gm-skill 2.0.1620 → 2.0.1622

package/AGENTS.md

@@ -72,7 +72,7 @@ Record only non-obvious technical caveats that cost multiple runs to discover; r
 
 No build step; the repo root is the published artifact. `npm publish` from root publishes `gm-skill` (npm package id is permanent; only the skill DIRECTORY is `skills/gm`, so the command is `/gm`). `package.json` `files:` pins the shipped paths. `AnEntrypoint/gm-skill` is a back-compat mirror receiving only `skills/gm/SKILL.md` per release.
 
-`bin/install.js` is the canonical installer -- no npx `skills` library, no marketplace. It copies `skills/gm` into `<home>/.claude/skills/gm/` (personal) or `.claude/skills/gm/` (`--project`); the dir name IS the `/command`. Non-interactive (`-y`/`--yes` or non-TTY) SETS four Claude Code settings (`autoCompactEnabled:true`, `autoCompactWindow:380000` -- an ABSOLUTE token count = 38% of 1M, not a percentage -- `effortLevel:"low"`, `alwaysThinkingEnabled:false`) and explains the revert; interactive OFFERS them. The reasoning-in-code framing it prints is load-bearing: the LLM still thinks, it tests its thoughts in code (execution as reasoning). `test.js checkRenameAndInstaller()` is the structural guard (asserts no `skills/gm-skill`, package id stays `gm-skill`, installer lands the skill + writes the four keys into an isolated temp HOME).
+`bin/install.js` is the canonical installer (no npx `skills` library, no marketplace); the dir name it lands IS the `/command`, and `test.js checkRenameAndInstaller()` is the structural guard. Copy-target, the four Claude Code settings it sets non-interactively, the reasoning-in-code framing, and the guard assertions in rs-learn (`recall: gm installer detail`).
 
 ## The agent is the orchestrator; plugkit is the brain it drives
 

package/gm-plugkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.1620",
+  "version": "2.0.1622",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform binary, verifies SHA256, and starts the spool watcher daemon. Includes plugkit-wasm-wrapper for WASM-based spool watching.",
   "main": "index.js",
   "bin": {

package/gm-plugkit/plugkit-wasm-wrapper.js

@@ -163,27 +163,19 @@ function dispatchVerbToWasmInternal(instance, verb, body) {
   if (!dispatch) return null;
   const verbBytes = new TextEncoder().encode(verb);
   const bodyBytes = new TextEncoder().encode(body || '');
-  const verbPtr = instance.exports.plugkit_alloc(verbBytes.length);
-  const bodyPtr = instance.exports.plugkit_alloc(bodyBytes.length);
-  if ((verbBytes.length > 0 && verbPtr === 0) || (bodyBytes.length > 0 && bodyPtr === 0)) {
-    try { if (verbPtr !== 0) instance.exports.plugkit_free(verbPtr, verbBytes.length); } catch (_) {}
-    try { if (bodyPtr !== 0) instance.exports.plugkit_free(bodyPtr, bodyBytes.length); } catch (_) {}
-    throw new Error(`wasm-alloc-failed for dispatch_verb(${verb}): plugkit_alloc returned 0 (wasm OOM); refusing to write to a null offset and corrupt the heap`);
-  }
+  // writeWasmInput re-reads memory.buffer fresh after each alloc (avoids the detached-buffer write bug).
+  let verbPtr = 0, bodyPtr = 0;
+  try { verbPtr = writeWasmInput(instance, verbBytes, `dispatch_verb(${verb}).verb`); }
+  catch (e) { throw new Error(`wasm-alloc-failed for dispatch_verb(${verb}): ${e.message}`); }
+  try { bodyPtr = writeWasmInput(instance, bodyBytes, `dispatch_verb(${verb}).body`); }
+  catch (e) { try { if (verbPtr) instance.exports.plugkit_free(verbPtr, verbBytes.length); } catch (_) {}
+    throw new Error(`wasm-alloc-failed for dispatch_verb(${verb}): ${e.message}`); }
   try {
-    new Uint8Array(instance.exports.memory.buffer, verbPtr, verbBytes.length).set(verbBytes);
-    new Uint8Array(instance.exports.memory.buffer, bodyPtr, bodyBytes.length).set(bodyBytes);
     const result = dispatch(verbPtr, verbBytes.length, bodyPtr, bodyBytes.length);
-    const ptr = Number(result & 0xffffffffn);
-    const len = Number(result >> 32n);
-    const buffer = instance.exports.memory.buffer;
-    guardWasmRange(buffer, ptr, len, `dispatch_verb(${verb})`);
-    const out = new TextDecoder().decode(new Uint8Array(buffer, ptr, len));
-    try { instance.exports.plugkit_free(ptr, len); } catch (_) {}
-    return out;
+    return decodeWasmResult(instance, result, `dispatch_verb(${verb})`);   // normalized i64 + fresh buffer
   } finally {
-    try { instance.exports.plugkit_free(verbPtr, verbBytes.length); } catch (_) {}
-    try { instance.exports.plugkit_free(bodyPtr, bodyBytes.length); } catch (_) {}
+    try { if (verbPtr) instance.exports.plugkit_free(verbPtr, verbBytes.length); } catch (_) {}
+    try { if (bodyPtr) instance.exports.plugkit_free(bodyPtr, bodyBytes.length); } catch (_) {}
   }
 }
 
