gm-skill 2.0.2208 → 2.0.2210

package/AGENTS.md

@@ -30,7 +30,7 @@ Plugkit-core = the wasm cdylib guest (the gm brain), published as `plugkit.wasm`
 
 **`agentplug-runner`** (repo `AnEntrypoint/agentplug`, published to `AnEntrypoint/agentplug-bin`) is a real native wasmtime binary that loads gm.wasm as one plugin among siblings (`bert`/`libsql`/`treesitter`), routing gm.wasm's `host_plugin_call`/`host_vec_embed` to those shared plugins -- browser and task are both native in agentplug-host, needing nothing from the retired JS wrapper. Full mechanics: the recall store (`recall: agentplug-runner wasmtime plugin loading mechanics`).
 
-The `gm-plugkit` npm identity stays load-bearing as the thin launcher edge only: `bun x gm-plugkit@latest spool` (`cli.js::tryDelegateToRunner`) re-execs the `agentplug-runner` executable staged at `~/.gm-tools/agentplug-runner` (gm-plugkit's own launcher-edge install location) and exits. **The executable's own runtime state lives elsewhere**: `agentplug-host::install_dir()` resolves to `~/.agentplug`, not `~/.gm-tools` -- every plugin wasm/version marker (`~/.agentplug/plugins/<name>.wasm`, `<name>.version`), `daemon-status.json`, `daemon-registry.txt`, and `daemon-config.json` live under `~/.agentplug`, fully independent of gm-plugkit's own launcher-edge files under `~/.gm-tools` (which still holds gm-plugkit's own `plugkit.wasm`/`plugkit-slim.wasm`/`plugkit.version` for the pre-agentplug JS-wrapper code path, now dormant once delegation succeeds). Inspecting the wrong directory for the live-served gm.wasm version is the single most likely false-alarm source when diagnosing update-path issues -- always check `~/.agentplug/plugins/gm.version`, never `~/.gm-tools/plugins/gm.version` or `~/.gm-tools/plugkit.version`, to see what agentplug-runner is actually serving. `bootstrap.js` still seeds per-project wiring and downloads `plugkit.wasm`/`plugkit-slim.wasm` (sha256-pinned) from `plugkit-bin` into `~/.gm-tools`, but this path is bypassed entirely once `tryDelegateToRunner` succeeds (the common case whenever `~/.gm-tools/agentplug-runner.exe` exists) -- `plugkit-slim.wasm` at the `~/.gm-tools` top level is therefore normally ABSENT by design on a machine where agentplug-runner is doing the serving; that is not a bootstrap failure. `startSpoolDaemon()` launches agentplug-runner or, when it is absent, fails loudly with an actionable install message -- there is no silent no-loader state. Size + embedded-model mechanics: the recall store (`recall: WASM-only plugkit size mechanics`).
+The `gm-plugkit` npm identity stays load-bearing as the thin launcher edge only: `bun x gm-plugkit@latest spool` (`cli.js::tryDelegateToRunner`) re-execs the `agentplug-runner` executable staged at `~/.gm-tools/agentplug-runner` and exits -- there is no silent no-loader state. The launcher-edge install path (`~/.gm-tools`) and the runner's own runtime state (`~/.agentplug`) are two different directories; always check `~/.agentplug/plugins/gm.version` for what is actually being served, never `~/.gm-tools`. Full path-split mechanics: the recall store (`recall: agentplug-runner runtime-state path split`). Size + embedded-model mechanics: the recall store (`recall: WASM-only plugkit size mechanics`).
 
 **`bin/install.js` hard-requires agentplug-runner.** It downloads the sha256-verified native runner from `AnEntrypoint/agentplug-bin` for the host platform, and if none is published (or the download/verify fails) it fails the install loudly with a clear message rather than leaving the user with no loader. There is no JS-host fallback to silently fall through to anymore.
 

package/bin/bootstrap.js

@@ -5,42 +5,40 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const crypto = require('crypto');
-const { spawnSync } = require('child_process');
-const { pidAlive, sha256OfFile, sha256OfFileSync } = require('../gm-plugkit/gm-process');
 const shared = require('../gm-plugkit/bootstrap-shared');
+const core = require('../gm-plugkit/bootstrap-wasm-core');
 const {
   obsEvent,
   cacheRoot,
   fallbackCacheRoot,
-  gmToolsDir,
   ensureDir,
   acquireLock,
   releaseLock,
-  isLockStale,
-  pruneOldVersions,
   healIfShaMatches,
-  daemonVersionSentinel,
+  pruneOldVersions,
   readDaemonVersion,
   writeDaemonVersion,
-  pidCommandLineForKillGuard,
-  pidIsPlugkitProcess,
-  writeKillAttribution,
-  killPid,
   killSpoolWatcherInCwd,
   proactiveKillForNewInstall,
   ensureNextStepWiring,
-  resolveWindowsExe,
-  resolveNpmCliJs,
 } = shared;
+const {
+  readVersionFile,
+  readShaManifest,
+  resolveCacheWasmPath,
+  extractNpmPackageWithRetry: extractNpmPackageWithRetryCore,
+  writeBootstrapError,
+  clearBootstrapError,
+} = core;
 
-const NPM_PACKAGE = 'plugkit-wasm';
-const ATTEMPT_TIMEOUT_MS = 10 * 60 * 1000;
-const MAX_ATTEMPTS = 3;
-const BACKOFF_MS = [5000, 15000];
-const LOCK_STALE_MS = 30 * 60 * 1000;
+const log = core.makeLogger('plugkit-bootstrap');
+
+function copyWasmToGmTools(wasmPath, wrapperDir, version) {
+  return core.copyWasmToGmTools(wasmPath, version, { wrapperDir });
+}
 
-function log(msg) {
-  try { process.stderr.write(`[plugkit-bootstrap] ${msg}\n`); } catch (_) {}
+function extractNpmPackageWithRetry(destPath, version) {
+  return extractNpmPackageWithRetryCore(destPath, version, { log });
 }
 
 function discoverBundledSkills(wrapperDir) {
@@ -126,139 +124,6 @@ function probeBinaryVersion(binPath) {
   } catch (_) { return null; }
 }
 
