gm-thebird 2.0.1069 → 2.0.1071

package/bin/bootstrap.js

@@ -4,20 +4,13 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const https = require('https');
 const crypto = require('crypto');
-const { URL } = require('url');
-
-const RELEASE_REPO = 'AnEntrypoint/plugkit-bin';
-const ATTEMPT_TIMEOUT_MS = 5 * 60 * 1000;
-const STALL_TIMEOUT_MS = 15 * 1000;
-const MAX_ATTEMPTS = 5;
-const BACKOFF_MS = [2000, 5000, 15000, 30000];
-// Worst case: a slow link downloading 140MB at 1MB/s = ~140s. Allow 30 minutes
-// before another bootstrap process treats this lock as abandoned. Below this,
-// concurrent bootstrap calls would wipe an in-progress download mid-stream
-// (see the v0.1.294 incident where a race between two wrappers blew away the
-// .partial during a 10-minute fetch).
+const { spawnSync } = require('child_process');
+
+const NPM_PACKAGE = '@anentrypoint/plugkit-wasm';
+const ATTEMPT_TIMEOUT_MS = 10 * 60 * 1000;
+const MAX_ATTEMPTS = 3;
+const BACKOFF_MS = [5000, 15000];
 const LOCK_STALE_MS = 30 * 60 * 1000;
 
 function log(msg) {
@@ -73,18 +66,6 @@ function obsEvent(subsystem, event, fields) {
   } catch (_) {}
 }
 
-function platformKey() {
-  const p = os.platform();
-  const a = os.arch();
-  if (p === 'win32') return a === 'arm64' ? 'win32-arm64' : 'win32-x64';
-  if (p === 'darwin') return a === 'arm64' ? 'darwin-arm64' : 'darwin-x64';
-  return (a === 'arm64' || a === 'aarch64') ? 'linux-arm64' : 'linux-x64';
-}
-
-function binaryName() {
-  const key = platformKey();
-  return key.startsWith('win32') ? `plugkit-${key}.exe` : `plugkit-${key}`;
-}
 
 function rtkBinaryName() {
   const key = platformKey();
@@ -117,98 +98,22 @@ function gmToolsDir() {
 // through node. Self-update inside the Rust binary keeps gm-tools fresh from
 // here on. Skipped silently on any error — the next session-start hook will
 // retry via ensure_tools_current.
-function killHoldersOfPath(targetPath) {
-  if (process.platform !== 'win32') return 0;
-  try {
-    const { spawnSync } = require('child_process');
-    const norm = path.resolve(targetPath).replace(/\//g, '\\');
-    const r = spawnSync('wmic', ['process', 'where', `ExecutablePath='${norm.replace(/\\/g, '\\\\')}'`, 'get', 'ProcessId', '/format:value'], { encoding: 'utf8', windowsHide: true, timeout: 5000 });
-    if (r.status !== 0 || !r.stdout) return 0;
-    const pids = [];
-    for (const line of r.stdout.split(/\r?\n/)) {
-      const m = line.match(/ProcessId=(\d+)/);
-      if (m) {
-        const pid = parseInt(m[1], 10);
-        if (Number.isFinite(pid) && pid !== process.pid) pids.push(pid);
-      }
-    }
-    for (const pid of pids) {
-      try { spawnSync('taskkill', ['/F', '/PID', String(pid)], { windowsHide: true, timeout: 3000 }); } catch (_) {}
-    }
-    return pids.length;
-  } catch (_) { return 0; }
-}
-
-function cleanOrphanNewFiles(dst, exeName) {
-  try {
-    for (const name of fs.readdirSync(dst)) {
-      if (name === exeName + '.new') continue;
-      if (/^plugkit(\.\d+\.\d+\.\d+)?\.new$/i.test(name)) {
-        try { fs.unlinkSync(path.join(dst, name)); } catch (_) {}
-      }
-    }
-  } catch (_) {}
-}
-
-function renameWithRetry(src, dst, attempts) {
-  for (let i = 0; i < attempts; i++) {
-    try { fs.renameSync(src, dst); return true; }
-    catch (err) {
-      if (err.code !== 'EEXIST' && err.code !== 'EPERM' && err.code !== 'EBUSY' && err.code !== 'EACCES') throw err;
-      if (i === Math.floor(attempts / 2)) killHoldersOfPath(dst);
-      try { const { spawnSync } = require('child_process'); spawnSync(process.execPath, ['-e', 'setTimeout(()=>{}, 200)'], { timeout: 400, killSignal: 'SIGKILL', stdio: 'ignore', windowsHide: true }); } catch (_) {}
-    }
-  }
-  return false;
-}
 
