gm-skill 2.0.2563 → 2.0.2564

package/bin/bootstrap.js

@@ -25,6 +25,7 @@ const {
 const {
   readVersionFile,
   readShaManifest,
+  failClosedMissingSha,
   resolveCacheWasmPath,
   extractNpmPackageWithRetry: extractNpmPackageWithRetryCore,
   writeBootstrapError,
@@ -215,7 +216,8 @@ async function bootstrap(opts) {
       throw extractErr;
     }
 
-    if (wasmExpectedSha) {
+    if (!wasmExpectedSha) throw failClosedMissingSha(version, wasmName, wasmPartialPath);
+    {
       const got = await require('../gm-plugkit/gm-process').sha256OfFile(wasmPartialPath);
       if (got !== wasmExpectedSha) {
         try { fs.unlinkSync(wasmPartialPath); } catch (_) {}
@@ -228,8 +230,6 @@ async function bootstrap(opts) {
         throw new Error(`sha256 mismatch for ${wasmName}: expected ${wasmExpectedSha}, got ${got}`);
       }
       log('sha256 verified');
-    } else {
-      log('no sha256 manifest -- skipping verify');
     }
 
     try { fs.renameSync(wasmPartialPath, wasmFinalPath); }

package/gm-plugkit/bootstrap-wasm-core.js

@@ -52,6 +52,18 @@ function clearBootstrapError() {
   } catch (_) {}
 }
 
+function failClosedMissingSha(version, artifactName, partialPath) {
+  try { fs.unlinkSync(partialPath); } catch (_) {}
+  const message = `no sha256 manifest entry for ${artifactName}: refusing to trust unverified download`;
+  writeBootstrapError({
+    expected_version: version,
+    cached_version: null,
+    error_phase: 'sha256-manifest-missing',
+    error_message: message,
+  });
+  return new Error(message);
+}
+
 function readVersionFile(wrapperDir) {
   const p = path.join(wrapperDir, 'plugkit.version');
   if (!fs.existsSync(p)) throw new Error(`plugkit.version not found at ${p}`);
@@ -226,6 +238,7 @@ module.exports = {
   resolveProjectRoot,
   writeBootstrapError,
   clearBootstrapError,
+  failClosedMissingSha,
   readVersionFile,
   readShaManifest,
   copyWasmToGmTools,

package/gm-plugkit/bootstrap.js

@@ -31,6 +31,7 @@ const {
   writeBootstrapError,
   clearBootstrapError,
   resolveInstalledWasmPath,
+  failClosedMissingSha,
 } = core;
 
 const LOCK_STALE_MS = 30 * 60 * 1000;
@@ -416,7 +417,8 @@ async function bootstrap(opts) {
       }
     }
 
-    if (expectedSha) {
+    if (!expectedSha) throw failClosedMissingSha(version, wasmName, partialPath);
+    {
       const got = await sha256OfFile(partialPath);
       if (got !== expectedSha) {
         try { fs.unlinkSync(partialPath); } catch (_) {}
@@ -428,8 +430,6 @@ async function bootstrap(opts) {
         throw new Error(`sha256 mismatch for ${wasmName}: expected ${expectedSha}, got ${got}`);
       }
       log('sha256 verified');
-    } else {
-      log('no sha256 manifest -- skipping verify');
     }
 
     try { fs.renameSync(partialPath, finalPath); }

package/gm-plugkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.2563",
+  "version": "2.0.2564",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.",
   "main": "index.js",
   "bin": {

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.2563",
+  "version": "2.0.2564",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-skill",
-  "version": "2.0.2563",
+  "version": "2.0.2564",
   "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
   "author": "AnEntrypoint",
   "license": "MIT",