gm-skill 2.0.2467 → 2.0.2468

package/AGENTS.md

@@ -50,7 +50,7 @@ Dispatch = Write `.gm/exec-spool/in/<verb>/<N>.txt`, Read `.gm/exec-spool/out/<v
 - **Wasm-direct verbs**: fs/kv/exec/fetch/env, recall, codesearch, memorize(+prune), health, filter, full git verb family. Enumeration in the recall store (`recall: wasm-direct plugkit verbs full list`).
 - **Host-native verb**: `background-convert` (`{verb, task}`) detaches an already-in-flight dispatch so the daemon worker stops waiting on it -- agent-initiated only, never routed to gm.wasm. Detail: `.gm/daemon-config-reference.md`.
 - **memorize-prune**: prune bad/superseded memories; two-mode spec (key-remove vs query-review) in the recall store (`recall: memorize-prune verb two-mode spec`).
-- **git verbs**: git is a first-class spool surface, never a shell command; `git_finalize {message}` is the bundled COMPLETE-phase push surface, `git_push` the only admissible raw push (porcelain-gated, rebase-retry). A git-dominant `bash`/`powershell` body is gated (`deviation.bash-git-bypass`). Per-verb shapes + host_git `.exe` resolution in the recall store (`recall: git verbs rs-plugkit spool surface`). `git_finalize` also runs `ci-status` inline right after push and auto-writes `.gm/exec-spool/.ci-validated` on a green result -- no separate poll-then-marker dispatch needed. The `ci-validated-fresh` COMPLETE gate compares that marker's `head_sha` against current HEAD and names `ci-status` as its `next_dispatch` on denial.
+- **git verbs**: git is a first-class spool surface, never a shell command; `git_finalize {message}` is the bundled COMPLETE-phase push surface, `git_push` the only admissible raw push (porcelain-gated, rebase-retry). A git-dominant `bash`/`powershell` body is gated (`deviation.bash-git-bypass`). Per-verb shapes + host_git `.exe` resolution in the recall store (`recall: git verbs rs-plugkit spool surface`). `git_finalize` also runs `ci-status` inline right after push and auto-writes `.gm/exec-spool/.ci-validated` on a green result -- no separate poll-then-marker dispatch needed. The `ci-validated-fresh` COMPLETE gate compares that marker's `head_sha` against current HEAD and names `ci-status` as its `next_dispatch` on denial. An async git host (one that answers host_git with `{pending,token}` and parks the terminal result in kv ns `outbox`) is served by the `git_poll {token}` verb: `git_status`/`git_add`/`git_commit`/`git_log`/`git_diff` return pending envelopes there, and the caller repeats `git_poll` until a non-pending envelope comes back -- that envelope is the verb's terminal result, plan-resumed across dispatches for compound verbs.
 - **filter**: pure stdout -> compact-stdout transform, in-wasm. Spec + usage (pipe raw command output through it before context) in the recall store (`recall: filter verb rs-plugkit spool spec`).
 
