@ai-ecoverse/mcpcat 0.17.4 → 0.17.6

package/README.md

@@ -26,14 +26,12 @@ mcpcat runs natively on macOS, Linux and Windows (Node ≥ 24), and inside Slicc
 
 ## Releases: certified = latest
 
-Every change that alters what mcpcat ships is certified before it reaches `main`. A pull request that touches `src/`, the build, the dependencies or the release workflows gets mcpcat's cert-review on a pack of its head, and again in the merge queue on the exact tree that lands on `main`; a FAIL blocks the merge. Docs-, test- and CI-only changes skip it as "not behaviour". A draft pull request is not reviewed: its `cert-review` is red with `draft: not reviewed, mark it ready for review`, and marking it ready starts the review (converted_to_draft cancels a running one). Mark ready = reviewed, and merges on green; a pull request held for anything stays a draft. For a PR that needs the coordinator's security read, the order is: the coordinator reads the draft, it is marked ready, the cert runs, then the queue. Each merge to `main` is then released to npm as `latest` in one step by semantic-release, with provenance, so `npm install @ai-ecoverse/mcpcat` and the installer always get certified code. The verdict line is a comment on the pull request and the `cert-review` commit status. It reads `certified …`, `cert-ci: FAIL …` when the reviewer or a check in code found a defect (status `failure`), or `cert-ci: INCOMPLETE …` when the review couldn't decide: the review job didn't succeed or was skipped, no verdict could be read, or the artifact or the runner's own `gh` was missing (status `error`). A fork's change to shipped behaviour also reads INCOMPLETE, since it gets no review. INCOMPLETE never certifies; re-run the failed jobs. A run that ends without `record` posting its status (a crashed plan, record or verdict job) still posts one on the head: `error` with its INCOMPLETE line, `failure` for a FAIL, or `pending` while the coordinator approval is missing. So the required `cert-review` check never waits forever, and a label change reuses only a `success` or `failure` verdict, never an INCOMPLETE one. The reviewer's verdict can add defects but never clear one found in code: `record` re-reads the suites' evidence (`stage.json`, `suites.json`), uploaded before the reviewer runs and bound by the artifact id and digest the review job output. A suite or security row that failed on the host or a pinned kernel, a changed test that fails on the head, an import in the kernel bundle or an unexplained rebuild difference is a FAIL. Missing suites, kernels or rows are INCOMPLETE. The NEGATIVE runs each changed test on the base's code: the subject's tests, helpers and fixtures with the base's `dist`, `scripts/` and `.github/workflows/`, all from the base sha, so a test of the cert tooling runs against main's tooling. The record names both shas. A changed test that also passes on the base is named in the line as `gaps: no-negative <file>`. Every artifact a later job reads (the tarball, the verdict, the suites' evidence) is downloaded by the artifact id its producer output, after `bind.mjs` checks the artifact's name, run and digest against that producer's outputs. Any other artifact from this attempt of the run under `mcpcat-tarball-`, `mcpcat-npm-tarball-` or `cert-review-` makes the line INCOMPLETE. An earlier attempt's leftovers, created before this attempt started, are never read.
+Every change that alters what mcpcat ships is certified before it reaches `main`. A pull request that touches `src/`, the build, the dependencies or the release workflows gets mcpcat's cert-review on a pack of its head, and again in the merge queue on the exact tree that lands on `main`; a FAIL blocks the merge. Docs-, test- and CI-only changes skip it as "not behaviour". A draft pull request is not reviewed: its `cert-review` is red with `draft: not reviewed, mark it ready for review`, and marking it ready starts the review (converted_to_draft cancels a running one). Mark ready = reviewed, and merges on green; a pull request held for anything stays a draft. For a PR that needs the coordinator's security read, the order is: the coordinator reads the draft, it is marked ready, the cert runs, then the queue. Each merge to `main` is then released to npm as `latest` in one step by semantic-release, with provenance, so `npm install @ai-ecoverse/mcpcat` and the installer always get certified code. The verdict line is a comment on the pull request and the `cert-review` commit status. It reads `certified …`, `cert-ci: FAIL …` when the reviewer or a check in code found a defect (status `failure`), or `cert-ci: INCOMPLETE …` when the review couldn't decide: the review job didn't succeed or was skipped, no verdict could be read, or the artifact or the runner's own `gh` was missing (status `error`). A fork's change to shipped behaviour also reads INCOMPLETE, since it gets no review. INCOMPLETE never certifies; re-run the failed jobs. A run that ends without `record` posting its status (a crashed plan, record or verdict job) still posts one on the head: `error` with its INCOMPLETE line, or `failure` for a FAIL. So the required `cert-review` check never waits forever. The reviewer's verdict can add defects but never clear one found in code: `record` re-reads the suites' evidence (`stage.json`, `suites.json`), uploaded before the reviewer runs and bound by the artifact id and digest the review job output. A suite or security row that failed on the host or a pinned kernel, a changed test that fails on the head, an import in the kernel bundle or an unexplained rebuild difference is a FAIL. Missing suites, kernels or rows are INCOMPLETE. The NEGATIVE runs each changed test on the base's code: the subject's tests, helpers and fixtures with the base's `dist`, `scripts/` and `.github/workflows/`, all from the base sha, so a test of the cert tooling runs against main's tooling. The record names both shas. A changed test that also passes on the base is named in the line as `gaps: no-negative <file>`. Every artifact a later job reads (the tarball, the verdict, the suites' evidence) is downloaded by the artifact id its producer output, after `bind.mjs` checks the artifact's name, run and digest against that producer's outputs. Any other artifact from this attempt of the run under `mcpcat-tarball-`, `mcpcat-npm-tarball-` or `cert-review-` makes the line INCOMPLETE. An earlier attempt's leftovers, created before this attempt started, are never read.
