gm-skill 2.0.1612 → 2.0.1613

package/gm-plugkit/instructions/browser.md

@@ -57,6 +57,7 @@ return {logs,errs,net,perf};
 - **Performance**: `performance.getEntriesByType('navigation')[0]` gives `loadEventEnd`/`domContentLoadedEventEnd`; `getEntriesByType('resource')` gives per-asset timing; `performance.now()`/`PerformanceObserver` for in-page measures. This is your profiler.
 - **Network timing**: `request.timing()` fields (`responseEnd`, `responseStart`, ...) are ALREADY relative to `startTime` -- use `Math.round(t.responseEnd)` directly for duration; subtracting `startTime` yields a garbage huge-negative (witnessed). `-1` means N/A.
 - **State**: expose any runtime value as `window.__x` in the app or via `page.evaluate(()=>{window.__x=...})`, then read it with another `page.evaluate` -- the live global beats a restart. Surface relevant state as a global on purpose so a single evaluate observes it.
+- **Screenshots**: to actually SEE a screenshot, save it to a file and `Read` that path -- `await page.screenshot({path:'<abs>/shot.png'})` then `Read <abs>/shot.png` (the Read tool renders the PNG visually; witnessed). NEVER `return` the screenshot Buffer inline -- it stringifies to useless bytes in the envelope. The same applies to any binary: write it to a path, then Read the path.
 
 Profile to LOCATE (which call/resource is slow), then eliminate hypotheses by live measurement -- never a/b-test by restarting. The node side mirrors this: `exec_js` with `process.hrtime.bigint()`/`performance.now()` timing, `process.memoryUsage()`, and `stderr` stack capture is a genuine node profiler+debugger.
 

package/gm-plugkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.1612",
+  "version": "2.0.1613",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform binary, verifies SHA256, and starts the spool watcher daemon. Includes plugkit-wasm-wrapper for WASM-based spool watching.",
   "main": "index.js",
   "bin": {

package/gm-plugkit/plugkit-wasm-wrapper.js

@@ -3109,6 +3109,7 @@ async function runSpoolWatcher(instance, spoolDir) {
 
       const ptr = Number(result & 0xffffffffn);
       const len = Number(result >> 32n);
+      guardWasmRange(instance.exports.memory.buffer, ptr, len, `spool-dispatch:${verb}`);
       const resultBytes = new Uint8Array(instance.exports.memory.buffer, ptr, len);
       let resultStr = new TextDecoder().decode(resultBytes);
 
@@ -3818,6 +3819,7 @@ if (_isCliEntry) (async () => {
       const result = dispatch(verbPtr, verbBytes.length, bodyPtr, bodyBytes.length);
       const ptr = Number(result & 0xffffffffn);
       const len = Number(result >> 32n);
+      guardWasmRange(instance.exports.memory.buffer, ptr, len, `cli-dispatch:${verb}`);
       const out = new TextDecoder().decode(new Uint8Array(instance.exports.memory.buffer, ptr, len));
       process.stdout.write(out);
       let parsed;

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.1612",
+  "version": "2.0.1613",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-skill",
-  "version": "2.0.1612",
+  "version": "2.0.1613",
   "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
   "author": "AnEntrypoint",
   "license": "MIT",