gm-skill 2.0.2015 → 2.0.2017

package/bin/plugkit-slim.wasm.sha256

@@ -1 +1 @@
-d7d210e1b0d79b4dc3b816215f011111152217305dbe5ef5041193f24757eb26  plugkit-slim.wasm
+ebb99b9ecd9db29509c2566601c191b7fb269f65bfe542f77a10e9754fea8014  plugkit-slim.wasm

package/bin/plugkit.version

@@ -1 +1 @@
-0.1.931
+0.1.932

package/bin/plugkit.wasm.sha256

@@ -1 +1 @@
-a5bfe10bea840a8014333ea02a0102370bb4e06bebd8eb8fa6f1ecc5939c4871  plugkit.wasm
+155068051e65d4d18998b8425272b8f7eec5ea5141df3ff31911f3f638be6535  plugkit.wasm

package/gm-plugkit/bootstrap.js

@@ -191,6 +191,37 @@ function ensureNextStepWiring(cwd) {
     }
   } catch (e) { obsEvent('bootstrap', 'next-step.wiring.target-failed', { target: agentsMdPath, error: e.message }); }
 
+  // gm writes its own runtime data into .gm/ in every project it drives; if that
+  // project is an npm package, that data must never be published. Maintain a
+  // managed .npmignore block excluding .gm/, mirroring the managed-gitignore
+  // mechanism: append a marker-delimited block to any existing .npmignore
+  // without clobbering the user's own entries, and skip entirely when a
+  // package.json `files:` allowlist is present (an allowlist already excludes
+  // everything not listed, so .gm/ is safe without an .npmignore).
+  try {
+    const pkgPath = path.join(cwd, 'package.json');
+    let hasFilesAllowlist = false;
+    try {
+      if (fs.existsSync(pkgPath)) {
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+        hasFilesAllowlist = Array.isArray(pkg.files) && pkg.files.length > 0;
+      }
+    } catch (_) {}
+    if (!hasFilesAllowlist) {
+      const npmIgnorePath = path.join(cwd, '.npmignore');
+      const begin = '# >>> gm managed';
+      const end = '# <<< gm managed';
+      const block = `${begin}\n.gm/\n${end}\n`;
+      let content = '';
+      if (fs.existsSync(npmIgnorePath)) content = fs.readFileSync(npmIgnorePath, 'utf8');
+      if (!content.includes(begin)) {
+        const sep = content && !content.endsWith('\n') ? '\n' : '';
+        fs.writeFileSync(npmIgnorePath, content + sep + (content ? '\n' : '') + block);
+        changes.push(fs.existsSync(npmIgnorePath) && content ? 'added gm managed block to .npmignore' : 'created .npmignore excluding .gm/');
+      }
+    }
+  } catch (e) { obsEvent('bootstrap', 'next-step.wiring.target-failed', { target: '.npmignore', error: e.message }); }
+
   if (changes.length > 0) {
     log(`next-step wiring: ${changes.join(', ')}`);
     obsEvent('bootstrap', 'next-step.wiring.applied', { changes });

package/gm-plugkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.2015",
+  "version": "2.0.2017",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform binary, verifies SHA256, and starts the spool watcher daemon. Includes plugkit-wasm-wrapper for WASM-based spool watching.",
   "main": "index.js",
   "bin": {

package/gm-plugkit/plugkit-slim.wasm.sha256

@@ -1 +1 @@
-d7d210e1b0d79b4dc3b816215f011111152217305dbe5ef5041193f24757eb26  plugkit-slim.wasm
+ebb99b9ecd9db29509c2566601c191b7fb269f65bfe542f77a10e9754fea8014  plugkit-slim.wasm

package/gm-plugkit/plugkit.version

@@ -1 +1 @@
-0.1.931
+0.1.932

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.2015",
+  "version": "2.0.2017",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",
@@ -17,5 +17,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "plugkitVersion": "0.1.931"
+  "plugkitVersion": "0.1.932"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-skill",
-  "version": "2.0.2015",
+  "version": "2.0.2017",
   "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
   "author": "AnEntrypoint",
   "license": "MIT",