@@ -1383,6 +1375,41 @@ function guardWasmRange(buffer, ptr, len, where) {
   }
 }
 
+// Decode a packed (ptr,len) i64 dispatch result into a JS string, the ONE correct way.
+// Two bugs this consolidates (they only surface once the wasm memory grows past a threshold --
+// e.g. a large .gm state file -> a big plugkit_alloc -> the memory grows past ~2GB / the linear
+// memory is re-grown mid-dispatch):
+//   1. SIGNED i64 result. dispatch_verb returns an i64; a high bit set (large ptr or a packed
+//      len in the top 32 bits) makes `result` a NEGATIVE BigInt. `result >> 32n` on a negative
+//      BigInt arithmetic-shifts in sign bits -> a garbage/negative len, and the low-word mask can
+//      misread too. Normalize to unsigned 64-bit FIRST: BigInt.asUintN(64, result).
+//   2. DETACHED buffer. `instance.exports.memory.buffer` captured before plugkit_alloc/dispatch is
+//      a STALE ArrayBuffer once the wasm linear memory grows (the old buffer detaches). Reading the
+//      result against it throws 'Start offset N is outside the bounds of the buffer'. Always re-read
+//      instance.exports.memory.buffer FRESH at the moment of the view, never reuse a captured one.
+function decodeWasmResult(instance, result, where) {
+  const u = BigInt.asUintN(64, BigInt(result));   // (1) normalize the i64 to unsigned before splitting
+  const ptr = Number(u & 0xffffffffn);
+  const len = Number(u >> 32n);
+  if (ptr === 0 || len === 0) return '';
+  const buffer = instance.exports.memory.buffer;  // (2) FRESH buffer (post-grow), never a stale capture
+  guardWasmRange(buffer, ptr, len, where);
+  const out = new TextDecoder().decode(new Uint8Array(buffer, ptr, len));
+  try { instance.exports.plugkit_free(ptr, len); } catch (_) {}
+  return out;
+}
+
+// Write input bytes into wasm memory, re-reading memory.buffer FRESH after the alloc so a memory
+// grow during plugkit_alloc never leaves us writing into a detached buffer (the write-side half of
+// the detached-buffer bug). Returns the ptr (caller frees) or throws on alloc failure.
+function writeWasmInput(instance, bytes, where) {
+  if (bytes.length === 0) return 0;
+  const ptr = instance.exports.plugkit_alloc(bytes.length);
+  if (ptr === 0) throw new Error(`wasm-alloc-failed at ${where}: plugkit_alloc returned 0 (wasm OOM)`);
+  new Uint8Array(instance.exports.memory.buffer, ptr, bytes.length).set(bytes);   // fresh buffer post-alloc
+  return ptr;
+}
+
 function readWasmBytes(instance, ptr, len) {
   if (ptr === 0 || len === 0) return new Uint8Array(0);
   const buffer = instance.exports.memory.buffer;
@@ -2250,13 +2277,14 @@ function readInstanceVersion(instance) {
     const result = fn();
     let ptr, len;
     if (typeof result === 'bigint') {
-      ptr = Number(result & 0xffffffffn);
-      len = Number(result >> 32n);
+      const u = BigInt.asUintN(64, result);   // normalize the i64 to unsigned before splitting (signed-ptr fix)
+      ptr = Number(u & 0xffffffffn);
+      len = Number(u >> 32n);
     } else {
-      ptr = Number(result) & 0xffffffff;
+      ptr = Number(result) >>> 0;   // unsigned 32-bit
       len = 0;
     }
-    const buf = new Uint8Array(instance.exports.memory.buffer, ptr, 64);
+    const buf = new Uint8Array(instance.exports.memory.buffer, ptr, 64);   // fresh buffer (post fn() grow)
     if (len === 0) {
       let end = 0;
       while (end < buf.length && buf[end] !== 0) end++;
@@ -3247,20 +3275,17 @@ async function runSpoolWatcher(instance, spoolDir) {
         }
       }
 