-function writeBootstrapError(spec) {
-  try {
-    const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
-    const spoolDir = path.join(projectDir, '.gm', 'exec-spool');
-    fs.mkdirSync(spoolDir, { recursive: true });
-    const out = path.join(spoolDir, '.bootstrap-error.json');
-    fs.writeFileSync(out, JSON.stringify({ ts: new Date().toISOString(), ...spec }, null, 2));
-  } catch (_) {}
-}
-
-function clearBootstrapError() {
-  try {
-    const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
-    const out = path.join(projectDir, '.gm', 'exec-spool', '.bootstrap-error.json');
-    fs.unlinkSync(out);
-  } catch (_) {}
-}
-
-function copyWasmToGmTools(wasmPath, wrapperDir, version) {
-  const dst = gmToolsDir();
-  fs.mkdirSync(dst, { recursive: true });
-  const target = path.join(dst, 'plugkit.wasm');
-  if (fs.existsSync(target)) {
-    try {
-      const cur = sha256OfFileSync(target);
-      const src = sha256OfFileSync(wasmPath);
-      if (cur === src) {
-        try { fs.writeFileSync(path.join(dst, 'plugkit.version'), version); } catch (_) {}
-        return;
-      }
-    } catch (_) {}
-  }
-  fs.copyFileSync(wasmPath, target);
-  fs.writeFileSync(path.join(dst, 'plugkit.version'), version);
-  try {
-    const srcSha = path.join(wrapperDir, 'plugkit.sha256');
-    if (fs.existsSync(srcSha)) fs.copyFileSync(srcSha, path.join(dst, 'plugkit.sha256'));
-  } catch (_) {}
-}
-
-function readVersionFile(wrapperDir) {
-  const p = path.join(wrapperDir, 'plugkit.version');
-  if (!fs.existsSync(p)) throw new Error(`plugkit.version not found at ${p}`);
-  return fs.readFileSync(p, 'utf8').trim();
-}
-
-
-function readShaManifest(wrapperDir, manifestName) {
-  const p = path.join(wrapperDir, manifestName || 'plugkit.sha256');
-  if (!fs.existsSync(p)) return null;
-  const out = {};
-  for (const line of fs.readFileSync(p, 'utf8').split(/\r?\n/)) {
-    const m = line.match(/^([0-9a-f]{64})\s+(\S+)\s*$/i);
-    if (m) out[m[2]] = m[1].toLowerCase();
-  }
-  return out;
-}
-
-async function extractNpmPackageWasm(destPath, version) {
-  const tempDir = path.join(path.dirname(destPath), '.npm-extract-' + Date.now());
-  try {
-    ensureDir(tempDir);
-    const startMs = Date.now();
-    log(`extracting npm package ${NPM_PACKAGE}@${version} to ${tempDir}`);
-    obsEvent('bootstrap', 'npm.extract.start', { package: NPM_PACKAGE, version });
-
-    const npmResolved = resolveWindowsExe('npm');
-    const isCmdShim = process.platform === 'win32' && /\.(cmd|bat)$/i.test(npmResolved);
-    const npmCliJs = isCmdShim ? resolveNpmCliJs(npmResolved) : null;
-    const installArgs = ['install', '--no-audit', '--no-fund', '--no-save', '--prefix', tempDir, NPM_PACKAGE + '@' + version];
-
-    const spawnCmd = npmCliJs ? process.execPath : (isCmdShim && /\s/.test(npmResolved) ? `"${npmResolved}"` : npmResolved);
-    const rawArgs = npmCliJs ? [npmCliJs, ...installArgs] : installArgs;
-    const spawnArgs = (isCmdShim && !npmCliJs) ? rawArgs.map(a => /[\s"]/.test(a) ? `"${a.replace(/"/g, '\\"')}"` : a) : rawArgs;
-    const result = spawnSync(
-      spawnCmd,
-      spawnArgs,
-      {
-        stdio: ['ignore', 'pipe', 'pipe'],
-        timeout: ATTEMPT_TIMEOUT_MS,
-        encoding: 'utf8',
-        windowsHide: true,
-        ...((isCmdShim && !npmCliJs) ? { shell: true } : {}),
-      }
-    );
-
-    if (result.error) throw result.error;
-    if (result.status !== 0) {
-      throw new Error(`npm install extraction failed: ${result.stderr || result.stdout || 'unknown error'}`);
-    }
-
-    const nodeModulesPath = path.join(tempDir, 'node_modules', NPM_PACKAGE, 'plugkit.wasm');
-    if (!fs.existsSync(nodeModulesPath)) {
-      throw new Error(`plugkit.wasm not found in extracted npm package at ${nodeModulesPath}`);
-    }
-
-    fs.copyFileSync(nodeModulesPath, destPath);
-    log(`extracted ${nodeModulesPath} -> ${destPath}`);
-    obsEvent('bootstrap', 'npm.extract.end', { dur_ms: Date.now() - startMs, ok: true });
-  } finally {
-    try { fs.rmSync(tempDir, { recursive: true, force: true, maxRetries: 1, retryDelay: 50 }); } catch (_) {}
-  }
-}
-
-async function extractNpmPackageWithRetry(destPath, version) {
-  let lastErr;
-  for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
-    try {
-      log(`npm extract attempt ${attempt}/${MAX_ATTEMPTS}: ${NPM_PACKAGE}@${version}`);
-      await extractNpmPackageWasm(destPath, version);
-      return;
-    } catch (err) {
-      lastErr = err;
-      log(`attempt ${attempt} failed: ${err.message}`);
-      obsEvent('bootstrap', 'npm.extract.attempt_failed', { package: NPM_PACKAGE, attempt, max: MAX_ATTEMPTS, err: String(err.message || err) });
-      if (err && (err.code === 'ENOENT' || /ENOENT/.test(String(err.message || '')))) {
-        log(`npx binary unresolvable (ENOENT); skipping retries, falling back`);
-        throw err;
-      }
-      if (err && (err.code === 'EINVAL' || /EINVAL/.test(String(err.message || '')))) {
-        log(`spawn EINVAL on npx shim; skipping retries, falling back`);
-        throw err;
-      }
-      if (attempt < MAX_ATTEMPTS) {
-        const wait = BACKOFF_MS[attempt - 1] || 120000;
-        log(`backing off ${wait}ms`);
-        await new Promise(r => setTimeout(r, wait));
-      }
-    }
-  }
-  throw lastErr;
-}
-
 async function bootstrap(opts) {
   opts = opts || {};
   const wrapperDir = opts.wrapperDir || __dirname;
@@ -282,7 +147,7 @@ async function bootstrap(opts) {
 
   if (fs.existsSync(wasmFinalPath) && fs.existsSync(wasmOkSentinel)) {
     if (wasmExpectedSha) {
-      const actualSha = sha256OfFileSync(wasmFinalPath);
+      const actualSha = require('../gm-plugkit/gm-process').sha256OfFileSync(wasmFinalPath);
       if (actualSha === wasmExpectedSha) {
         obsEvent('bootstrap', 'decision.hit', { reason: 'sha-match', version, path: wasmFinalPath });
         copyWasmToGmTools(wasmFinalPath, wrapperDir, version);
@@ -332,7 +197,7 @@ async function bootstrap(opts) {
     if (fs.existsSync(wasmPartialPath)) {
       try {
         const st = fs.statSync(wasmPartialPath);
-        if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
+        if (Date.now() - st.mtimeMs > 30 * 60 * 1000) {
           fs.unlinkSync(wasmPartialPath);
           log(`cleared stale partial: ${wasmPartialPath}`);
         }
@@ -351,7 +216,7 @@ async function bootstrap(opts) {
     }
 
