gm-skill 2.0.2572 → 2.0.2574

package/gm-plugkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.2572",
+  "version": "2.0.2574",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.",
   "main": "index.js",
   "bin": {

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.2572",
+  "version": "2.0.2574",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-skill",
-  "version": "2.0.2572",
+  "version": "2.0.2574",
   "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
   "author": "AnEntrypoint",
   "license": "MIT",

package/scripts/scan-supply-chain-tells.mjs

@@ -17,6 +17,11 @@ import process from 'node:process'
 const SKIP_DIRS = new Set([
   'node_modules', '.git', 'dist', 'build', '.next', 'vendor', '.cache',
   '.svelte-kit', '.nuxt', '.output', '.turbo', 'out', 'coverage', '.parcel-cache',
+  // Vendored/third-party binary trees this scanner isn't meant to police --
+  // a browser profile's installed extensions are third-party code the user
+  // didn't write and can't fix here; a real backdoor concern in a project's
+  // OWN code should never be diluted by noise from a bundled Chrome profile.
+  '.plugkit-browser-profile', '.plugkit-agent-worktree', '.wwebjs_auth', '.wwebjs_cache',
 ])
 // Code files only. JSON/YAML/MD routinely carry legitimate non-Latin natural-
 // language text (Cyrillic, Greek, CJK, etc.) which is indistinguishable from a
@@ -136,6 +141,9 @@ function walk(dir, out) {
   }
   for (const e of entries) {
     if (SKIP_DIRS.has(e.name)) continue
+    // Hash/timestamp-suffixed variants of the same vendored-profile dirs
+    // (e.g. .plugkit-browser-profile-<id>) -- prefix match on the same names.
+    if (e.name.startsWith('.plugkit-browser-profile') || e.name.startsWith('.plugkit-browser-chrome-profile') || e.name.startsWith('.plugkit-agent-worktree')) continue
     const p = path.join(dir, e.name)
     if (e.isDirectory()) {
       walk(p, out)
@@ -234,24 +242,30 @@ function main() {
     else files.push(root)
   }
 
-  const allFindings = []
-  for (const f of files) {
-    allFindings.push(...scanFile(f))
-  }
-
-  if (!allFindings.length) {
-    console.log(`scan-supply-chain-tells: clean (${files.length} files scanned)`)
-    process.exit(0)
+  // Stream findings as each file is scanned (never buffer until the end) so a
+  // kill/timeout mid-run still leaves a partial, readable, useful result on
+  // disk instead of losing everything. Progress heartbeat every 200 files so
+  // a long run's liveness is visible without waiting for a finding.
+  let totalFindings = 0
+  const filesWithFindings = new Set()
+  for (let idx = 0; idx < files.length; idx++) {
+    const f = files[idx]
+    const findings = scanFile(f)
+    for (const finding of findings) {
+      totalFindings++
+      filesWithFindings.add(finding.filePath)
+      const loc = finding.line ? `:${finding.line}` : ''
+      const label = finding.sig || finding.name
+      console.log(`[${finding.kind}] ${finding.filePath}${loc} — ${label}`)
+      console.log(`    ${finding.why}`)
+    }
+    if ((idx + 1) % 200 === 0) {
+      console.error(`... scanned ${idx + 1}/${files.length} files, ${totalFindings} finding(s) so far`)
+    }
   }
 
-  console.log(`scan-supply-chain-tells: ${allFindings.length} finding(s) across ${new Set(allFindings.map(f => f.filePath)).size} file(s)\n`)
-  for (const f of allFindings) {
-    const loc = f.line ? `:${f.line}` : ''
-    const label = f.sig || f.name
-    console.log(`[${f.kind}] ${f.filePath}${loc} — ${label}`)
-    console.log(`    ${f.why}`)
-  }
-  process.exit(1)
+  console.log(`\nscan-supply-chain-tells: ${totalFindings} finding(s) across ${filesWithFindings.size} file(s) (${files.length} files scanned total)`)
+  process.exit(totalFindings ? 1 : 0)
 }
 
 main()