-      const verbPtr = instance.exports.plugkit_alloc(verbBytes.length);
-      const bodyPtr = instance.exports.plugkit_alloc(bodyBytes.length);
-      new Uint8Array(instance.exports.memory.buffer, verbPtr, verbBytes.length).set(verbBytes);
-      new Uint8Array(instance.exports.memory.buffer, bodyPtr, bodyBytes.length).set(bodyBytes);
+      // writeWasmInput re-reads memory.buffer fresh after each alloc (detached-buffer write fix).
+      const verbPtr = writeWasmInput(instance, verbBytes, `spool-dispatch:${verb}.verb`);
+      const bodyPtr = writeWasmInput(instance, bodyBytes, `spool-dispatch:${verb}.body`);
 
       writeVerbActive(verb, taskBase);
       const result = dispatch(verbPtr, verbBytes.length, bodyPtr, bodyBytes.length);
       clearVerbActive();
 
-      const ptr = Number(result & 0xffffffffn);
-      const len = Number(result >> 32n);
-      guardWasmRange(instance.exports.memory.buffer, ptr, len, `spool-dispatch:${verb}`);
-      const resultBytes = new Uint8Array(instance.exports.memory.buffer, ptr, len);
-      let resultStr = new TextDecoder().decode(resultBytes);
+      // decodeWasmResult normalizes the i64 (BigInt.asUintN), re-reads the buffer FRESH (post-grow),
+      // guards the range, AND frees the result ptr -- so the (ptr,len) free below is dropped.
+      let resultStr = decodeWasmResult(instance, result, `spool-dispatch:${verb}`);
 
       if (autoRecallPayload) {
         resultStr = mergeAutoRecallIntoInstructionResponse(resultStr, autoRecallPayload);
@@ -3313,7 +3338,7 @@ async function runSpoolWatcher(instance, spoolDir) {
 
       try { instance.exports.plugkit_free(verbPtr, verbBytes.length); } catch (_) {}
       try { instance.exports.plugkit_free(bodyPtr, bodyBytes.length); } catch (_) {}
-      try { instance.exports.plugkit_free(ptr, len); } catch (_) {}
+      // (the result ptr is freed inside decodeWasmResult above)
 