     if (wasmExpectedSha) {
-      const got = await sha256OfFile(wasmPartialPath);
+      const got = await require('../gm-plugkit/gm-process').sha256OfFile(wasmPartialPath);
       if (got !== wasmExpectedSha) {
         try { fs.unlinkSync(wasmPartialPath); } catch (_) {}
         writeBootstrapError({
@@ -396,11 +261,7 @@ function getWasmPath(opts) {
     try { const r = cacheRoot(); ensureDir(r); return r; }
     catch (_) { const r = fallbackCacheRoot(); ensureDir(r); return r; }
   })();
-  const verDir = path.join(root, `v${version}`);
-  const wasmPath = path.join(verDir, 'plugkit.wasm');
-  const okSentinel = path.join(verDir, '.wasm-ok');
-  if (fs.existsSync(wasmPath) && fs.existsSync(okSentinel)) return wasmPath;
-  return null;
+  return resolveCacheWasmPath(root, version, 'plugkit.wasm');
 }
 
 function killStaleDaemonIfVersionChanged(wrapperDir) {

package/bin/plugkit-slim.wasm.sha256

@@ -1 +1 @@
-4785c38fbedab482430d5925eebf3eb687b5cc4607dd2d8442de89feb20c532a  plugkit-slim.wasm
+ffa850254a06a6a16e190b88a64dd960c369aae0a2ba2e985edc7a72ff11e779  plugkit-slim.wasm

package/bin/plugkit.version

@@ -1 +1 @@
-0.1.1048
+0.1.1049

package/bin/plugkit.wasm.sha256

@@ -1 +1 @@
-81a01efb3f14df1df3a1891a34920fdfabde276519fc1186cfd4e325a3efe907  plugkit.wasm
+d0008048fd103533948b5d91e48890ba3ff9b7d4544d00260bfa443d99077d8d  plugkit.wasm