 ## Documentation Policy

package/gm-plugkit/bootstrap.js

@@ -792,6 +792,95 @@ function getBinaryPath() {
   return getWasmPath();
 }
 
+function agentplugRunnerAssetName() {
+  const plat = process.platform;
+  const arch = process.arch;
+  if (plat === 'win32') {
+    if (arch === 'x64') return 'agentplug-runner-windows-x64.exe';
+    if (arch === 'arm64') return 'agentplug-runner-windows-arm64.exe';
+    return null;
+  }
+  if (plat === 'darwin') {
+    if (arch === 'x64') return 'agentplug-runner-macos-x64';
+    if (arch === 'arm64') return 'agentplug-runner-macos-arm64';
+    return null;
+  }
+  if (plat === 'linux') {
+    if (arch === 'x64') return 'agentplug-runner-linux-x64';
+    if (arch === 'arm64') return 'agentplug-runner-linux-arm64';
+    return null;
+  }
+  return null;
+}
+
+function compareDottedSemverAscending(a, b) {
+  const pa = a.replace(/^v/, '').split('.').map(Number);
+  const pb = b.replace(/^v/, '').split('.').map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] || 0) - (pb[i] || 0);
+    if (d !== 0) return d;
+  }
+  return 0;
+}
+
+function latestAgentplugRunnerTagViaGitLsRemote() {
+  const { execFileSync } = require('child_process');
+  const out = execFileSync('git', ['ls-remote', '--tags', '--refs', 'https://github.com/AnEntrypoint/agentplug-bin.git'], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'ignore'],
+  });
+  const tags = out.split('\n')
+    .map(line => line.match(/refs\/tags\/(.+)$/))
+    .filter(Boolean)
+    .map(m => m[1]);
+  if (tags.length === 0) return null;
+  tags.sort(compareDottedSemverAscending);
+  return tags[tags.length - 1];
+}
+
+// The sole loader has to exist before startSpoolDaemon can do anything --
+// a project that never ran `gm-skill install` (or whose install predates
+// agentplug-runner) hit a hard "not installed" failure here even though
+// the sha256-verified download this needs is the same one bin/install.js
+// already performs. Attempting it inline means a bare `spool` boot recovers
+// on its own instead of requiring a separate manual install step first.
+async function ensureAgentplugRunnerInstalled(destPath) {
+  const assetName = agentplugRunnerAssetName();
+  if (!assetName) return false;
+  const destDir = gmToolsDir();
+  try {
+    let tag;
+    try {
+      const releaseInfo = JSON.parse((await httpGetBuffer('https://api.github.com/repos/AnEntrypoint/agentplug-bin/releases/latest', 15000)).toString('utf8'));
+      tag = releaseInfo && releaseInfo.tag_name;
+    } catch (apiErr) {
+      try {
+        tag = latestAgentplugRunnerTagViaGitLsRemote();
+      } catch (_) {
+        return false;
+      }
+    }
+    if (!tag) return false;
+    const base = `https://github.com/AnEntrypoint/agentplug-bin/releases/download/${tag}`;
+    const [binBuf, shaBuf] = await Promise.all([
+      httpGetBuffer(`${base}/${assetName}`, 60000),
+      httpGetBuffer(`${base}/${assetName}.sha256`, 15000),
+    ]);
+    const expectedSha = shaBuf.toString('utf8').trim().split(/\s+/)[0];
+    const actualSha = sha256Hex(binBuf);
+    if (!expectedSha || actualSha.toLowerCase() !== expectedSha.toLowerCase()) return false;
+    fs.mkdirSync(destDir, { recursive: true });
+    const tmp = destPath + '.tmp' + process.pid;
+    fs.writeFileSync(tmp, binBuf);
+    if (process.platform !== 'win32') { try { fs.chmodSync(tmp, 0o755); } catch (_) {} }
+    fs.renameSync(tmp, destPath);
+    fs.writeFileSync(path.join(destDir, 'agentplug-runner.version'), tag);
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+
 function startSpoolDaemon() {
   try {
     const runnerName = process.platform === 'win32' ? 'agentplug-runner.exe' : 'agentplug-runner';
@@ -805,6 +894,7 @@ function startSpoolDaemon() {
           `which downloads the sha256-verified native runner from AnEntrypoint/agentplug-bin for this platform ` +
           `(${process.platform}/${process.arch}). If no binary is published for this platform yet, there is no ` +
           `loader available -- file an issue at https://github.com/AnEntrypoint/agentplug-bin so a binary is built for it.`,
+        needsRunnerInstall: true,
       };
     }
     const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
@@ -846,6 +936,7 @@ module.exports = {
   getWasmPath,
   getBinaryPath,
   startSpoolDaemon,
+  ensureAgentplugRunnerInstalled,
   isReady,
   cacheRoot,
   obsEvent,

