gm-skill 2.0.1907 → 2.0.1909

package/gm-plugkit/instructions/execute.md

@@ -46,6 +46,8 @@ Data first -- correct structures/invariants make the code write itself; convolut
 
 **Process of elimination is the debugging paradigm on every surface; manual labour against real services is how you witness.** Thinking-in-code at its sharpest: each candidate cause is a hypothesis, tested by running it, never reasoned around. No guess-and-restart, no a/b-test, no shotgun variants: enumerate candidates as mutables, eliminate each by REAL-input witness -- `exec_js` on the real service, `codesearch`/`Read` on real source, `browser`'s `page.evaluate` on a live `window.*` global, monkeypatching each candidate function/handler in-page to isolate which one actually fires. Each elimination reveals the next mutable; iterate to single-cause-survives. One live-runtime read outweighs a hundred blind restarts.
 
+**Before the first hypothesis, name the loop that will falsify it.** A hard bug gets a single named command -- an `exec_js`/`browser` dispatch, a CLI invocation, a curl against a live dev surface -- that is red-capable (drives the exact reported symptom, not a nearby one), deterministic (same verdict every run; for flaky bugs, driven to a high-enough reproduction rate to debug against), and fast. Name and run that command once, unmodified, before reading code for a theory -- reading code first to build a theory is the failure this clause exists to catch. Every mutable elimination pass afterward reuses the same loop; a loop that only sometimes reproduces gets tightened (narrower scope, pinned time/seed, isolated fs/network) before it's trusted as a witness surface.
+
 Profile the real surface, never intuit. `exec_js`: `duration_ms` free, own timing + `process.memoryUsage()` on stdout, thrown-`stack` on stderr -- read both channels. Browser: `capture\n<script>` prefix auto-returns `{result, debug:{console, pageErrors, network, performance}}`, zero boilerplate. Slow-node-not-obvious: `exec_js opts.profile:true` / browser `profile\n<script>` prefix both return `{result, profile:{timeframe:{start_us,end_us,total_us,sample_count}, culprits:[{location,function,self_us,self_pct,hits}]}}` -- worst-N `file:line` self-time, identical shape both surfaces. Both also return `mem` (rss/heap/delta) and `wall_vs_cpu:{wall_us, offcpu_us}` -- sampler sees only on-CPU JS, large `offcpu_us` = IO/async-wait/GPU time invisible to it; tune via `opts.sampleIntervalUs`/`opts.profileTopN` (cli) or `interval=`/`topN=` (browser). Cheap non-profile path: `opts.mem:true` -> `{result, mem, wall_ms}` + structured `error:{name,message,stack}` on throw -- read `error.name` directly; default path (no `opts.mem`) byte-unchanged. CPU sampler is GPU-blind -- wall >> CPU self-time on render/canvas/WebGL -> browser `trace\n<script>` prefix opens CDP Tracing, returns `trace:{wall_us, gpu_us, viz_us, cc_us, by_category}`. Profile to LOCATE, then eliminate by live measurement. Verification is the same labour: run the real thing, witness the real output (live page, real service) -- never a unit/mock harness standing in for real-services witness. Apparent tooling failure is the same mechanical self-recovery-by-elimination, never a question for the user.
 
 ## No test files, ever (hard rule)

package/gm-plugkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.1907",
+  "version": "2.0.1909",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform binary, verifies SHA256, and starts the spool watcher daemon. Includes plugkit-wasm-wrapper for WASM-based spool watching.",
   "main": "index.js",
   "bin": {