-function copyToGmTools(finalPath, wrapperDir, version) {
+function copyWasmToGmTools(wasmPath, wrapperDir, version) {
   const dst = gmToolsDir();
   fs.mkdirSync(dst, { recursive: true });
-  const exeName = process.platform === 'win32' ? 'plugkit.exe' : 'plugkit';
-  const target = path.join(dst, exeName);
-  const targetTmp = target + '.new';
-  cleanOrphanNewFiles(dst, exeName);
+  const target = path.join(dst, 'plugkit.wasm');
   if (fs.existsSync(target)) {
-    let needsRefresh = true;
     try {
       const cur = sha256OfFileSync(target);
-      const src = sha256OfFileSync(finalPath);
-      if (cur === src) needsRefresh = false;
-    } catch (_) {}
-    if (!needsRefresh) {
-      try { fs.writeFileSync(path.join(dst, 'plugkit.version'), version); } catch (_) {}
-      return;
-    }
-    try { killHoldersOfPath(target); } catch (_) {}
-  }
-  fs.copyFileSync(finalPath, targetTmp);
-  if (!renameWithRetry(targetTmp, target, 8)) {
-    try { killHoldersOfPath(target); } catch (_) {}
-    try { fs.unlinkSync(target); } catch (_) {}
-    try { fs.renameSync(targetTmp, target); }
-    catch (_) {
-      try { fs.unlinkSync(targetTmp); } catch (_) {}
-      obsEvent('bootstrap', 'gmtools.rename.failed', { target });
-      writeBootstrapError({
-        expected_version: version,
-        cached_version: null,
-        error_phase: 'gmtools-rename',
-        error_message: `cannot replace ${target} after kill+unlink retry; orphan removed`,
-      });
-      throw new Error(`gm-tools update blocked: cannot replace ${target} (held open by running plugkit and kill-retry exhausted)`);
-    }
-  }
-  try {
-    for (const name of fs.readdirSync(dst)) {
-      if (/^plugkit(\.\d+\.\d+\.\d+)?\.new$/i.test(name)) {
-        try { fs.unlinkSync(path.join(dst, name)); } catch (_) {}
+      const src = sha256OfFileSync(wasmPath);
+      if (cur === src) {
+        try { fs.writeFileSync(path.join(dst, 'plugkit.version'), version); } catch (_) {}
+        return;
       }
-    }
-  } catch (_) {}
-  if (process.platform !== 'win32') {
-    try { fs.chmodSync(target, 0o755); } catch (_) {}
+    } catch (_) {}
   }
+  fs.copyFileSync(wasmPath, target);
   fs.writeFileSync(path.join(dst, 'plugkit.version'), version);
   try {
     const srcSha = path.join(wrapperDir, 'plugkit.sha256');
@@ -319,88 +224,54 @@ function sha256OfFile(filePath) {
   });
 }
 
-function fetchToFile(url, destPath, expectedTotal) {
-  return new Promise((resolve, reject) => {
-    let existing = 0;
-    try { existing = fs.statSync(destPath).size; } catch (_) {}
-    const headers = { 'User-Agent': 'plugkit-bootstrap', 'Accept': '*/*' };
-    if (existing > 0) headers['Range'] = `bytes=${existing}-`;
-
-    const u = new URL(url);
-    const req = https.request({
-      method: 'GET',
-      hostname: u.hostname,
-      path: u.pathname + u.search,
-      headers,
-      timeout: ATTEMPT_TIMEOUT_MS,
-    }, (res) => {
-      if (res.statusCode === 301 || res.statusCode === 302 || res.statusCode === 307 || res.statusCode === 308) {
-        res.resume();
-        return resolve(fetchToFile(res.headers.location, destPath, expectedTotal));
-      }
-      if (res.statusCode === 416) {
-        res.resume();
-        try { fs.unlinkSync(destPath); } catch (_) {}
-        return reject(new Error('range-not-satisfiable: cleared partial, retry'));
-      }
-      if (!(res.statusCode === 200 || res.statusCode === 206)) {
-        res.resume();
-        return reject(new Error(`HTTP ${res.statusCode} for ${url}`));
+async function extractNpmPackageWasm(destPath) {
+  const tempDir = path.join(path.dirname(destPath), '.npm-extract-' + Date.now());
+  try {
+    ensureDir(tempDir);
+    const startMs = Date.now();
+    log(`extracting npm package ${NPM_PACKAGE}@latest to ${tempDir}`);
+    obsEvent('bootstrap', 'npm.extract.start', { package: NPM_PACKAGE, version: 'latest' });
+
+    const result = spawnSync(
+      process.platform === 'win32' ? 'bunx.cmd' : 'bunx',
+      ['--bun', NPM_PACKAGE + '@latest', '--save-exact', '--prefix', tempDir],
+      {
+        stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: ATTEMPT_TIMEOUT_MS,
+        encoding: 'utf8',
+        windowsHide: true,
       }
-      const append = res.statusCode === 206 && existing > 0;
-      // Ensure parent dir exists — a concurrent prune may have removed it
-      // between lock-acquire and now. Recreating is cheap and avoids a
-      // confusing ENOENT later.
-      try { ensureDir(path.dirname(destPath)); } catch (_) {}
-      const out = fs.createWriteStream(destPath, { flags: append ? 'a' : 'w' });
-      let bytes = append ? existing : 0;
-      let lastStderr = Date.now();
-      let lastByte = Date.now();
-      const fetchStart = Date.now();
-      const safeUrl = (() => { try { const p = new URL(url); return p.hostname + p.pathname; } catch(_) { return url.split('?')[0]; } })();
-      obsEvent('bootstrap', 'fetch.start', { url: safeUrl, resume_from: existing, status: res.statusCode });
-      const stallTimer = setInterval(() => {
-        if (Date.now() - lastByte > STALL_TIMEOUT_MS) {
-          clearInterval(stallTimer);
-          req.destroy(new Error(`stalled: no bytes for ${STALL_TIMEOUT_MS}ms`));
-        }
-      }, 2000);
-      res.on('data', c => {
-        bytes += c.length;
-        lastByte = Date.now();
-        if (Date.now() - lastStderr > 5000) {
-          const pct = expectedTotal ? ` ${Math.floor(bytes / expectedTotal * 100)}%` : '';
-          try { process.stderr.write(`[plugkit-bootstrap] downloading: ${(bytes / 1048576).toFixed(1)} MiB${pct}\n`); } catch (_) {}
-          lastStderr = Date.now();
-        }
-      });
-      res.pipe(out);
-      out.on('finish', () => {
-        clearInterval(stallTimer);
-        obsEvent('bootstrap', 'fetch.end', { url: safeUrl, bytes, dur_ms: Date.now() - fetchStart, ok: true });
-        out.close(() => resolve(bytes));
-      });
-      out.on('error', err => { clearInterval(stallTimer); obsEvent('bootstrap', 'fetch.end', { url: safeUrl, bytes, dur_ms: Date.now() - fetchStart, ok: false, err: String(err.message || err) }); reject(err); });
-      res.on('error', err => { clearInterval(stallTimer); reject(err); });
-      res.on('end', () => clearInterval(stallTimer));
-    });
-    req.on('timeout', () => { req.destroy(new Error(`timeout after ${ATTEMPT_TIMEOUT_MS}ms`)); });
-    req.on('error', reject);
-    req.end();
-  });
+    );
+
+    if (result.error) throw result.error;
+    if (result.status !== 0) {
+      throw new Error(`bunx extraction failed: ${result.stderr || result.stdout || 'unknown error'}`);
+    }
+
+    const nodeModulesPath = path.join(tempDir, 'node_modules', NPM_PACKAGE, 'plugkit.wasm');
+    if (!fs.existsSync(nodeModulesPath)) {
+      throw new Error(`plugkit.wasm not found in extracted npm package at ${nodeModulesPath}`);
+    }
+
+    fs.copyFileSync(nodeModulesPath, destPath);
+    log(`extracted ${nodeModulesPath} → ${destPath}`);
+    obsEvent('bootstrap', 'npm.extract.end', { dur_ms: Date.now() - startMs, ok: true });
+  } finally {
+    try { fs.rmSync(tempDir, { recursive: true, force: true, maxRetries: 1, retryDelay: 50 }); } catch (_) {}
+  }
 }
 