package/gm-plugkit/bootstrap-shared.js

@@ -0,0 +1,320 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { spawnSync } = require('child_process');
+const { pidAlive, sha256OfFileSync } = require('./gm-process');
+
+
+const LOCK_STALE_MS = 30 * 60 * 1000;
+const ATTEMPT_TIMEOUT_MS = 10 * 60 * 1000;
+
+function obsEvent(subsystem, event, fields) {
+  if (process.env.GM_LOG_DISABLE) return;
+  try {
+    const root = process.env.GM_LOG_DIR || path.join(os.homedir(), '.claude', 'gm-log');
+    const day = new Date().toISOString().slice(0, 10);
+    const dir = path.join(root, day);
+    fs.mkdirSync(dir, { recursive: true });
+    const line = JSON.stringify({
+      ts: new Date().toISOString(),
+      sub: subsystem,
+      event,
+      pid: process.pid,
+      sess: process.env.CLAUDE_SESSION_ID || process.env.GM_SESSION_ID || '',
+      ...fields,
+    });
+    fs.appendFileSync(path.join(dir, `${subsystem}.jsonl`), line + '\n');
+  } catch (_) {}
+}
+
+function cacheRoot() {
+  const home = os.homedir();
+  if (process.env.PLUGKIT_CACHE_DIR) return process.env.PLUGKIT_CACHE_DIR;
+  if (os.platform() === 'win32') {
+    const base = process.env.LOCALAPPDATA || path.join(home, 'AppData', 'Local');
+    return path.join(base, 'plugkit', 'bin');
+  }
+  if (os.platform() === 'darwin') return path.join(home, 'Library', 'Caches', 'plugkit', 'bin');
+  const xdg = process.env.XDG_CACHE_HOME || path.join(home, '.cache');
+  return path.join(xdg, 'plugkit', 'bin');
+}
+
+function fallbackCacheRoot() {
+  return path.join(os.tmpdir(), 'plugkit-cache', 'bin');
+}
+
+function gmToolsDir() {
+  const home = process.env.USERPROFILE || process.env.HOME || os.homedir();
+  const primary = path.join(home, '.gm-tools');
+  const fallback = path.join(home, '.claude', 'gm-tools');
+  if (fs.existsSync(primary)) return primary;
+  if (fs.existsSync(fallback)) return fallback;
+  return primary;
+}
+
+function ensureDir(dir) {
+  fs.mkdirSync(dir, { recursive: true });
+}
+
+function acquireLock(lockPath) {
+  const start = Date.now();
+  for (;;) {
+    try {
+      const fd = fs.openSync(lockPath, 'wx');
+      fs.writeSync(fd, String(process.pid));
+      fs.closeSync(fd);
+      return true;
+    } catch (err) {
+      if (err.code !== 'EEXIST') throw err;
+      let stale = false;
+      try {
+        const st = fs.statSync(lockPath);
+        if (Date.now() - st.mtimeMs > LOCK_STALE_MS) stale = true;
+        const owner = parseInt(fs.readFileSync(lockPath, 'utf8').trim(), 10);
+        if (Number.isFinite(owner) && owner !== process.pid && !pidAlive(owner)) stale = true;
+      } catch (_) { stale = true; }
+      if (stale) {
+        try { fs.unlinkSync(lockPath); } catch (_) {}
+        continue;
+      }
+      if (Date.now() - start > ATTEMPT_TIMEOUT_MS) throw new Error(`lock wait timeout: ${lockPath}`);
+      try { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 2000); }
+      catch (e) { obsEvent('bootstrap', 'acquire-lock.atomics-wait-failed', { error: e.message, lockPath }); }
+    }
+  }
+}
+
+function releaseLock(lockPath) {
+  try { fs.unlinkSync(lockPath); } catch (_) {}
+}
+
+function isLockStale(lockPath) {
+  try {
+    const st = fs.statSync(lockPath);
+    if (Date.now() - st.mtimeMs > LOCK_STALE_MS) return true;
+    const owner = parseInt(fs.readFileSync(lockPath, 'utf8').trim(), 10);
+    if (Number.isFinite(owner) && !pidAlive(owner)) return true;
+  } catch (_) { return true; }
+  return false;
+}
+
+function pruneOldVersions(root, keepVersion) {
+  try {
+    const entries = fs.readdirSync(root);
+    for (const e of entries) {
+      if (!e.startsWith('v')) continue;
+      if (e === `v${keepVersion}`) continue;
+      const dir = path.join(root, e);
+      const lock = path.join(dir, '.lock');
+      if (fs.existsSync(lock) && !isLockStale(lock)) continue;
+      if (fs.existsSync(lock)) { try { fs.unlinkSync(lock); } catch (_) {} }
+      try {
+        fs.rmSync(dir, { recursive: true, force: true, maxRetries: 1, retryDelay: 50 });
+      } catch (_) {}
+    }
+  } catch (_) {}
+}
+
+function healIfShaMatches(binPath, expectedSha, sentinelPath, partialPath, kind) {
+  if (!fs.existsSync(binPath)) return false;
+  if (partialPath) { try { if (fs.existsSync(partialPath)) fs.unlinkSync(partialPath); } catch (_) {} }
+  if (!expectedSha) return false;
+  let got;
+  try { got = sha256OfFileSync(binPath); }
+  catch (_) { return false; }
+  if (got !== expectedSha) {
+    try { fs.unlinkSync(binPath); } catch (_) {}
+    return false;
+  }
+  try { fs.writeFileSync(sentinelPath, new Date().toISOString()); } catch (_) { return false; }
+  obsEvent('bootstrap', 'cache.heal', { path: binPath, kind });
+  return true;
+}
+
+function daemonVersionSentinel() {
+  const root = (() => {
+    try { const r = cacheRoot(); ensureDir(r); return r; }
+    catch (_) { const r = fallbackCacheRoot(); ensureDir(r); return r; }
+  })();
+  return path.join(root, '.daemon-version');
+}
+
+function readDaemonVersion() {
+  try { return fs.readFileSync(daemonVersionSentinel(), 'utf8').trim(); }
+  catch (_) { return null; }
+}
+
+function writeDaemonVersion(v) {
+  try { fs.writeFileSync(daemonVersionSentinel(), String(v)); } catch (_) {}
+}
+
+function pidCommandLineForKillGuard(pid) {
+  try {
+    if (process.platform === 'win32') {
+      const r = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', `(Get-CimInstance Win32_Process -Filter "ProcessId=${Number(pid)}").CommandLine`], { encoding: 'utf8', windowsHide: true, timeout: 5000 });
+      return String((r && r.stdout) || '');
+    }
+    const r = spawnSync('ps', ['-p', String(pid), '-o', 'args='], { encoding: 'utf8', timeout: 5000 });
+    return String((r && r.stdout) || '');
+  } catch (_) { return ''; }
+}
+
+function pidIsPlugkitProcess(pid) {
+  return /agentplug-runner(\.exe)?/i.test(pidCommandLineForKillGuard(pid));
+}
+
+function writeKillAttribution(targetSpoolDir, info) {
+  try {
