromium spawn)
-  // blocks the heartbeat write. The verb advertises busy_until in .status.json; while
-  // that is in the future the watcher is busy, not hung -- reaping it kills the verb
-  // mid-flight (the VERB ABORT). Honor busy_until exactly as the agent boot probe does.
   if (status.busy_until && status.busy_until > now) {
     return;
   }
@@ -320,10 +301,6 @@ function checkWatcherHealth() {
     }
     return;
   }
-  // A published wrapper-only fix (no wasm version bump) lands in ~/.gm-tools via the next
-  // bootstrap's ensureWrapperFresh, but a healthy running watcher keeps the old wrapper until it
-  // restarts. On wrapper_sha drift (watcher's reported sha != on-disk), recycle so the fix goes
-  // live without a manual kill. busy_until already returned above, so the watcher is not mid-verb.
   const reported = status.wrapper_sha || null;
   const onDisk = wrapperSha12OnDisk();
   if (reported && onDisk && reported !== onDisk) {
@@ -339,13 +316,6 @@ function checkWatcherHealth() {
     }
     return;
   }
-  // The watcher reads the wasm's embedded instance_version at load and compares it to the
-  // plugkit.version text file (file_version), exposing version_drifted when they disagree.
-  // This catches the case where the version text was bumped (e.g. ensureReady's remote-latest
-  // override) but the cached plugkit.wasm bytes are a different build -- the text claims 635
-  // while the binary embeds 634, so ensureReady's text-only drift check never re-downloads.
-  // On that drift, evict the stale cached wasm so the next bootstrap fails isReady() and
-  // redownloads the correct build, then recycle the child to load it.
   if (status.version_drifted === true) {
     if (now - lastVersionDriftActionAt < VERSION_DRIFT_COOLDOWN_MS) {
       return;

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.1576",
+  "version": "2.0.1578",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",

package/lang/ssh.js

@@ -146,7 +146,6 @@ module.exports = {
       if (!cmd) return '[no command provided]';
       const target = loadTarget(targetName);
 
-      // Detect background-only commands (fire-and-forget: ends with & or uses nohup/systemd-run)
       const isBackground = /(&\s*$|^\s*(nohup|systemd-run|setsid)\s)/m.test(cmd);
 
       if (isBackground) {

package/lib/spool.js

@@ -49,7 +49,7 @@ function writeSpool(body, lang = 'nodejs', options = {}) {
   fs.mkdirSync(inDir, { recursive: true });
 
   const sessionId = options.sessionId || process.env.CLAUDE_SESSION_ID;
-  const code = sessionId ? `const SESSION_ID = '${sessionId}';\n${body}` : body;
+  const code = sessionId ? `const SESSION_ID = ${JSON.stringify(sessionId)};\n${body}` : body;
 
   fs.writeFileSync(inFile, code, 'utf8');
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-skill",
-  "version": "2.0.1576",
+  "version": "2.0.1578",
   "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
   "author": "AnEntrypoint",
   "license": "MIT",