-async function downloadWithRetry(url, destPath) {
+async function extractNpmPackageWithRetry(destPath) {
   let lastErr;
   for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
     try {
-      log(`fetch attempt ${attempt}/${MAX_ATTEMPTS}: ${url}`);
-      await fetchToFile(url, destPath);
+      log(`npm extract attempt ${attempt}/${MAX_ATTEMPTS}: ${NPM_PACKAGE}@latest`);
+      await extractNpmPackageWasm(destPath);
       return;
     } catch (err) {
       lastErr = err;
       log(`attempt ${attempt} failed: ${err.message}`);
-      obsEvent('bootstrap', 'fetch.attempt_failed', { url, attempt, max: MAX_ATTEMPTS, err: String(err.message || err) });
+      obsEvent('bootstrap', 'npm.extract.attempt_failed', { package: NPM_PACKAGE, attempt, max: MAX_ATTEMPTS, err: String(err.message || err) });
       if (attempt < MAX_ATTEMPTS) {
         const wait = BACKOFF_MS[attempt - 1] || 120000;
         log(`backing off ${wait}ms`);
@@ -447,8 +318,8 @@ async function bootstrap(opts) {
   const wrapperDir = opts.wrapperDir || __dirname;
   const version = opts.version || readVersionFile(wrapperDir);
   const shaManifest = readShaManifest(wrapperDir);
-  const binName = binaryName();
-  const expectedSha = shaManifest ? shaManifest[binName] : null;
+  const wasmName = 'plugkit.wasm';
+  const wasmExpectedSha = shaManifest ? shaManifest[wasmName] : null;
 
   let root = cacheRoot();
   try { ensureDir(root); }
@@ -457,121 +328,116 @@ async function bootstrap(opts) {
   const verDir = path.join(root, `v${version}`);
   ensureDir(verDir);
 
-  const finalPath = path.join(verDir, binName);
-  const okSentinel = path.join(verDir, '.ok');
-  const partialPath = `${finalPath}.partial`;
+  const wasmFinalPath = path.join(verDir, wasmName);
+  const wasmOkSentinel = path.join(verDir, '.wasm-ok');
+  const wasmPartialPath = `${wasmFinalPath}.partial`;
 
-  if (fs.existsSync(finalPath) && fs.existsSync(okSentinel)) {
-    if (expectedSha) {
-      const actualSha = sha256OfFileSync(finalPath);
-      if (actualSha === expectedSha) {
-        obsEvent('bootstrap', 'decision.hit', { reason: 'sha-match', version, path: finalPath });
-        copyToGmTools(finalPath, wrapperDir, version);
+  if (fs.existsSync(wasmFinalPath) && fs.existsSync(wasmOkSentinel)) {
+    if (wasmExpectedSha) {
+      const actualSha = sha256OfFileSync(wasmFinalPath);
+      if (actualSha === wasmExpectedSha) {
+        obsEvent('bootstrap', 'decision.hit', { reason: 'sha-match', version, path: wasmFinalPath });
+        copyWasmToGmTools(wasmFinalPath, wrapperDir, version);
         clearBootstrapError();
-        return finalPath;
+        return wasmFinalPath;
       }
-      log(`decision: fetch reason: cache-hit-sha-mismatch (dir=v${version} expected ${expectedSha.slice(0,12)}… got ${(actualSha||'').slice(0,12)}…)`);
+      log(`decision: fetch reason: cache-hit-sha-mismatch (dir=v${version} expected ${wasmExpectedSha.slice(0,12)}… got ${(actualSha||'').slice(0,12)}…)`);
       writeBootstrapError({
         expected_version: version,
         cached_version: null,
         error_phase: 'cache-hit-sha-mismatch',
-        error_message: `cached binary at ${finalPath} sha=${actualSha} but manifest expects ${expectedSha}`,
+        error_message: `cached wasm at ${wasmFinalPath} sha=${actualSha} but manifest expects ${wasmExpectedSha}`,
       });
-      try { fs.unlinkSync(finalPath); } catch (_) {}
-      try { fs.unlinkSync(okSentinel); } catch (_) {}
+      try { fs.unlinkSync(wasmFinalPath); } catch (_) {}
+      try { fs.unlinkSync(wasmOkSentinel); } catch (_) {}
     } else {
-      obsEvent('bootstrap', 'decision.hit', { reason: 'sentinel+no-sha-manifest', path: finalPath });
-      copyToGmTools(finalPath, wrapperDir, version);
+      obsEvent('bootstrap', 'decision.hit', { reason: 'sentinel+no-sha-manifest', path: wasmFinalPath });
+      copyWasmToGmTools(wasmFinalPath, wrapperDir, version);
       clearBootstrapError();
-      return finalPath;
+      return wasmFinalPath;
     }
   }
 