+    fs.mkdirSync(targetSpoolDir, { recursive: true });
+    fs.writeFileSync(path.join(targetSpoolDir, '.kill-attribution.json'), JSON.stringify({ killer_pid: process.pid, killer_cwd: process.cwd(), killer_script: __filename, ts: Date.now(), ...info }, null, 2));
+  } catch (_) {}
+}
+
+function killPid(pid) {
+  if (!Number.isFinite(pid) || pid === process.pid || !pidAlive(pid)) return false;
+  try { process.kill(pid, 'SIGTERM'); }
+  catch (_) { try { process.kill(pid); } catch (_) {} }
+  if (os.platform() === 'win32' && pidAlive(pid)) {
+    try { spawnSync('taskkill', ['/F', '/PID', String(pid)], { stdio: 'ignore', windowsHide: true, timeout: 3000, killSignal: 'SIGKILL' }); } catch (_) {}
+  }
+  return true;
+}
+
+function killSpoolWatcherInCwd(reason) {
+  try {
+    const pidPath = path.join(process.cwd(), '.gm', 'exec-spool', '.watcher.pid');
+    if (!fs.existsSync(pidPath)) return null;
+    const pid = parseInt(fs.readFileSync(pidPath, 'utf8').trim(), 10);
+    if (pidAlive(pid) && !pidIsPlugkitProcess(pid)) {
+      obsEvent('bootstrap', 'watcher.kill-skipped-pid-reused', { pid, reason });
+      try { fs.unlinkSync(pidPath); } catch (_) {}
+      return null;
+    }
+    writeKillAttribution(path.join(process.cwd(), '.gm', 'exec-spool'), { reason, target_pid: pid, via: 'killSpoolWatcherInCwd' });
+    if (killPid(pid)) {
+      obsEvent('bootstrap', 'watcher.killed', { pid, reason });
+      try { fs.unlinkSync(pidPath); } catch (_) {}
+      return pid;
+    }
+    try { fs.unlinkSync(pidPath); } catch (_) {}
+  } catch (_) {}
+  return null;
+}
+
+function proactiveKillForNewInstall(installedVersion) {
+  try {
+    const reason = `install:v${installedVersion}`;
+    killSpoolWatcherInCwd(reason);
+    writeDaemonVersion(installedVersion);
+  } catch (_) {}
+}
+
+function resolveWindowsExe(cmd) {
+  if (process.platform !== 'win32') return cmd;
+  try {
+    const r = spawnSync('where', [cmd], {
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      windowsHide: true,
+      timeout: 800,
+    });
+    if (r.status !== 0) return cmd;
+    const lines = (r.stdout || '').split(/\r?\n/).map(l => l.trim()).filter(Boolean);
+    const exe = lines.find(l => /\.exe$/i.test(l));
+    const shim = lines.find(l => /\.(cmd|bat)$/i.test(l));
+    return exe || shim || cmd;
+  } catch {
+    return cmd;
+  }
+}
+
+function resolveNpmCliJs(shimPath) {
+  const candidates = [];
+  try {
+    const execDir = path.dirname(process.execPath);
+    candidates.push(path.join(execDir, 'node_modules', 'npm', 'bin', 'npm-cli.js'));
+  } catch (_) {}
+  try {
+    const shimDir = path.dirname(shimPath);
+    candidates.push(path.join(shimDir, 'node_modules', 'npm', 'bin', 'npm-cli.js'));
+  } catch (_) {}
+  candidates.push(
+    path.join('C:', 'Program Files', 'nodejs', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    path.join(process.env.APPDATA || '', 'npm', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    path.join(process.env.APPDATA || '', 'nvm', process.version.replace(/^v/, ''), 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+  );
+  return candidates.find(p => { try { return fs.existsSync(p); } catch (_) { return false; } }) || null;
+}
+
+function ensureNextStepWiring(cwd) {
+  const changes = [];
+  const gmDir = path.join(cwd, '.gm');
+  try { fs.mkdirSync(gmDir, { recursive: true }); }
+  catch (e) { obsEvent('bootstrap', 'next-step.wiring.target-failed', { target: gmDir, error: e.message }); }
+
+  const nextStepPath = path.join(gmDir, 'next-step.md');
+  const nextStepBody = '# Next step\n\nDispatch the `instruction` verb to plugkit by writing `.gm/exec-spool/in/instruction/<N>.txt` (any unique N) with body `{}` (or `{"prompt":"<user request>"}` on the first dispatch of the turn). Read the response from `.gm/exec-spool/out/<N>.json` and follow the imperative in the `instruction` field.\n\nThis file is auto-rewritten by plugkit on every instruction dispatch.\n';
+  try {
+    if (!fs.existsSync(nextStepPath)) {
+      fs.writeFileSync(nextStepPath, nextStepBody);
+      changes.push('seeded .gm/next-step.md');
+    }
+  } catch (e) { obsEvent('bootstrap', 'next-step.wiring.target-failed', { target: nextStepPath, error: e.message }); }
+
+  const claudeMdPath = path.join(cwd, 'CLAUDE.md');
+  try {
+    if (!fs.existsSync(claudeMdPath)) {
+      fs.writeFileSync(claudeMdPath, '@AGENTS.md\n');
+      changes.push('created CLAUDE.md');
+    } else {
+      const cur = fs.readFileSync(claudeMdPath, 'utf8');
+      const hasLine = cur.split(/\r?\n/).some(l => l.trim() === '@AGENTS.md');
+      if (!hasLine) {
+        fs.writeFileSync(claudeMdPath, '@AGENTS.md\n' + cur);
+        changes.push('prepended @AGENTS.md to CLAUDE.md');
+      }
+    }
+  } catch (e) { obsEvent('bootstrap', 'next-step.wiring.target-failed', { target: claudeMdPath, error: e.message }); }
+
+  const agentsMdPath = path.join(cwd, 'AGENTS.md');
+  try {
+    if (fs.existsSync(agentsMdPath)) {
+      const cur = fs.readFileSync(agentsMdPath, 'utf8');
+      const hasLine = cur.split(/\r?\n/).some(l => l.trim() === '@.gm/next-step.md');
+      if (!hasLine) {
+        const sep = cur.endsWith('\n') ? '' : '\n';
+        fs.writeFileSync(agentsMdPath, cur + sep + '\n@.gm/next-step.md\n');
+        changes.push('appended @.gm/next-step.md to AGENTS.md');
+      }
+    }
+  } catch (e) { obsEvent('bootstrap', 'next-step.wiring.target-failed', { target: agentsMdPath, error: e.message }); }
+
+  return changes;
+}
+
+module.exports = {
+  obsEvent,
+  cacheRoot,
+  fallbackCacheRoot,
+  gmToolsDir,
+  ensureDir,
+  acquireLock,
+  releaseLock,
+  isLockStale,
+  pruneOldVersions,
+  healIfShaMatches,
+  daemonVersionSentinel,
+  readDaemonVersion,
+  writeDaemonVersion,
+  pidCommandLineForKillGuard,
+  pidIsPlugkitProcess,
+  writeKillAttribution,
+  killPid,
+  killSpoolWatcherInCwd,
+  proactiveKillForNewInstall,
+  ensureNextStepWiring,
+  resolveWindowsExe,
+  resolveNpmCliJs,
+};