 
 After each release, `cert-verify.yml` (on the Release run's success, or dispatched from `main` with a `version`) checks again that npm serves the SLSA subject built by `release.yml` on `main` from the tag, and that every pull request merged since the previous tag carries a green `cert-review` status on its head. Its hosted, write-only `notes` job then puts one line into the GitHub release notes, between `<!-- cert-verify -->` markers: `certified @ai-ecoverse/mcpcat@<version> sha256=<sha> (…; pr-certified since v<prev>: …)`, or `verified …` when some pull request lacks a green cert-review. A re-run with the same bytes leaves the notes as they are. Notes that already name another sha for the version, or npm bytes that don't verify, are a supply-chain alert: nothing is written and an issue is filed. Checks that couldn't run read `cert-ci: INCOMPLETE` and write nothing.
 
 Silence never passes: every gate in the workflows prints a verdict line, and its caller requires that line, not just an exit code. These are `all-green: PASS|FAIL …`, the cert job's `cert: kernel <v> — N kernel tests passed`, shipped.mjs's `behaviour:`/`not behaviour:`, release verify's `verified …`, and the installer tests' `All installer tests passed.`. A gate that exits 0 without its line fails.
 
-A pull request or merge group that touches the certification itself (the `cert-review` and `ci` workflows, `scripts/cert-review/` and `rows.json`, `scripts/cert.mjs`, `scripts/kernel-test-files.mjs`, and the cert-row, cert-gate, cert-review, cert-runner, cert-self-guard, cert-verify and cert-verdicts tests) fails `cert-review` with "needs coordinator review" until the label `cert-review-approved` is applied after its head arrived. The check is the shared [cert self-guard](https://github.com/ai-ecoverse/slicc-shared-web/tree/f342d7cf558c817ce517bbbbc4cc46df6eac2f97/.github/actions/cert-self-guard), pinned to a full sha in `cert-review.yml`. Only the lane coordinator applies the label, after reading the diff; workers never add or remove it. Any push removes it, so every new head needs a fresh approval; a label change re-runs the checks but reuses the recorded cert-review verdict of an unchanged head. To re-check an approval, run the label event, not the earlier push. The label is procedural: every agent acts as one admin account, so the permission check cannot tell a coordinator from a worker, and a deliberate rewrite of the workflow is not stopped. The `kernel-cert-*` pins in `package.json` are not guarded, because the guard matches whole files and guarding `package.json` would hold every Renovate bump for approval.