-  if (healIfShaMatches(finalPath, expectedSha, okSentinel, partialPath, 'plugkit')) {
-    obsEvent('bootstrap', 'decision.heal', { reason: 'sha-match', path: finalPath });
+  if (healIfShaMatches(wasmFinalPath, wasmExpectedSha, wasmOkSentinel, wasmPartialPath, 'wasm')) {
+    obsEvent('bootstrap', 'decision.heal', { reason: 'sha-match', path: wasmFinalPath });
     spawnDetachedRtkFetch(wrapperDir);
-    copyToGmTools(finalPath, wrapperDir, version);
+    copyWasmToGmTools(wasmFinalPath, wrapperDir, version);
     clearBootstrapError();
-    return finalPath;
+    return wasmFinalPath;
   }
 
   const lockPath = path.join(verDir, '.lock');
   acquireLock(lockPath);
   try {
-    if (fs.existsSync(finalPath) && fs.existsSync(okSentinel)) {
-      obsEvent('bootstrap', 'decision.hit', { reason: 'lock-race-resolved', path: finalPath });
-      copyToGmTools(finalPath, wrapperDir, version);
+    if (fs.existsSync(wasmFinalPath) && fs.existsSync(wasmOkSentinel)) {
+      obsEvent('bootstrap', 'decision.hit', { reason: 'lock-race-resolved', path: wasmFinalPath });
+      copyWasmToGmTools(wasmFinalPath, wrapperDir, version);
       clearBootstrapError();
-      return finalPath;
+      return wasmFinalPath;
     }
-    if (healIfShaMatches(finalPath, expectedSha, okSentinel, partialPath, 'plugkit')) {
-      obsEvent('bootstrap', 'decision.heal', { reason: 'sha-match-under-lock', path: finalPath });
+    if (healIfShaMatches(wasmFinalPath, wasmExpectedSha, wasmOkSentinel, wasmPartialPath, 'wasm')) {
+      obsEvent('bootstrap', 'decision.heal', { reason: 'sha-match-under-lock', path: wasmFinalPath });
       spawnDetachedRtkFetch(wrapperDir);
-      copyToGmTools(finalPath, wrapperDir, version);
+      copyWasmToGmTools(wasmFinalPath, wrapperDir, version);
       clearBootstrapError();
-      return finalPath;
+      return wasmFinalPath;
     }
 
-    if (fs.existsSync(partialPath)) {
+    if (fs.existsSync(wasmPartialPath)) {
       try {
-        const st = fs.statSync(partialPath);
+        const st = fs.statSync(wasmPartialPath);
         if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
-          fs.unlinkSync(partialPath);
-          log(`cleared stale partial: ${partialPath}`);
+          fs.unlinkSync(wasmPartialPath);
+          log(`cleared stale partial: ${wasmPartialPath}`);
         }
       } catch (_) {}
     }
-    const url = `https://github.com/${RELEASE_REPO}/releases/download/v${version}/${binName}`;
     try {
-      await downloadWithRetry(url, partialPath);
-    } catch (fetchErr) {
+      await extractNpmPackageWithRetry(wasmPartialPath);
+    } catch (extractErr) {
       writeBootstrapError({
         expected_version: version,
         cached_version: null,
-        error_phase: 'download',
-        error_message: fetchErr && fetchErr.message ? fetchErr.message : String(fetchErr),
+        error_phase: 'npm-extract',
+        error_message: extractErr && extractErr.message ? extractErr.message : String(extractErr),
       });
-      throw fetchErr;
+      throw extractErr;
     }
 
-    if (expectedSha) {
-      const got = await sha256OfFile(partialPath);
-      if (got !== expectedSha) {
-        try { fs.unlinkSync(partialPath); } catch (_) {}
+    if (wasmExpectedSha) {
+      const got = await sha256OfFile(wasmPartialPath);
+      if (got !== wasmExpectedSha) {
+        try { fs.unlinkSync(wasmPartialPath); } catch (_) {}
         writeBootstrapError({
           expected_version: version,
           cached_version: null,
           error_phase: 'sha256-mismatch',
-          error_message: `sha256 mismatch for ${binName}: expected ${expectedSha}, got ${got}`,
+          error_message: `sha256 mismatch for ${wasmName}: expected ${wasmExpectedSha}, got ${got}`,
         });
-        throw new Error(`sha256 mismatch for ${binName}: expected ${expectedSha}, got ${got}`);
+        throw new Error(`sha256 mismatch for ${wasmName}: expected ${wasmExpectedSha}, got ${got}`);
       }
       log('sha256 verified');
     } else {
       log('no sha256 manifest — skipping verify');
     }
 
-    try { fs.renameSync(partialPath, finalPath); }
+    try { fs.renameSync(wasmPartialPath, wasmFinalPath); }
     catch (err) {
       if (err.code === 'EEXIST' || err.code === 'EPERM') {
-        try { fs.unlinkSync(finalPath); } catch (_) {}
-        fs.renameSync(partialPath, finalPath);
+        try { fs.unlinkSync(wasmFinalPath); } catch (_) {}
+        fs.renameSync(wasmPartialPath, wasmFinalPath);
       } else throw err;
     }
 