package/gm-plugkit/bootstrap-wasm-core.js

@@ -0,0 +1,236 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { spawnSync } = require('child_process');
+const { sha256OfFileSync } = require('./gm-process');
+const {
+  obsEvent,
+  gmToolsDir,
+  resolveWindowsExe,
+  resolveNpmCliJs,
+} = require('./bootstrap-shared');
+
+const NPM_PACKAGE = 'plugkit-wasm';
+const ATTEMPT_TIMEOUT_MS = 10 * 60 * 1000;
+const MAX_ATTEMPTS = 3;
+const BACKOFF_MS = [5000, 15000];
+
+function makeLogger(prefix) {
+  return function log(msg) {
+    try { process.stderr.write(`[${prefix}] ${msg}\n`); } catch (_) {}
+  };
+}
+
+function resolveProjectRoot(start) {
+  const resolved = path.resolve(start);
+  try {
+    const r = spawnSync('git', ['rev-parse', '--git-common-dir'], { cwd: resolved, encoding: 'utf-8', windowsHide: true, timeout: 1500 });
+    if (r.status === 0 && r.stdout && r.stdout.trim()) {
+      let commonDir = r.stdout.trim();
+      if (!path.isAbsolute(commonDir)) commonDir = path.resolve(resolved, commonDir);
+      if (/(^|[\\/])\.git$/.test(commonDir)) return path.dirname(commonDir);
+    }
+  } catch (_) {}
+  return resolved;
+}
+
+function writeBootstrapError(spec) {
+  try {
+    const projectDir = resolveProjectRoot(process.env.CLAUDE_PROJECT_DIR || process.cwd());
+    const spoolDir = path.join(projectDir, '.gm', 'exec-spool');
+    fs.mkdirSync(spoolDir, { recursive: true });
+    fs.writeFileSync(path.join(spoolDir, '.bootstrap-error.json'), JSON.stringify({ ts: new Date().toISOString(), ...spec }, null, 2));
+  } catch (_) {}
+}
+
+function clearBootstrapError() {
+  try {
+    const projectDir = resolveProjectRoot(process.env.CLAUDE_PROJECT_DIR || process.cwd());
+    fs.unlinkSync(path.join(projectDir, '.gm', 'exec-spool', '.bootstrap-error.json'));
+  } catch (_) {}
+}
+
+function readVersionFile(wrapperDir) {
+  const p = path.join(wrapperDir, 'plugkit.version');
+  if (!fs.existsSync(p)) throw new Error(`plugkit.version not found at ${p}`);
+  return fs.readFileSync(p, 'utf8').trim();
+}
+
+function readShaManifest(wrapperDir, manifestName) {
+  const p = path.join(wrapperDir, manifestName || 'plugkit.sha256');
+  if (!fs.existsSync(p)) return null;
+  const raw = fs.readFileSync(p, 'utf8');
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === 'object') {
+      const out = {};
+      for (const [name, sha] of Object.entries(parsed)) {
+        if (typeof sha === 'string') out[name] = sha.toLowerCase();
+      }
+      return out;
+    }
+  } catch (_) {}
+  const out = {};
+  for (const line of raw.split(/\r?\n/)) {
+    const m = line.match(/^([0-9a-f]{64})\s+(\S+)\s*$/i);
+    if (m) out[m[2]] = m[1].toLowerCase();
+  }
+  return out;
+}
+
+function copyWasmToGmTools(wasmPath, version, opts) {
+  opts = opts || {};
+  const dst = gmToolsDir();
+  fs.mkdirSync(dst, { recursive: true });
+  const target = path.join(dst, 'plugkit.wasm');
+
+  let wasmFresh = false;
+  if (fs.existsSync(target)) {
+    try {
+      const cur = sha256OfFileSync(target);
+      const src = sha256OfFileSync(wasmPath);
+      if (cur === src) wasmFresh = true;
+    } catch (_) {}
+  }
+  if (!wasmFresh) {
+    const tmp = `${target}.partial-${process.pid}`;
+    fs.copyFileSync(wasmPath, tmp);
+    try { fs.renameSync(tmp, target); }
+    catch (err) {
+      if (err.code === 'EEXIST' || err.code === 'EPERM') {
+        try { fs.unlinkSync(target); } catch (_) {}
+        fs.renameSync(tmp, target);
+      } else {
+        try { fs.unlinkSync(tmp); } catch (_) {}
+        throw err;
+      }
+    }
+  }
+  fs.writeFileSync(path.join(dst, 'plugkit.version'), version);
+
+  if (opts.wrapperDir) {
+    try {
+      const srcSha = path.join(opts.wrapperDir, 'plugkit.sha256');
+      if (fs.existsSync(srcSha)) fs.copyFileSync(srcSha, path.join(dst, 'plugkit.sha256'));
+    } catch (_) {}
+  }
+}
+
+function resolveCacheWasmPath(root, version, wasmName) {
+  const verDir = path.join(root, `v${version}`);
+  const wasmPath = path.join(verDir, wasmName || 'plugkit.wasm');
+  const okSentinel = path.join(verDir, '.wasm-ok');
+  if (fs.existsSync(wasmPath) && fs.existsSync(okSentinel)) return wasmPath;
+  return null;
+}
+
+function resolveInstalledWasmPath() {
+  const home = process.env.USERPROFILE || process.env.HOME || os.homedir();
+  const primary = path.join(home, '.gm-tools', 'plugkit.wasm');
+  const fallback = path.join(home, '.claude', 'gm-tools', 'plugkit.wasm');
+  if (fs.existsSync(primary)) return primary;
+  if (fs.existsSync(fallback)) return fallback;
+  return primary;
+}
+
+async function extractNpmPackageWasm(destPath, version, opts) {
+  opts = opts || {};
+  const log = opts.log || makeLogger('plugkit-bootstrap');
+  const { ensureDir } = require('./bootstrap-shared');
+  const tempDir = path.join(path.dirname(destPath), '.npm-extract-' + Date.now());
+  try {
+    ensureDir(tempDir);
+    const startMs = Date.now();
+    log(`extracting npm package ${NPM_PACKAGE}@${version} to ${tempDir}`);
+    obsEvent('bootstrap', 'npm.extract.start', { package: NPM_PACKAGE, version });
+
+    fs.writeFileSync(path.join(tempDir, 'package.json'), JSON.stringify({ name: 'plugkit-extract', version: '0.0.0', private: true }));
+
+    const cmd = resolveWindowsExe('npm');
+    const installArgs = ['install', '--no-audit', '--no-fund', '--no-save', NPM_PACKAGE + '@' + version];
+    const isCmdShim = process.platform === 'win32' && /\.(cmd|bat)$/i.test(cmd);
+    const npmCliJs = isCmdShim ? resolveNpmCliJs(cmd) : null;
+
+    const spawnCmd = npmCliJs ? process.execPath : (isCmdShim ? `"${cmd}"` : cmd);
+    const rawArgs = npmCliJs ? [npmCliJs, ...installArgs] : installArgs;
+    const spawnArgs = (isCmdShim && !npmCliJs) ? rawArgs.map(a => /[\s"]/.test(a) ? `"${a.replace(/"/g, '\\"')}"` : a) : rawArgs;
+
+    const result = spawnSync(spawnCmd, spawnArgs, {
+      cwd: tempDir,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: ATTEMPT_TIMEOUT_MS,
+      encoding: 'utf8',
+      windowsHide: true,
+      ...((isCmdShim && !npmCliJs) ? { shell: true } : {}),
+    });
+
+    if (result.error) throw result.error;
+    if (result.status !== 0) {
+      const detail = (result.stderr || result.stdout || '').trim().split(/\r?\n/).slice(-5).join(' | ');
+      const sig = result.signal ? ` signal=${result.signal}` : '';
+      throw new Error(`npm install failed status=${result.status}${sig}: ${detail || 'no stderr/stdout captured'}`);
+    }
+
+    const nodeModulesPath = path.join(tempDir, 'node_modules', NPM_PACKAGE, 'plugkit.wasm');
+    if (!fs.existsSync(nodeModulesPath)) {
+      throw new Error(`plugkit.wasm not found in extracted npm package at ${nodeModulesPath}`);
+    }
+
+    fs.copyFileSync(nodeModulesPath, destPath);
+    log(`extracted ${nodeModulesPath} -> ${destPath}`);
+    obsEvent('bootstrap', 'npm.extract.end', { dur_ms: Date.now() - startMs, ok: true });
+  } finally {
+    try { fs.rmSync(tempDir, { recursive: true, force: true, maxRetries: 1, retryDelay: 50 }); } catch (_) {}
+  }
+}
+
+async function extractNpmPackageWithRetry(destPath, version, opts) {
+  opts = opts || {};
+  const log = opts.log || makeLogger('plugkit-bootstrap');
+  let lastErr;
+  for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+    try {
+      log(`npm extract attempt ${attempt}/${MAX_ATTEMPTS}: ${NPM_PACKAGE}@${version}`);
+      await extractNpmPackageWasm(destPath, version, opts);
+      return;
+    } catch (err) {
+      lastErr = err;
+      log(`attempt ${attempt} failed: ${err.message}`);
+      obsEvent('bootstrap', 'npm.extract.attempt_failed', { package: NPM_PACKAGE, attempt, max: MAX_ATTEMPTS, err: String(err.message || err) });
+      if (err && (err.code === 'ENOENT' || /ENOENT/.test(String(err.message || '')))) {
+        log(`npm binary unresolvable (ENOENT); skipping retries, falling back`);
+        throw err;
+      }
+      if (err && (err.code === 'EINVAL' || /EINVAL/.test(String(err.message || '')))) {
+        log(`spawn EINVAL on npm shim; skipping retries, falling back`);
+        throw err;
+      }
+      if (attempt < MAX_ATTEMPTS) {
+        const wait = BACKOFF_MS[attempt - 1] || 120000;
+        log(`backing off ${wait}ms`);
+        await new Promise(r => setTimeout(r, wait));
+      }
+    }
+  }
+  throw lastErr;
+}
+
+module.exports = {
+  NPM_PACKAGE,
+  ATTEMPT_TIMEOUT_MS,
+  MAX_ATTEMPTS,
+  BACKOFF_MS,
+  makeLogger,
+  resolveProjectRoot,
+  writeBootstrapError,
+  clearBootstrapError,
+  readVersionFile,
+  readShaManifest,
+  copyWasmToGmTools,
+  resolveCacheWasmPath,
+  resolveInstalledWasmPath,
+  extractNpmPackageWasm,
+  extractNpmPackageWithRetry,
+};

package/gm-plugkit/bootstrap.js

@@ -6,8 +6,9 @@ const path = require('path');
 const os = require('os');
 const crypto = require('crypto');
 const { spawn, spawnSync } = require('child_process');
-const { pidAlive, sha256OfFile, sha256OfFileSync } = require('./gm-process');
+const { sha256OfFile, sha256OfFileSync } = require('./gm-process');
 const shared = require('./bootstrap-shared');
+const core = require('./bootstrap-wasm-core');
 const {
   obsEvent,
   cacheRoot,
@@ -16,49 +17,40 @@ const {
   ensureDir,
   acquireLock,
   releaseLock,
-  isLockStale,
   pruneOldVersions,
   healIfShaMatches,
   daemonVersionSentinel,
   readDaemonVersion,
   writeDaemonVersion,
-  pidCommandLineForKillGuard,
-  pidIsPlugkitProcess,
-  writeKillAttribution,
-  killPid,
   killSpoolWatcherInCwd,
   proactiveKillForNewInstall,
   ensureNextStepWiring: ensureNextStepWiringShared,
-  resolveWindowsExe,
-  resolveNpmCliJs,
 } = shared;
+const {
+  resolveProjectRoot,
+  writeBootstrapError,
+  clearBootstrapError,
+  resolveInstalledWasmPath,
+} = core;
 
