gm-skill 2.0.2575 → 2.0.2576

package/AGENTS.md

@@ -47,7 +47,7 @@ Wasm host-import link-module rule (`#[link(wasm_import_module="env")]` on every
 Dispatch = Write `.gm/exec-spool/in/<verb>/<N>.txt`, Read `.gm/exec-spool/out/<verb>-<N>.json` (nested) or `out/<N>.json` (root). `<N>` is session-id-prefixed (`<session_id>-<local-counter>`), never a bare small integer -- the shared daemon claims and answers in-files by the literal `(verb, N)` pair with no per-session partition, so unprefixed sequential ids collide across concurrent sessions on the same project (recall: `gm spool dispatch id collision cross-session crosstalk`). Wasm orchestrator services every verb; harness never executes side effects directly.
 
 - **Orchestrator verbs**: `instruction`, `transition`, `phase-status`, `mutable-resolve`, `mutable-add`, `mutable-list`, `memorize-fire`, `memorize-continue`, `discipline-note`, `residual-scan`, `auto-recall`, `prd-add`, `prd-resolve`, `prd-list`, `task-spawn`, `task-list`, `task-stop`, `task-output`, `fsm-vendor`, `fsm-validate`, `fsm-propose-override`, `claim-audit`, `submodule-check`.
-- **`fsm-propose-override`**: session-authored `.gm/instructions` override, gated two-phase (`{proposed:true,requires_confirmation:true}` first, real write only on a second dispatch carrying `user_confirmed:true`). `kind:"graph"` additionally requires `confirmation_witness` citing an `AskUserQuestion` dispatch -- graph overrides grant execution authority (hooks) per Section 4. Body: `{kind:"prose"|"graph"|"config", key, proposed_text, reason, witness}`. Validates the proposed graph/config before ever proposing it; a `stuck-loop-escalation` gate denial also emits `self-reconfig-candidate` as the machine-readable trigger for when a proposal is worth authoring.
+- **`fsm-propose-override`**: session-authored `.gm/instructions` override, gated two-phase (`{proposed:true,requires_confirmation:true}` first, real write only on a second dispatch carrying `user_confirmed:true`). `kind:"graph"` additionally requires `confirmation_witness` citing an `AskUserQuestion` dispatch -- graph overrides grant execution authority (hooks) per Section 4. Body: `{kind:"prose"|"graph"|"config", key, proposed_text, reason, witness}`. Validates the proposed graph/config before ever proposing it; a `stuck-loop-escalation` gate denial also emits `self-reconfig-candidate` as the machine-readable trigger for when a proposal is worth authoring. Its `kind:"prose"` content-shape rule (attributed anchors, mermaid backreference graphs, no external catalog citation) is served content, not local doc -- it lives in `gm-config/prose/entry.md` (every project reaches it), never here alone.
 - **Wasm-direct verbs**: fs/kv/exec/fetch/env, recall, codesearch, memorize, memorize-prune, memorize-vacuum, memorize-retention, health, filter, full git verb family. Enumeration in the recall store (`recall: wasm-direct plugkit verbs full list`).
 - **Host-native verb**: `background-convert` (`{verb, task}`) detaches an already-in-flight dispatch so the daemon worker stops waiting on it -- agent-initiated only, never routed to gm.wasm. Detail: `.gm/daemon-config-reference.md`.
 - **memorize-prune**: prune bad/superseded memories; two-mode spec (key-remove vs query-review) in the recall store (`recall: memorize-prune verb two-mode spec`). **memorize-vacuum**/**memorize-retention**: compaction and retention-policy enforcement over the same memory store; both also accept underscore-form aliases (`memorize_vacuum`/`memorize_retention`), matching every `memorize-*` verb's hyphen/underscore dual registration.

package/gm-plugkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.2575",
+  "version": "2.0.2576",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.",
   "main": "index.js",
   "bin": {

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.2575",
+  "version": "2.0.2576",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-skill",
-  "version": "2.0.2575",
+  "version": "2.0.2576",
   "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
   "author": "AnEntrypoint",
   "license": "MIT",

package/scripts/scan-supply-chain-tells.mjs

@@ -125,6 +125,13 @@ const SUSPICIOUS_UNICODE = [
   { cp: 0x0421, name: 'CYRILLIC CAPITAL С (looks like Latin C)' },
   { cp: 0x0441, name: 'CYRILLIC SMALL с (looks like Latin c)' },
 ]
+const SUSPICIOUS_UNICODE_MAP = new Map(SUSPICIOUS_UNICODE.map(u => [u.cp, u.name]))
+// Single regex alternation, scanned natively by the engine in one pass --
+// the previous per-character for-loop with an inner .find() was O(n) work
+// PER CHARACTER (n = codepoint list length) and made a multi-MB minified
+// bundle file (a real case: a 3.3MB single-line webpack chunk) take minutes
+// instead of milliseconds.
+const SUSPICIOUS_UNICODE_RE = new RegExp('[' + SUSPICIOUS_UNICODE.map(u => '\\u' + u.cp.toString(16).padStart(4, '0')).join('') + ']', 'g')
 
 // A file whose non-ASCII payload is almost entirely \uXXXX-style JS escape
 // sequences decoding to plain ASCII is itself a tell (deliberate obfuscation
@@ -205,25 +212,39 @@ function scanFile(filePath) {
   }
 
   if (CODE_EXT.has(path.extname(filePath))) {
-    // De-duplicate per (codepoint, line): a run of several confusables on one
-    // line (a whole disguised word) is one finding, not one per character.
-    const seen = new Set()
-    for (let i = 0; i < text.length; i++) {
-      const cp = text.codePointAt(i)
-      const hit = SUSPICIOUS_UNICODE.find(u => u.cp === cp)
-      if (hit) {
-        const line = text.slice(0, i).split('\n').length
+    const matches = text.match(SUSPICIOUS_UNICODE_RE)
+    if (matches && matches.length) {
+      // Line numbers computed via one pass over newline offsets (not a fresh
+      // split() per hit) -- still correct even on a huge single-line file,
+      // just no longer quadratic.
+      let newlineOffsets = null
+      const lineOf = (idx) => {
+        if (!newlineOffsets) {
+          newlineOffsets = []
+          for (let i = 0; i < text.length; i++) if (text.charCodeAt(i) === 10) newlineOffsets.push(i)
+        }
+        let lo = 0, hi = newlineOffsets.length
+        while (lo < hi) { const mid = (lo + hi) >> 1; if (newlineOffsets[mid] < idx) lo = mid + 1; else hi = mid }
+        return lo + 1
+      }
+      const seen = new Set()
+      SUSPICIOUS_UNICODE_RE.lastIndex = 0
+      let m
+      while ((m = SUSPICIOUS_UNICODE_RE.exec(text)) !== null) {
+        const cp = m[0].codePointAt(0)
+        const line = lineOf(m.index)
         const key = cp + ':' + line
         if (seen.has(key)) continue
         seen.add(key)
         findings.push({
           filePath,
           kind: 'unicode',
-          name: hit.name,
+          name: SUSPICIOUS_UNICODE_MAP.get(cp),
           codepoint: '0x' + cp.toString(16),
           line,
           why: 'invisible or confusable Unicode codepoint inside a code file — used to hide code from visual review or disguise an identifier/URL as something else',
         })
+        if (SUSPICIOUS_UNICODE_RE.lastIndex === m.index) SUSPICIOUS_UNICODE_RE.lastIndex++
       }
     }
   }