-    if (os.platform() !== 'win32') {
-      try { fs.chmodSync(finalPath, 0o755); } catch (_) {}
-    }
-
-    fs.writeFileSync(okSentinel, new Date().toISOString());
-    log(`decision: fetch reason: install-complete (${finalPath})`);
-    obsEvent('bootstrap', 'install.done', { path: finalPath, version, kind: 'plugkit' });
-    proactiveKillForNewInstall(version, finalPath);
+    fs.writeFileSync(wasmOkSentinel, new Date().toISOString());
+    log(`decision: fetch reason: install-complete (${wasmFinalPath})`);
+    obsEvent('bootstrap', 'install.done', { path: wasmFinalPath, version, kind: 'wasm' });
     pruneOldVersions(root, version, readRtkVersion(wrapperDir));
     spawnDetachedRtkFetch(wrapperDir);
-    copyToGmTools(finalPath, wrapperDir, version);
+    copyWasmToGmTools(wasmFinalPath, wrapperDir, version);
+
     clearBootstrapError();
-    return finalPath;
+    return wasmFinalPath;
   } finally {
     releaseLock(lockPath);
   }
@@ -616,8 +482,33 @@ async function bootstrapRtk(plugkitVerDir, plugkitVersion, wrapperDir, silent, r
     if (!silent) log(`rtk cache heal (sha match): ${rtkPath}`);
     return rtkPath;
   }
-  const url = `https://github.com/${RELEASE_REPO}/releases/download/v${plugkitVersion}/${rtkName}`;
-  await downloadWithRetry(url, tmp);
+  const RTKS_RELEASE_REPO = 'AnEntrypoint/plugkit-bin';
+  const url = `https://github.com/${RTKS_RELEASE_REPO}/releases/download/v${plugkitVersion}/${rtkName}`;
+  const startMs = Date.now();
+  let lastErr;
+  for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+    try {
+      log(`rtk download attempt ${attempt}/${MAX_ATTEMPTS}: ${url}`);
+      const result = spawnSync(
+        'curl',
+        ['-fSL', '--max-time', String(Math.floor(ATTEMPT_TIMEOUT_MS / 1000)), '-o', tmp, url],
+        { stdio: 'pipe', timeout: ATTEMPT_TIMEOUT_MS + 5000, windowsHide: true }
+      );
+      if (result.error) throw result.error;
+      if (result.status !== 0) throw new Error(`curl failed with status ${result.status}`);
+      break;
+    } catch (err) {
+      lastErr = err;
+      log(`rtk attempt ${attempt} failed: ${err.message}`);
+      obsEvent('bootstrap', 'rtk.download.attempt_failed', { attempt, max: MAX_ATTEMPTS, err: String(err.message || err) });
+      if (attempt < MAX_ATTEMPTS) {
+        const wait = BACKOFF_MS[attempt - 1] || 120000;
+        log(`backing off ${wait}ms`);
+        await new Promise(r => setTimeout(r, wait));
+      }
+    }
+  }
+  if (lastErr) throw lastErr;
   if (expected) {
     const got = await sha256OfFile(tmp);
     if (got !== expected) {
@@ -635,7 +526,7 @@ async function bootstrapRtk(plugkitVerDir, plugkitVersion, wrapperDir, silent, r
   if (os.platform() !== 'win32') { try { fs.chmodSync(rtkPath, 0o755); } catch (_) {} }
   fs.writeFileSync(rtkOk, new Date().toISOString());
   log(`installed ${rtkPath}`);
-  obsEvent('bootstrap', 'install.done', { path: rtkPath, plugkit_version: plugkitVersion, rtk_version: readRtkVersion(wrapperDir) || plugkitVersion, kind: 'rtk' });
+  obsEvent('bootstrap', 'install.done', { path: rtkPath, plugkit_version: plugkitVersion, rtk_version: readRtkVersion(wrapperDir) || plugkitVersion, kind: 'rtk', dur_ms: Date.now() - startMs });
   return rtkPath;
 }
 
@@ -655,7 +546,7 @@ function resolveCachedRtk(opts) {
   return null;
 }
 
-function resolveCachedBinary(opts) {
+function getWasmPath(opts) {
   opts = opts || {};
   const wrapperDir = opts.wrapperDir || __dirname;
   const version = opts.version || readVersionFile(wrapperDir);
@@ -664,9 +555,9 @@ function resolveCachedBinary(opts) {
     catch (_) { const r = fallbackCacheRoot(); ensureDir(r); return r; }
   })();
   const verDir = path.join(root, `v${version}`);
-  const finalPath = path.join(verDir, binaryName());
-  const okSentinel = path.join(verDir, '.ok');
-  if (fs.existsSync(finalPath) && fs.existsSync(okSentinel)) return finalPath;
+  const wasmPath = path.join(verDir, 'plugkit.wasm');
+  const okSentinel = path.join(verDir, '.wasm-ok');
+  if (fs.existsSync(wasmPath) && fs.existsSync(okSentinel)) return wasmPath;
   return null;
 }
 
@@ -729,72 +620,6 @@ function killRunningDaemons(reason) {
   return killedPids;
 }
 
-function listRunningPlugkitImagePaths() {
-  const out = [];
-  try {
-    const { spawnSync } = require('child_process');
-    if (os.platform() === 'win32') {
-      let parsed = null;
-      try {
-        const p = spawnSync('powershell', ['-NoProfile', '-NonInteractive', '-Command', "Get-Process plugkit* -ErrorAction SilentlyContinue | Select-Object Id,Path | ConvertTo-Json -Compress"], { windowsHide: true, encoding: 'utf8', timeout: 5000, killSignal: 'SIGKILL', stdio: ['ignore', 'pipe', 'pipe'] });
-        const text = ((p && p.stdout) || '').trim();
-        if (text) {
-          const j = JSON.parse(text);
-          parsed = Array.isArray(j) ? j : [j];
-        }
-      } catch (_) {}
-      if (parsed) {
-        for (const item of parsed) {
-          if (!item) continue;
-          const pid = parseInt(item.Id, 10);
-          if (!Number.isFinite(pid)) continue;
-          out.push({ pid, path: (item.Path || '').trim() });
-        }
-      } else {
-        const r = spawnSync('tasklist', ['/FI', 'IMAGENAME eq plugkit*', '/FO', 'CSV', '/NH'], { windowsHide: true, encoding: 'utf8', timeout: 5000, killSignal: 'SIGKILL', stdio: ['ignore', 'pipe', 'pipe'] });
-        const text = (r && r.stdout) || '';
-        const seen = new Set();
-        for (const line of text.split(/\r?\n/)) {
-          const m = line.match(/^"([^"]+)","(\d+)"/);
-          if (!m) continue;
-          const pid = parseInt(m[2], 10);
-          if (!Number.isFinite(pid) || seen.has(pid)) continue;
-          seen.add(pid);
-          out.push({ pid, path: '' });
-        }
-      }
-    } else if (os.platform() === 'linux') {
-      let entries = [];
-      try { entries = fs.readdirSync('/proc'); } catch (_) {}
-      for (const e of entries) {
-        if (!/^\d+$/.test(e)) continue;
-        const pid = parseInt(e, 10);
-        let comm = '';
-        try { comm = fs.readFileSync(`/proc/${pid}/comm`, 'utf8').trim(); } catch (_) { continue; }
-        if (!/^plugkit/i.test(comm)) continue;
-        let imagePath = '';
-        try { imagePath = fs.readlinkSync(`/proc/${pid}/exe`); } catch (_) {}
-        out.push({ pid, path: imagePath });
-      }
-    } else {
-      const r = spawnSync('ps', ['-axo', 'pid=,comm='], { encoding: 'utf8', timeout: 5000, killSignal: 'SIGKILL', stdio: ['ignore', 'pipe', 'pipe'] });
-      const text = (r && r.stdout) || '';
-      for (const line of text.split(/\r?\n/)) {
-        const m = line.match(/^\s*(\d+)\s+(.+?)\s*$/);
-        if (!m) continue;
-        if (!/plugkit/i.test(m[2])) continue;
-        const pid = parseInt(m[1], 10);
-        let imagePath = '';
-        try {
-          const p = spawnSync('ps', ['-p', String(pid), '-o', 'command='], { encoding: 'utf8', timeout: 3000, killSignal: 'SIGKILL', stdio: ['ignore', 'pipe', 'pipe'] });
-          imagePath = ((p && p.stdout) || '').trim().split(/\s+/)[0] || '';
-        } catch (_) {}
-        out.push({ pid, path: imagePath });
-      }
-    }
-  } catch (_) {}
-  return out;
-}
 