-const NPM_PACKAGE = 'plugkit-wasm';
-const ATTEMPT_TIMEOUT_MS = 10 * 60 * 1000;
-const MAX_ATTEMPTS = 3;
-const BACKOFF_MS = [5000, 15000];
 const LOCK_STALE_MS = 30 * 60 * 1000;
 
 const wrapperDir = __dirname;
 
-function log(msg) {
-  try { process.stderr.write(`[gm-plugkit] ${msg}\n`); } catch (_) {}
-}
+const log = core.makeLogger('gm-plugkit');
 
-function writeBootstrapError(spec) {
+function copyWasmToGmTools(wasmPath, version) {
+  core.copyWasmToGmTools(wasmPath, version);
   try {
-    const projectDir = resolveProjectRoot(process.env.CLAUDE_PROJECT_DIR || process.cwd());
-    const spoolDir = path.join(projectDir, '.gm', 'exec-spool');
-    fs.mkdirSync(spoolDir, { recursive: true });
-    fs.writeFileSync(path.join(spoolDir, '.bootstrap-error.json'), JSON.stringify({ ts: new Date().toISOString(), ...spec }, null, 2));
+    const ownPkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8'));
+    if (ownPkg && ownPkg.version) {
+      fs.writeFileSync(path.join(gmToolsDir(), 'gm-plugkit.version'), ownPkg.version);
+    }
   } catch (_) {}
 }
 
-function clearBootstrapError() {
-  try {
-    const projectDir = resolveProjectRoot(process.env.CLAUDE_PROJECT_DIR || process.cwd());
-    fs.unlinkSync(path.join(projectDir, '.gm', 'exec-spool', '.bootstrap-error.json'));
-  } catch (_) {}
+function extractNpmPackageWithRetry(destPath, version) {
+  return core.extractNpmPackageWithRetry(destPath, version, { log });
 }
 
 function sha256Hex(buf) {
@@ -179,45 +171,12 @@ function hasNativeEmbedRunner() {
   return names.some(n => { try { return fs.existsSync(path.join(dir, n)); } catch (_) { return false; } });
 }
 
-function resolveProjectRoot(start) {
-  const resolved = path.resolve(start);
-  try {
-    const r = spawnSync('git', ['rev-parse', '--git-common-dir'], { cwd: resolved, encoding: 'utf-8', windowsHide: true, timeout: 1500 });
-    if (r.status === 0 && r.stdout && r.stdout.trim()) {
-      let commonDir = r.stdout.trim();
-      if (!path.isAbsolute(commonDir)) commonDir = path.resolve(resolved, commonDir);
-      if (/(^|[\\/])\.git$/.test(commonDir)) return path.dirname(commonDir);
-    }
-  } catch (_) {}
-  return resolved;
-}
-
 function readVersionFile() {
-  const p = path.join(wrapperDir, 'plugkit.version');
-  if (!fs.existsSync(p)) throw new Error(`plugkit.version not found at ${p}`);
-  return fs.readFileSync(p, 'utf8').trim();
+  return core.readVersionFile(wrapperDir);
 }
 
 function readShaManifest() {
-  const p = path.join(wrapperDir, 'plugkit.sha256');
-  if (!fs.existsSync(p)) return null;
-  const raw = fs.readFileSync(p, 'utf8');
-  try {
-    const parsed = JSON.parse(raw);
-    if (parsed && typeof parsed === 'object') {
-      const out = {};
-      for (const [name, sha] of Object.entries(parsed)) {
-        if (typeof sha === 'string') out[name] = sha.toLowerCase();
-      }
-      return out;
-    }
-  } catch (_) {}
-  const out = {};
-  for (const line of raw.split(/\r?\n/)) {
-    const m = line.match(/^([0-9a-f]{64})\s+(\S+)\s*$/i);
-    if (m) out[m[2]] = m[1].toLowerCase();
-  }
-  return out;
+  return core.readShaManifest(wrapperDir);
 }
 
 async function fetchRemoteSha(version, artifactName) {
@@ -231,54 +190,6 @@ async function fetchRemoteSha(version, artifactName) {
   }
 }
 
-async function extractNpmPackageWasm(destPath, version) {
-  const tempDir = path.join(path.dirname(destPath), '.npm-extract-' + Date.now());
-  try {
-    ensureDir(tempDir);
-    const startMs = Date.now();
-    log(`extracting npm package ${NPM_PACKAGE}@${version} to ${tempDir}`);
-    obsEvent('bootstrap', 'npm.extract.start', { package: NPM_PACKAGE, version });
-
-    fs.writeFileSync(path.join(tempDir, 'package.json'), JSON.stringify({ name: 'plugkit-extract', version: '0.0.0', private: true }));
-
-    const cmd = resolveWindowsExe('npm');
-    const installArgs = ['install', '--no-audit', '--no-fund', '--no-save', NPM_PACKAGE + '@' + version];
-    const isCmdShim = process.platform === 'win32' && /\.(cmd|bat)$/i.test(cmd);
-    const npmCliJs = isCmdShim ? resolveNpmCliJs(cmd) : null;
-
-    const spawnCmd = npmCliJs ? process.execPath : (isCmdShim ? `"${cmd}"` : cmd);
-    const rawArgs = npmCliJs ? [npmCliJs, ...installArgs] : installArgs;
-    const spawnArgs = (isCmdShim && !npmCliJs) ? rawArgs.map(a => /[\s"]/.test(a) ? `"${a.replace(/"/g, '\\"')}"` : a) : rawArgs;
-
-    const result = spawnSync(spawnCmd, spawnArgs, {
-      cwd: tempDir,
-      stdio: ['ignore', 'pipe', 'pipe'],
-      timeout: ATTEMPT_TIMEOUT_MS,
-      encoding: 'utf8',
-      windowsHide: true,
-      ...((isCmdShim && !npmCliJs) ? { shell: true } : {}),
-    });
-
-    if (result.error) throw result.error;
-    if (result.status !== 0) {
-      const detail = (result.stderr || result.stdout || '').trim().split(/\r?\n/).slice(-5).join(' | ');
-      const sig = result.signal ? ` signal=${result.signal}` : '';
-      throw new Error(`npm install failed status=${result.status}${sig}: ${detail || 'no stderr/stdout captured'}`);
-    }
-
-    const nodeModulesPath = path.join(tempDir, 'node_modules', NPM_PACKAGE, 'plugkit.wasm');
-    if (!fs.existsSync(nodeModulesPath)) {
-      throw new Error(`plugkit.wasm not found in extracted npm package at ${nodeModulesPath}`);
-    }
-
-    fs.copyFileSync(nodeModulesPath, destPath);
-    log(`extracted ${nodeModulesPath} -> ${destPath}`);
-    obsEvent('bootstrap', 'npm.extract.end', { dur_ms: Date.now() - startMs, ok: true });
-  } finally {
-    try { fs.rmSync(tempDir, { recursive: true, force: true, maxRetries: 1, retryDelay: 50 }); } catch (_) {}
-  }
-}
-
 function httpGetBuffer(url, timeoutMs) {
   const https = require('https');
   const idleTimeoutMs = timeoutMs || 30000;
@@ -355,35 +266,6 @@ async function downloadFromGithubReleases(destPath, version, artifactName) {
   log(`gh-releases wrote ${buf.length} bytes to ${destPath} (artifact=${name})`);
 }
 