package/gm-plugkit/cli.js

@@ -5,7 +5,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const cp = require('child_process');
-const { ensureReady, startSpoolDaemon, gmToolsDir, readVersionFile, ensureGmPlugkitVersionFresh, ensureSkillMdFresh, isReady, getWasmPath, readPinnedGmPlugkitVersion, spawnPinnedBoot, resolveProjectRoot } = require('./bootstrap');
+const { ensureReady, startSpoolDaemon, ensureAgentplugRunnerInstalled, gmToolsDir, readVersionFile, ensureGmPlugkitVersionFresh, ensureSkillMdFresh, isReady, getWasmPath, readPinnedGmPlugkitVersion, spawnPinnedBoot, resolveProjectRoot } = require('./bootstrap');
 const { pidAliveSync, waitForPidDeath } = require('./gm-process');
 
 function getWasmPathSafe() {
@@ -24,7 +24,7 @@ function spawnBackgroundFreshnessCheck(reason) {
   } catch (_) {}
 }
 
-function spawnDaemonOrExit(version, binaryPath, message) {
+async function spawnDaemonOrExit(version, binaryPath, message) {
   let daemon;
   try {
     daemon = startSpoolDaemon();
@@ -33,6 +33,21 @@ function spawnDaemonOrExit(version, binaryPath, message) {
     console.error('Daemon start failed:', err.message);
     process.exit(1);
   }
+  if (daemon && !daemon.ok && daemon.needsRunnerInstall) {
+    const runnerName = process.platform === 'win32' ? 'agentplug-runner.exe' : 'agentplug-runner';
+    const runnerPath = path.join(gmToolsDir(), runnerName);
+    console.error('agentplug-runner not found -- attempting sha256-verified download from AnEntrypoint/agentplug-bin before failing...');
+    const installed = await ensureAgentplugRunnerInstalled(runnerPath);
+    if (installed) {
+      try {
+        daemon = startSpoolDaemon();
+      } catch (err) {
+        writeCliError('start-daemon', err);
+        console.error('Daemon start failed:', err.message);
+        process.exit(1);
+      }
+    }
+  }
   if (!daemon || !daemon.ok) {
     const errMsg = (daemon && daemon.error) || 'startSpoolDaemon returned non-ok';
     writeCliError('start-daemon', new Error(errMsg));
@@ -207,7 +222,7 @@ function tryDelegateToRunner(args) {
     try { installedVersion = readVersionFile(); } catch (_) { installedVersion = null; }
     writeCliStatus({ phase: 'bootstrapped', version: installedVersion, binary: getWasmPathSafe() });
     spawnBackgroundFreshnessCheck(versionDrifted ? 'version-drift-respawn' : 'fast-path-spawn');
-    spawnDaemonOrExit(
+    await spawnDaemonOrExit(
       installedVersion,
       getWasmPathSafe(),
       'plugkit daemon spawned from existing local install, not yet confirmed serving -- check .gm/exec-spool/.status.json for heartbeat freshness; remote freshness check running in background'
@@ -231,7 +246,7 @@ function tryDelegateToRunner(args) {
   }
 
   writeCliStatus({ phase: 'bootstrapped', version: bootstrapResult.version, binary: bootstrapResult.binaryPath });
-  spawnDaemonOrExit(
+  await spawnDaemonOrExit(
     bootstrapResult.version,
     bootstrapResult.binaryPath,
     'plugkit daemon spawned, not yet confirmed serving -- check .gm/exec-spool/.status.json for heartbeat freshness'

package/gm-plugkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.2467",
+  "version": "2.0.2468",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.",
   "main": "index.js",
   "bin": {

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.2467",
+  "version": "2.0.2468",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-skill",
-  "version": "2.0.2467",
+  "version": "2.0.2468",
   "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
   "author": "AnEntrypoint",
   "license": "MIT",