 function killSpoolWatcherInCwd(reason) {
   try {
@@ -811,39 +636,21 @@ function killSpoolWatcherInCwd(reason) {
   return null;
 }
 
-function proactiveKillForNewInstall(installedVersion, finalPath) {
+function proactiveKillForNewInstall(installedVersion) {
   try {
     const reason = `install:v${installedVersion}`;
-    const target = finalPath ? path.resolve(finalPath).toLowerCase() : null;
-    const cacheRootNorm = (() => {
-      try { return path.resolve(cacheRoot()).toLowerCase(); } catch (_) { return null; }
-    })();
-    const procs = listRunningPlugkitImagePaths();
-    for (const { pid, path: imagePath } of procs) {
-      if (!Number.isFinite(pid) || pid === process.pid) continue;
-      if (!imagePath) continue;
-      const norm = path.resolve(imagePath).toLowerCase();
-      if (target && norm === target) continue;
-      if (!cacheRootNorm || !norm.startsWith(cacheRootNorm + path.sep.toLowerCase())) continue;
-      if (killPid(pid)) {
-        try { process.stderr.write(`[bootstrap] killed stale daemon pid=${pid} path=${imagePath} (current install: v${installedVersion})\n`); } catch (_) {}
-        obsEvent('bootstrap', 'daemon.killed', { pid, oldPath: imagePath, installedVersion, mechanism: 'process-path' });
-      }
-    }
     killRunningDaemons(reason);
     killSpoolWatcherInCwd(reason);
     writeDaemonVersion(installedVersion);
   } catch (_) {}
 }
 
-// Compare wrapper-pinned version against last-recorded daemon version. If
-// they differ, kill the daemon so it respawns under the new binary.
 function killStaleDaemonIfVersionChanged(wrapperDir) {
   let currentVersion;
   try { currentVersion = readVersionFile(wrapperDir); } catch (_) { return; }
-  const cached = resolveCachedBinary({ wrapperDir, version: currentVersion });
+  const cached = getWasmPath({ wrapperDir, version: currentVersion });
   if (cached) {
-    proactiveKillForNewInstall(currentVersion, cached);
+    proactiveKillForNewInstall(currentVersion);
     return;
   }
   const recorded = readDaemonVersion();
@@ -852,7 +659,7 @@ function killStaleDaemonIfVersionChanged(wrapperDir) {
   writeDaemonVersion(currentVersion);
 }
 
-module.exports = { bootstrap, resolveCachedBinary, resolveCachedRtk, platformKey, binaryName, rtkBinaryName, cacheRoot, obsEvent, killRunningDaemons, killStaleDaemonIfVersionChanged, killSpoolWatcherInCwd, proactiveKillForNewInstall };
+module.exports = { bootstrap, getWasmPath, resolveCachedRtk, rtkBinaryName, cacheRoot, obsEvent, killRunningDaemons, killStaleDaemonIfVersionChanged, killSpoolWatcherInCwd, proactiveKillForNewInstall };
 
 if (require.main === module) {
   const argv = process.argv.slice(2);

package/bin/plugkit.js

@@ -81,13 +81,40 @@ function ensureReady(silent) {
   return r.status === 0 && isReady();
 }
 
+function wasmPath() {
+  return path.join(wrapperDir, 'plugkit.wasm');
+}
+
+function shouldUseWasm() {
+  if (process.env.GM_USE_WASM === '1') return true;
+  if (fs.existsSync(wasmPath()) && !fs.existsSync(toolsBin())) return true;
+  return false;
+}
+
+async function runWasm(args) {
+  try {
+    const WasmHost = require('../lib/wasm-host');
+    const host = new WasmHost(wasmPath());
+    const verb = args[0] || 'health';
+    const body = args.slice(1).join(' ') || '{}';
+    const result = await host.dispatch(verb, body);
+    console.log(JSON.stringify(result, null, 2));
+    process.exit(result.ok ? 0 : 1);
+  } catch (err) {
+    console.error('[plugkit wasm]', err.message);
+    process.exit(1);
+  }
+}
+
 function main() {
   const args = process.argv.slice(2);
   const isHook = args[0] === 'hook';
   const hookSubcmd = isHook ? (args[1] || '') : '';
 