-
 ## Quick start
 
 ```sh

package/dist/host/mcpcat.mjs

@@ -8453,22 +8453,20 @@ function mcpNameForMethod(method, params) {
 function makeAbort(timeoutMs, externalSignal) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
-  if (externalSignal) {
-    if (externalSignal.aborted) {
+  const onAbort = () => {
+    clearTimeout(timer);
+    controller.abort();
+  };
+  if (externalSignal?.aborted) onAbort();
+  else externalSignal?.addEventListener("abort", onAbort, { once: true });
+  return {
+    controller,
+    stopTimer: () => clearTimeout(timer),
+    detach: () => {
       clearTimeout(timer);
-      controller.abort();
-    } else {
-      externalSignal.addEventListener(
-        "abort",
-        () => {
-          clearTimeout(timer);
-          controller.abort();
-        },
-        { once: true }
-      );
+      externalSignal?.removeEventListener("abort", onAbort);
     }
-  }
-  return { controller, timer };
+  };
 }
 function logHeaders(verbose, dir, entries) {
   for (const [k, v] of entries) {
@@ -8586,7 +8584,7 @@ async function createStatelessConnection(options) {
       verbose.request(method, body);
       logHeaders(verbose, ">", Object.entries(headers));
     }
-    const { controller, timer } = makeAbort(timeoutMs, externalSignal);
+    const { controller, stopTimer, detach } = makeAbort(timeoutMs, externalSignal);
     try {
       const res = await fetchImpl(url, {
         method: "POST",
@@ -8598,14 +8596,15 @@ async function createStatelessConnection(options) {
         verbose.http("<", `HTTP/1.1 ${res.status} ${res.statusText}`);
         logHeaders(verbose, "<", res.headers.entries());
       }
-      return { res, token };
+      return { res, token, detach };
     } catch (err) {
+      detach();
       if (controller.signal.aborted && !externalSignal?.aborted) {
         throw new McpTimeoutError2(method, timeoutMs);
       }
       throw err;
     } finally {
-      clearTimeout(timer);
+      stopTimer();
     }
   }
   async function parseResponse(res, id) {
@@ -8654,19 +8653,22 @@ async function createStatelessConnection(options) {
       params: { ...cleanParams, _meta: meta }
     });
     for (let attempt = 0; attempt < 2; attempt++) {
-      const { res, token } = await doFetch(method, params, body);
-      if (res.status >= 400) {
-        try {
-          await handleErrorStatus(res, method);
-        } catch (err) {
-          if (err instanceof AuthRetryableError && attempt === 0) {
-            await handleAuthError(err, token);
-            continue;
+      const { res, token, detach } = await doFetch(method, params, body);
+      let retry;
+      try {
+        if (res.status >= 400) {
+          try {
+            await handleErrorStatus(res, method);
+          } catch (err) {
+            if (!(err instanceof AuthRetryableError && attempt === 0)) throw err;
+            retry = err;
           }
-          throw err;
         }
+        if (!retry) return await parseResponse(res, id);
+      } finally {
+        detach();
       }
-      return parseResponse(res, id);
+      await handleAuthError(retry, token);
     }
     throw new McpAuthError(401, url);
   }
@@ -8858,6 +8860,19 @@ function createStdioJsonRpc(proc, platform2, options) {
       writer.releaseLock();
     }
   }
+  function raceDeadline(linePromise, method, remaining) {
+    let timer;
+    let onAbort;
+    const stop = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new McpTimeoutError2(method, timeoutMs)), remaining);
+      onAbort = () => reject(new McpTimeoutError2(method, timeoutMs));
+      externalSignal?.addEventListener("abort", onAbort, { once: true });
+    });
+    return Promise.race([linePromise, stop]).finally(() => {
+      clearTimeout(timer);
+      if (onAbort) externalSignal?.removeEventListener("abort", onAbort);
+    });
+  }
   async function request(method, params) {
     const id = nextId2++;
     const meta = {
@@ -8881,11 +8896,7 @@ function createStdioJsonRpc(proc, platform2, options) {
     while (Date.now() < deadline) {
       const remaining = deadline - Date.now();
       if (externalSignal?.aborted) throw new McpTimeoutError2(method, timeoutMs);
-      const linePromise = readLine2();
-      const timeoutPromise = new Promise(
-        (_, reject) => setTimeout(() => reject(new McpTimeoutError2(method, timeoutMs)), remaining)
-      );
-      const line = await Promise.race([linePromise, timeoutPromise]);
+      const line = await raceDeadline(readLine2(), method, remaining);
       const parsed = JSON.parse(line);
       if (verbose?.enabled) verbose.response(line);
       if (parsed.id === id) {