       try { if (fs.existsSync(filePath)) fs.unlinkSync(filePath); } catch (_) {}
       unmarkProcessed(key);
@@ -3961,15 +3986,12 @@ if (_isCliEntry) (async () => {
       const dispatch = instance.exports.dispatch_verb;
       const verbBytes = new TextEncoder().encode(verb);
       const bodyBytes = new TextEncoder().encode(body);
-      const verbPtr = instance.exports.plugkit_alloc(verbBytes.length);
-      const bodyPtr = instance.exports.plugkit_alloc(bodyBytes.length);
-      new Uint8Array(instance.exports.memory.buffer, verbPtr, verbBytes.length).set(verbBytes);
-      new Uint8Array(instance.exports.memory.buffer, bodyPtr, bodyBytes.length).set(bodyBytes);
+      const verbPtr = writeWasmInput(instance, verbBytes, `cli-dispatch:${verb}.verb`);
+      const bodyPtr = writeWasmInput(instance, bodyBytes, `cli-dispatch:${verb}.body`);
       const result = dispatch(verbPtr, verbBytes.length, bodyPtr, bodyBytes.length);
-      const ptr = Number(result & 0xffffffffn);
-      const len = Number(result >> 32n);
-      guardWasmRange(instance.exports.memory.buffer, ptr, len, `cli-dispatch:${verb}`);
-      const out = new TextDecoder().decode(new Uint8Array(instance.exports.memory.buffer, ptr, len));
+      const out = decodeWasmResult(instance, result, `cli-dispatch:${verb}`);   // normalized i64 + fresh buffer
+      try { instance.exports.plugkit_free(verbPtr, verbBytes.length); } catch (_) {}
+      try { instance.exports.plugkit_free(bodyPtr, bodyBytes.length); } catch (_) {}
       process.stdout.write(out);
       let parsed;
       try { parsed = JSON.parse(out); } catch (_) { parsed = null; }

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.1620",
+  "version": "2.0.1622",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-skill",
-  "version": "2.0.1620",
+  "version": "2.0.1622",
   "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
   "author": "AnEntrypoint",
   "license": "MIT",

package/skills/gm/SKILL.md

@@ -56,7 +56,7 @@ bun x gm-plugkit@latest spool > /dev/null 2>&1 &
 
 From PowerShell, write spool input as UTF-8 no-BOM (`-Encoding utf8` or `[System.IO.File]::WriteAllText`); the 5.1 default UTF-16+BOM trips `spool.body-encoding-recoded`. Prefer the `Write` tool for JSON bodies. First-turn body is `{"prompt":"<user request>"}` (derives orient_nouns + recall_hits); later same-conversation turns may use `{}`. A `Write` to `in/<verb>/` that errors `ENOENT` (a fast watcher consumed and unlinked the file before the tool's post-write stat) has STILL dispatched -- confirm via the `out/` response, never blind-retry (a non-idempotent verb like `git_finalize` would double-fire); a Bash heredoc `cat > in/<verb>/<N>.txt` has no post-write stat and never surfaces this.
 
-**Batch writes and reads together.** Write request + Read response is one logical step -- issue both in one block, not three turns. Fan-out is the same: N independent verbs = N Writes in one block then N Reads in one block. Only a real data dependency (verb B needs A's response) forces separate turns.
+**Batch writes and reads together -- one block is the default, the serial single dispatch is the drift.** Write request + Read response is one logical step; issue both in one block, never across turns. Independent dispatches batch as a class -- N `prd-add`, N `prd-resolve`, N `mutable-add`, the orient `recall`+`codesearch`, several inspection `Read`/`codesearch` -- as N Writes in one block then N Reads in one block. A turn that issues one independent verb while three were ready is the miss to correct; the only thing that forces separate turns is a true data dependency, verb B reading verb A's response. Two edges bound the rule. Same-file batching inverts it: two Edits to the SAME file in one block is not fan-out -- the first invalidates the file's read-state and the rest fail `File has been modified since read`, so collapse same-file changes into one Edit (or `replace_all`, or one Write of the whole file) and reserve in-block batching for Edits across DIFFERENT files. And a long verb (browser, an `exec_js` build, `git_finalize`) whose response is not ready on the Write+Read block: the recovery is one block carrying both the wait probe and the re-Read (the `until [ -f .gm/exec-spool/out/<verb>-<N>.json ]; do sleep N; done` and the `Read` together, or honoring an advertised `busy_until` the same way), never a bare wait turn followed by a separate Read turn. Reading a homogeneous fan-out's responses is itself batched: Read all N in one block, or spot-check first and last -- they carry no ordering dependency.
 
 The chain is not COMPLETE until changes are on origin. Commit and push at the end of every session that touched tracked files; do not ask -- the push IS the validation dispatch (`verify.rs`). Only the porcelain check holds it back, and a dirty tree is fixed by stage-commit or revert, not by asking.