-  // Synchronous readiness check on these hooks. Hot path: isReady() is sha-match
-  // against pinned manifest, returns true in <50ms with no network.
+  if (shouldUseWasm()) {
+    return runWasm(args);
+  }
+
   const blocksUntilReady = hookSubcmd === 'session-start' || hookSubcmd === 'prompt-submit';
 
   if (blocksUntilReady) {
@@ -96,8 +123,6 @@ function main() {
       process.exit(1);
     }
   } else if (!fs.existsSync(toolsBin())) {
-    // For non-blocking hooks (pre-tool-use, post-tool-use, stop, etc.): if the
-    // binary doesn't exist yet, exit cleanly — session-start will populate it.
     if (isHook) process.exit(0);
     process.exit(1);
   }

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.1069",
+  "version": "2.0.1071",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-thebird",
-  "version": "2.0.1069",
+  "version": "2.0.1071",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.1069",
+  "version": "2.0.1071",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": {
     "name": "AnEntrypoint",

package/skills/code-search/SKILL.md

@@ -5,7 +5,7 @@ description: Mandatory codebase search workflow. Use whenever you need to find a
 
 # Codebase search
 
-`exec:codesearch` is the only codebase search tool. Grep, Glob, Find, Explore, raw `grep`/`rg`/`find` inside `exec:bash` are all hook-blocked. No fallback.
+`exec:codesearch` is the only codebase search tool. Never use Grep, Glob, Find, Explore, raw `grep`/`rg`/`find` inside `exec:bash`. No fallback.
 
 A `@<discipline>` first-token after the verb scopes the search to that discipline's index; absent the sigil, results fan across default plus enabled disciplines, prefixed by source.
 

package/skills/gm-complete/SKILL.md

@@ -26,7 +26,7 @@ Failure triage: broken output to EMIT, wrong logic to EXECUTE, new unknown to PL
 - `git_clean` — `git status --porcelain` returns empty
 - `git_pushed` — `git log origin/main..HEAD --oneline` returns empty
 - `ci_passed` — every GitHub Actions run reaches `conclusion: success`
-- `mutables_resolved` — `.gm/mutables.yml` deleted OR every entry `status: witnessed`. Stop hook hard-blocks turn-stop while any entry is `status: unknown`.
+- `mutables_resolved` — `.gm/mutables.yml` deleted OR every entry `status: witnessed`. Never stop the turn while any entry is `status: unknown` — this gate is self-enforced.
 - `prd_empty` — `.gm/prd.yml` deleted AFTER residual scan: enumerate every in-spirit reachable residual surfaced this session; any hit re-enters `planning`, appends PRD items, executes. Empty PRD is necessary, not sufficient — done = empty PRD AND zero reachable in-spirit residuals. Out-of-spirit-or-unreachable residuals are named in the response and skipped; everything else is this turn's work.
 - `stress_suite_clear` — change walked through M1–D1 (governance), none flunked
 - `hidden_decision_posture` — open → down_weighted → closed only when CI is green AND stress suite is clear
@@ -81,7 +81,7 @@ Both must return empty. Local commit without push is not complete.
 
 ## CI is automated
 
-The Stop hook watches Actions for the pushed HEAD. Do not call `gh run list` manually. All-green → Stop approves with CI summary in next-turn context. Failure → Stop blocks with run names + IDs; investigate via `gh run view <id> --log-failed`, fix, push, hook re-watches. Deadline 180s (override `GM_CI_WATCH_SECS`); slow jobs get a "still in progress" approve.
+After `git push`, poll `gh run list --branch main --limit 5 --json status,name,databaseId` until all runs reach a terminal state. Green → continue; failure → investigate via `gh run view <id> --log-failed`, fix, push again. Deadline 180s (override `GM_CI_WATCH_SECS`). Poll every 10s via a nodejs spool file with a `setInterval` loop writing results to stdout.
 
 ## Hygiene sweep
 

package/skills/gm-emit/SKILL.md

@@ -49,7 +49,7 @@ Re-import from disk — in-memory state is stale and inadmissible. Run identical
 
 ## Mutables gate
 
-Before pre-emit run, read `.gm/mutables.yml`. Any entry with `status: unknown` → regress to `gm-execute`. The pre-tool-use hook hard-blocks Write/Edit/NotebookEdit while unresolved entries exist; trying to emit anyway returns deny. Zero unresolved is the precondition for every legitimacy question below.
+Before pre-emit run, read `.gm/mutables.yml`. Any entry with `status: unknown` → regress to `gm-execute`. Never use Write/Edit/NotebookEdit while unresolved entries exist — this gate is self-enforced. Zero unresolved is the precondition for every legitimacy question below.
 
 ## Gate (all true at once)
 

package/skills/gm-execute/SKILL.md

@@ -30,7 +30,7 @@ Resolves to KNOWN only when all four pass:
 
 Unresolved after 2 passes regresses to `planning`. Never narrate past an unresolved mutable.
 
-Every witness that resolves a mutable writes back to `.gm/mutables.yml` the same step: set `status: witnessed` and fill `witness_evidence` with concrete proof (file:line, codesearch hit, exec output snippet). No write-back = the mutable stays unknown and the EMIT-gate stays closed. The hook reads this file; the agent's memory of "I resolved it" does not unblock anything.
+Every witness that resolves a mutable writes back to `.gm/mutables.yml` the same step: set `status: witnessed` and fill `witness_evidence` with concrete proof (file:line, codesearch hit, exec output snippet). No write-back = the mutable stays unknown and the EMIT-gate stays closed. The file is the record; the agent's memory of "I resolved it" does not count.
 
 Route candidates from PLAN are `weak_prior` only. Plausibility is the right to test, not the right to believe. A claim with no witness in the current session is a hypothesis — say so when stating it, and say what would settle it. The next reader (you, next turn) needs to know which lines were earned and which were carried forward.
 
@@ -44,13 +44,13 @@ Code AND utility verbs both run through the file-spool. Write a file to `.gm/exe
 
 Pack runs: `Promise.allSettled`, each idea own try/catch, under 12s per call. Runner: write `in/runner/<N>.txt` with body `start` | `stop` | `status`.
 