@@ -11136,6 +11147,23 @@ async function runDiscover(platform2, args2) {
   return 0;
 }
 
+// src/render/redact.ts
+function redactDeep(value, redact2) {
+  if (typeof value === "string") return redact2(value);
+  if (Array.isArray(value)) return value.map((v) => redactDeep(v, redact2));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([k, v]) => [redact2(k), redactDeep(v, redact2)])
+    );
+  }
+  return value;
+}
+function redactWrites(platform2, redact2) {
+  return Object.assign(Object.create(platform2), {
+    write: (fd, data) => platform2.write(fd, typeof data === "string" ? redact2(data) : data)
+  });
+}
+
 // src/render/result.ts
 function formatBytes(n) {
   if (n < 1024) return `${n} bytes`;
@@ -16531,18 +16559,24 @@ async function loadRespondData(platform2, respondArg, json) {
     return { exitCode: EXIT_USAGE };
   }
 }
-async function handleInputRequired(platform2, conn, err, respondData, json) {
+async function handleInputRequired(platform2, conn, err, respondData, json, redact2) {
   const parsed2 = JSON.parse(err.requestJson);
+  const requestOut = sanitizeJson(JSON.stringify(redactDeep(parsed2, redact2), null, 2));
   const inputReq = parseInputRequest(parsed2.result ?? parsed2);
   if (!inputReq) {
-    await platform2.write(2, `${sanitizeJson(err.requestJson)}
+    await platform2.write(2, `${requestOut}
 `);
     return EXIT_INPUT_REQUIRED;
   }
   const isTty = platform2.kind === "host" && platform2.isatty(0) && platform2.isatty(2);
-  const elicitResult = await handleElicitation(platform2, inputReq, isTty, respondData);
+  const elicitResult = await handleElicitation(
+    redactWrites(platform2, redact2),
+    inputReq,
+    isTty,
+    respondData
+  );
   if ("exitCode" in elicitResult) {
-    await platform2.write(2, `${sanitizeJson(err.requestJson)}
+    await platform2.write(2, `${requestOut}
 `);
     return EXIT_INPUT_REQUIRED;
   }
@@ -16554,7 +16588,7 @@ async function handleInputRequired(platform2, conn, err, respondData, json) {
     return renderCallResult(platform2, retryResult, { json });
   } catch (retryErr) {
     const e2 = classifyError(retryErr);
-    await writeErr(platform2, json, e2.kind, e2.msg);
+    await writeErrRedacted(platform2, json, e2.kind, e2.msg, redact2);
     return e2.code;
   }
 }
@@ -16630,11 +16664,7 @@ async function runClientVerb(platform2, version, parsed) {
   const redact2 = (text) => {
     let result = text;
     for (const secret of allSecrets) {
-      if (secret.length > 0) {
-        while (result.includes(secret)) {
-          result = result.replace(secret, "[REDACTED]");
-        }
-      }
+      if (secret.length > 0) result = result.replaceAll(secret, "[REDACTED]");
     }
     return result;
   };
@@ -16712,7 +16742,7 @@ async function runClientVerb(platform2, version, parsed) {
       return termExitCode;
     }
     if (err instanceof InputRequiredError) {
-      return handleInputRequired(platform2, conn, err, respondData, parsed.jsonOutput);
+      return handleInputRequired(platform2, conn, err, respondData, parsed.jsonOutput, redact2);
     }
     const e = classifyError(err);
     await writeErrRedacted(platform2, parsed.jsonOutput, e.kind, e.msg, redact2);
@@ -17014,5 +17044,5 @@ try {
   });
 } catch {
 }
-var code = await run(platform, "0.17.4", args);
+var code = await run(platform, "0.17.6", args);
 process.exit(code);

package/dist/kernel/mcpcat.mjs

@@ -8074,22 +8074,20 @@ function mcpNameForMethod(method, params) {
 function makeAbort(timeoutMs, externalSignal) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
-  if (externalSignal) {
-    if (externalSignal.aborted) {
+  const onAbort = () => {
+    clearTimeout(timer);
+    controller.abort();
+  };
+  if (externalSignal?.aborted) onAbort();
+  else externalSignal?.addEventListener("abort", onAbort, { once: true });
+  return {
+    controller,
+    stopTimer: () => clearTimeout(timer),
+    detach: () => {
       clearTimeout(timer);
-      controller.abort();
-    } else {
-      externalSignal.addEventListener(
-        "abort",
-        () => {
-          clearTimeout(timer);
-          controller.abort();
-        },
-        { once: true }
-      );
+      externalSignal?.removeEventListener("abort", onAbort);
     }
-  }
-  return { controller, timer };
+  };
 }
 function logHeaders(verbose, dir, entries) {
   for (const [k, v] of entries) {
@@ -8207,7 +8205,7 @@ async function createStatelessConnection(options) {
       verbose.request(method, body);
       logHeaders(verbose, ">", Object.entries(headers));
     }
-    const { controller, timer } = makeAbort(timeoutMs, externalSignal);