package/gm-plugkit/plugkit-wasm-wrapper.js

@@ -758,20 +758,78 @@ function findCachedBunRunnerBin() {
   return null;
 }
 
+// playwriter's CLI `--timeout` option is parsed as a raw string (its own arg parser does not
+// coerce it despite the zod schema declaring z.number()), and that string is forwarded verbatim
+// into `vm.runInContext(..., { timeout })`, which throws
+// `TypeError: The "options.timeout" property must be of type number` -- every managed browser
+// session then fails, and each spawn's relay/Chromium never gets torn down (an "orphan-chrome
+// pileup"). Idempotently patch it in whatever playwriter dist copy we're about to invoke.
+const _patchedPlaywriterDistDirs = new Set();
+function patchPlaywriterTimeoutBug(binJs) {
+  try {
+    const distDir = path.dirname(binJs);
+    if (_patchedPlaywriterDistDirs.has(distDir)) return;
+    _patchedPlaywriterDistDirs.add(distDir);
+    const executorPath = path.join(distDir, 'executor.js');
+    if (fs.existsSync(executorPath)) {
+      const src = fs.readFileSync(executorPath, 'utf-8');
+      if (/async execute\(code, timeout = 10000\) \{(?!\s*timeout = Number)/.test(src)) {
+        const patched = src.replace(
+          /(async execute\(code, timeout = 10000\) \{)/,
+          '$1\n        timeout = Number(timeout) || 10000;'
+        );
+        fs.writeFileSync(executorPath, patched);
+      }
+    }
+    const cliPath = path.join(distDir, 'cli.js');
+    if (fs.existsSync(cliPath)) {
+      const src = fs.readFileSync(cliPath, 'utf-8');
+      if (src.includes('timeout: options.timeout || 10000') && !src.includes('timeout: Number(options.timeout)')) {
+        const patched = src.replace(
+          'timeout: options.timeout || 10000',
+          'timeout: Number(options.timeout) || 10000'
+        );
+        fs.writeFileSync(cliPath, patched);
+      }
+    }
+  } catch (_) {}
+}
+
+function patchAllCachedPlaywriterCopies() {
+  try {
+    const cacheDir = path.join(os.homedir(), '.bun', 'install', 'cache');
+    const entries = fs.readdirSync(cacheDir).filter(n => n.startsWith(`${BROWSER_RUNNER_BIN}@`));
+    for (const name of entries) {
+      const binJs = path.join(cacheDir, name, 'bin.js');
+      if (fs.existsSync(binJs)) patchPlaywriterTimeoutBug(binJs);
+    }
+  } catch (_) {}
+}
+
 function findBrowserRunner() {
+  // bun's global-install node_modules root has real dependency resolution (npm-style
+  // node_modules tree), so a bin.js found there is safe to invoke directly.
   const bunGlobalRoots = [
     path.join(os.homedir(), '.bun', 'install', 'global', 'node_modules', BROWSER_RUNNER_BIN, 'bin.js'),
   ];
   for (const binJs of bunGlobalRoots) {
-    if (fs.existsSync(binJs)) return { cmd: process.execPath, baseArgs: [binJs], shell: false };
+    if (fs.existsSync(binJs)) { patchPlaywriterTimeoutBug(binJs); return { cmd: process.execPath, baseArgs: [binJs], shell: false }; }
   }
-  const cachedBin = findCachedBunRunnerBin();
-  if (cachedBin) return { cmd: process.execPath, baseArgs: [cachedBin], shell: false };
+  // `~/.bun/install/cache/<pkg>@version` is bun's *content-addressed package cache*, not an
+  // installed tree -- it has no node_modules of its own, so invoking its bin.js directly with
+  // plain node/bun fails to resolve the package's own dependencies (e.g. "Cannot find package
+  // 'hono'"). Only `bun x` (or an npm-global install) sets up real dependency resolution, so
+  // prefer that over the cached bin.js. `bun x` still ultimately runs the same content-addressed
+  // cache copy (symlinked node_modules alongside it), so patch every cached copy proactively --
+  // there is no separate resolved-tree location to target for the `bun x` path specifically.
+  patchAllCachedPlaywriterCopies();
   const whichCmd = process.platform === 'win32' ? 'where' : 'which';
   const bunR = spawnSync(whichCmd, ['bun'], { encoding: 'utf-8', shell: true });
   if (bunR.status === 0 && bunR.stdout.trim()) {
     return { cmd: 'bun', baseArgs: ['x', `${BROWSER_RUNNER_BIN}@latest`], shell: true };
   }
+  const cachedBin = findCachedBunRunnerBin();
+  if (cachedBin) return { cmd: process.execPath, baseArgs: [cachedBin], shell: false };
   const r = spawnSync(whichCmd, [BROWSER_RUNNER_BIN], { encoding: 'utf-8', shell: true });
   if (r.status === 0 && r.stdout.trim()) {
     const candidates = r.stdout.split(/\r?\n/).map(l => l.trim()).filter(Boolean);

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.1907",
+  "version": "2.0.1909",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-skill",
-  "version": "2.0.1907",
+  "version": "2.0.1909",
   "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
   "author": "AnEntrypoint",
   "license": "MIT",