-Every exec daemonizes. The hook tails the task logfile up to 30s wall-clock and returns whatever is there — short tasks complete inside the window and look synchronous; long tasks return a task_id with partial output. Continue with `exec:tail` (drain, bounded), `exec:watch` (resume blocking until match or timeout), or `exec:close` (terminate). Never re-spawn a long task to check on it — that orphans the first one. `exec:wait` is a pure timer; `exec:sleep` blocks on a specific task's output; `exec:watch` is the match-or-timeout primitive. Every execution-platform RPC returns the live list of running tasks for this session — close stragglers via `exec:close\n<id>` so the list stays scannable. Session-end (clear/logout/prompt_input_exit) kills the session's tasks; compaction/handoff preserves them.
+Every exec daemonizes. The spool watcher tails the task logfile up to 30s wall-clock and returns whatever is there — short tasks complete inside the window and look synchronous; long tasks return a task_id with partial output. Continue with `exec:tail` (drain, bounded), `exec:watch` (resume blocking until match or timeout), or `exec:close` (terminate). Never re-spawn a long task to check on it — that orphans the first one. `exec:wait` is a pure timer; `exec:sleep` blocks on a specific task's output; `exec:watch` is the match-or-timeout primitive. Every execution-platform RPC returns the live list of running tasks for this session — close stragglers via `exec:close\n<id>` so the list stays scannable. Session-end (clear/logout/prompt_input_exit) kills the session's tasks; compaction/handoff preserves them.
 
-Every utility verb dispatches via `in/<verb>/<N>.txt`; the body of the file is the verb's argument. There is no inline form and no Bash-prefix form — both are denied by the hook.
+Every utility verb dispatches via `in/<verb>/<N>.txt`; the body of the file is the verb's argument. There is no inline form and no Bash-prefix form — use only the spool path.
 
 ## Codebase search
 
-Codesearch only. Grep, Glob, Find, Explore, raw grep/rg/find inside Bash are all hook-blocked. Write query to `.gm/exec-spool/in/codesearch/<N>.txt`. Read result from `.gm/exec-spool/out/<N>.out`.
+Codesearch only. Never use Grep, Glob, Find, Explore, raw grep/rg/find inside Bash. Write query to `.gm/exec-spool/in/codesearch/<N>.txt`. Read result from `.gm/exec-spool/out/<N>.out`.
 
 Start two words, change/add one per pass, minimum four attempts before concluding absent. Known absolute path → `Read`. Known directory → nodejs spool file + `fs.readdirSync`.
 
@@ -80,4 +80,4 @@ Up to 3 `gm:gm` subagents for independent items in one message. Browser escalati
 
 ## CI is automated
 
-`git push` triggers the Stop hook to watch Actions for the pushed HEAD on the same repo (downstream cascades are not auto-watched). Green → Stop approves with summary; failure → run names + IDs surfaced, investigate via `gh run view <id> --log-failed`. Deadline 180s (override `GM_CI_WATCH_SECS`).
+After `git push`, poll `gh run list --branch main --limit 5 --json status,name,databaseId` until all runs reach a terminal state. Green → continue; failure → investigate via `gh run view <id> --log-failed`, fix, push again. Deadline 180s (override `GM_CI_WATCH_SECS`). Poll every 10s via a nodejs spool file with a `setInterval` loop writing results to stdout.

package/skills/planning/SKILL.md

@@ -77,7 +77,7 @@ Plan exits when zero new unknowns surfaced last pass AND every item has acceptan
 
 ## .gm/mutables.yml — co-equal with .gm/prd.yml
 
-Every unknown surfaced during PLAN lands as an entry in `.gm/mutables.yml` the same pass. Live during work, deleted when empty. Hook-gated: Write/Edit/NotebookEdit and `git commit`/`git push` are hard-blocked while any entry has `status: unknown`; turn-stop is hard-blocked the same way.
+Every unknown surfaced during PLAN lands as an entry in `.gm/mutables.yml` the same pass. Live during work, deleted when empty. Self-enforced: never use Write/Edit/NotebookEdit, never run `git commit`/`git push`, never stop the turn while any entry has `status: unknown`. This discipline is owned by the agent — not by external infrastructure.
 
 ```yaml
 - id: kebab-id
@@ -143,7 +143,7 @@ The 200 lines are a *budget* for maximum surface coverage, not a target. Subsyst
 
 Code execution AND utility verbs both write to `.gm/exec-spool/in/<lang-or-verb>/<N>.<ext>`. Languages live under `in/<lang>/` (nodejs, python, bash, typescript, go, rust, c, cpp, java, deno); verbs live under `in/<verb>/` (codesearch, recall, memorize, wait, sleep, status, close, browser, runner, type, kill-port, forget, feedback, learn-status, learn-debug, learn-build, discipline, pause, health). The spool watcher runs the file and streams to `out/<N>.out` (stdout) + `out/<N>.err` (stderr) line-by-line, then writes `out/<N>.json` metadata (exitCode, durationMs, timedOut, startedAt, endedAt) at completion. Both streams return as systemMessage with `--- stdout ---` / `--- stderr ---` separators. `in/` and `out/` are wiped at session start and at real-exit session end. Only `git` (and `gh`) run directly via Bash; never `Bash(node/npm/npx/bun)`, never `Bash(exec:<anything>)`. Spool paths in nodejs files are platform-literal — use `os.tmpdir()` and `path.join`. The spool enforces per-task timeouts; on timeout, partial output is preserved and the watcher emits `[exec timed out after Nms; partial output above]`.
 
-Codesearch only — Grep/Glob/Find/Explore are hook-blocked. Write to `.gm/exec-spool/in/codesearch/<N>.txt`. Start two words, change/add one per pass, minimum four attempts before concluding absent.
+Codesearch only — never use Grep/Glob/Find/Explore. Write to `.gm/exec-spool/in/codesearch/<N>.txt`. Start two words, change/add one per pass, minimum four attempts before concluding absent.
 
 Pack runs use `Promise.allSettled`, each idea its own try/catch, under 12s per call.