-async function extractNpmPackageWithRetry(destPath, version) {
-  let lastErr;
-  for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
-    try {
-      log(`npm extract attempt ${attempt}/${MAX_ATTEMPTS}: ${NPM_PACKAGE}@${version}`);
-      await extractNpmPackageWasm(destPath, version);
-      return;
-    } catch (err) {
-      lastErr = err;
-      log(`attempt ${attempt} failed: ${err.message}`);
-      obsEvent('bootstrap', 'npm.extract.attempt_failed', { package: NPM_PACKAGE, attempt, max: MAX_ATTEMPTS, err: String(err.message || err) });
-      if (err && (err.code === 'ENOENT' || /ENOENT/.test(String(err.message || '')))) {
-        log(`npm binary unresolvable (ENOENT); skipping retries, falling back`);
-        throw err;
-      }
-      if (err && (err.code === 'EINVAL' || /EINVAL/.test(String(err.message || '')))) {
-        log(`spawn EINVAL on npm shim; skipping retries, falling back`);
-        throw err;
-      }
-      if (attempt < MAX_ATTEMPTS) {
-        const wait = BACKOFF_MS[attempt - 1] || 120000;
-        log(`backing off ${wait}ms`);
-        await new Promise(r => setTimeout(r, wait));
-      }
-    }
-  }
-  throw lastErr;
-}
-
 function killStaleDaemonIfVersionChanged() {
   let currentVersion;
   try { currentVersion = readVersionFile(); }
@@ -391,9 +273,9 @@ function killStaleDaemonIfVersionChanged() {
     obsEvent('bootstrap', 'kill-stale-daemon.version-read-failed', { error: e.message });
     return;
   }
-  const cached = resolveCachedBinary({ version: currentVersion });
-  if (cached) {
-    proactiveKillForNewInstall(currentVersion, cached);
+  const cached = resolveInstalledWasmPath();
+  if (cached && fs.existsSync(cached)) {
+    proactiveKillForNewInstall(currentVersion);
     return;
   }
   const recorded = readDaemonVersion();
@@ -553,51 +435,8 @@ async function bootstrap(opts) {
   }
 }
 
-function copyWasmToGmTools(wasmPath, version) {
-  const dst = gmToolsDir();
-  fs.mkdirSync(dst, { recursive: true });
-  const target = path.join(dst, 'plugkit.wasm');
-
-  let wasmFresh = false;
-  if (fs.existsSync(target)) {
-    try {
-      const cur = sha256OfFileSync(target);
-      const src = sha256OfFileSync(wasmPath);
-      if (cur === src) wasmFresh = true;
-    } catch (_) {}
-  }
-  if (!wasmFresh) {
-    const tmp = `${target}.partial-${process.pid}`;
-    fs.copyFileSync(wasmPath, tmp);
-    try { fs.renameSync(tmp, target); }
-    catch (err) {
-      if (err.code === 'EEXIST' || err.code === 'EPERM') {
-        try { fs.unlinkSync(target); } catch (_) {}
-        fs.renameSync(tmp, target);
-      } else {
-        try { fs.unlinkSync(tmp); } catch (_) {}
-        throw err;
-      }
-    }
-  }
-  fs.writeFileSync(path.join(dst, 'plugkit.version'), version);
-
-  try {
-    const ownPkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8'));
-    if (ownPkg && ownPkg.version) {
-      fs.writeFileSync(path.join(dst, 'gm-plugkit.version'), ownPkg.version);
-    }
-  } catch (_) {}
-
-}
-
 function getWasmPath() {
-  const home = process.env.USERPROFILE || process.env.HOME || os.homedir();
-  const primary = path.join(home, '.gm-tools', 'plugkit.wasm');
-  const fallback = path.join(home, '.claude', 'gm-tools', 'plugkit.wasm');
-  if (fs.existsSync(primary)) return primary;
-  if (fs.existsSync(fallback)) return fallback;
-  return primary;
+  return resolveInstalledWasmPath();
 }
 
 function isReady() {

package/gm-plugkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.2208",
+  "version": "2.0.2210",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.",
   "main": "index.js",
   "bin": {

package/gm-plugkit/plugkit-slim.wasm.sha256

@@ -1 +1 @@
-4785c38fbedab482430d5925eebf3eb687b5cc4607dd2d8442de89feb20c532a  plugkit-slim.wasm
+ffa850254a06a6a16e190b88a64dd960c369aae0a2ba2e985edc7a72ff11e779  plugkit-slim.wasm

package/gm-plugkit/plugkit.version

@@ -1 +1 @@
-0.1.1048
+0.1.1049

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.2208",
+  "version": "2.0.2210",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",
@@ -17,5 +17,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "plugkitVersion": "0.1.1048"
+  "plugkitVersion": "0.1.1049"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-skill",
-  "version": "2.0.2208",
+  "version": "2.0.2210",
   "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
   "author": "AnEntrypoint",
   "license": "MIT",
@@ -38,6 +38,8 @@
     "bin/plugkit.wasm.sha256",
     "bin/plugkit-slim.wasm.sha256",
     "gm-plugkit/bootstrap.js",
+    "gm-plugkit/bootstrap-wasm-core.js",
+    "gm-plugkit/bootstrap-shared.js",
     "gm-plugkit/cli.js",
     "gm-plugkit/index.js",
     "gm-plugkit/package.json",