+    const { controller, stopTimer, detach } = makeAbort(timeoutMs, externalSignal);
     try {
       const res = await fetchImpl(url, {
         method: "POST",
@@ -8219,14 +8217,15 @@ async function createStatelessConnection(options) {
         verbose.http("<", `HTTP/1.1 ${res.status} ${res.statusText}`);
         logHeaders(verbose, "<", res.headers.entries());
       }
-      return { res, token };
+      return { res, token, detach };
     } catch (err) {
+      detach();
       if (controller.signal.aborted && !externalSignal?.aborted) {
         throw new McpTimeoutError2(method, timeoutMs);
       }
       throw err;
     } finally {
-      clearTimeout(timer);
+      stopTimer();
     }
   }
   async function parseResponse(res, id) {
@@ -8275,19 +8274,22 @@ async function createStatelessConnection(options) {
       params: { ...cleanParams, _meta: meta }
     });
     for (let attempt = 0; attempt < 2; attempt++) {
-      const { res, token } = await doFetch(method, params, body);
-      if (res.status >= 400) {
-        try {
-          await handleErrorStatus(res, method);
-        } catch (err) {
-          if (err instanceof AuthRetryableError && attempt === 0) {
-            await handleAuthError(err, token);
-            continue;
+      const { res, token, detach } = await doFetch(method, params, body);
+      let retry;
+      try {
+        if (res.status >= 400) {
+          try {
+            await handleErrorStatus(res, method);
+          } catch (err) {
+            if (!(err instanceof AuthRetryableError && attempt === 0)) throw err;
+            retry = err;
           }
-          throw err;
         }
+        if (!retry) return await parseResponse(res, id);
+      } finally {
+        detach();
       }
-      return parseResponse(res, id);
+      await handleAuthError(retry, token);
     }
     throw new McpAuthError(401, url);
   }
@@ -8479,6 +8481,19 @@ function createStdioJsonRpc(proc, platform2, options) {
       writer.releaseLock();
     }
   }
+  function raceDeadline(linePromise, method, remaining) {
+    let timer;
+    let onAbort;
+    const stop = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new McpTimeoutError2(method, timeoutMs)), remaining);
+      onAbort = () => reject(new McpTimeoutError2(method, timeoutMs));
+      externalSignal?.addEventListener("abort", onAbort, { once: true });
+    });
+    return Promise.race([linePromise, stop]).finally(() => {
+      clearTimeout(timer);
+      if (onAbort) externalSignal?.removeEventListener("abort", onAbort);
+    });
+  }
   async function request(method, params) {
     const id = nextId2++;
     const meta = {
@@ -8502,11 +8517,7 @@ function createStdioJsonRpc(proc, platform2, options) {
     while (Date.now() < deadline) {
       const remaining = deadline - Date.now();
       if (externalSignal?.aborted) throw new McpTimeoutError2(method, timeoutMs);
-      const linePromise = readLine2();
-      const timeoutPromise = new Promise(
-        (_, reject) => setTimeout(() => reject(new McpTimeoutError2(method, timeoutMs)), remaining)
-      );
-      const line = await Promise.race([linePromise, timeoutPromise]);
+      const line = await raceDeadline(readLine2(), method, remaining);
       const parsed = JSON.parse(line);
       if (verbose?.enabled) verbose.response(line);
       if (parsed.id === id) {
@@ -10757,6 +10768,23 @@ async function runDiscover(platform2, args) {
   return 0;
 }
 
+// src/render/redact.ts
+function redactDeep(value, redact2) {
+  if (typeof value === "string") return redact2(value);
+  if (Array.isArray(value)) return value.map((v) => redactDeep(v, redact2));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([k, v]) => [redact2(k), redactDeep(v, redact2)])
+    );
+  }
+  return value;
+}
+function redactWrites(platform2, redact2) {
+  return Object.assign(Object.create(platform2), {
+    write: (fd, data) => platform2.write(fd, typeof data === "string" ? redact2(data) : data)
+  });
+}
+
 // src/render/result.ts
 function formatBytes(n) {
   if (n < 1024) return `${n} bytes`;
@@ -16152,18 +16180,24 @@ async function loadRespondData(platform2, respondArg, json) {
     return { exitCode: EXIT_USAGE };
   }
 }
-async function handleInputRequired(platform2, conn, err, respondData, json) {
+async function handleInputRequired(platform2, conn, err, respondData, json, redact2) {
   const parsed2 = JSON.parse(err.requestJson);
+  const requestOut = sanitizeJson(JSON.stringify(redactDeep(parsed2, redact2), null, 2));
   const inputReq = parseInputRequest(parsed2.result ?? parsed2);
   if (!inputReq) {
-    await platform2.write(2, `${sanitizeJson(err.requestJson)}
+    await platform2.write(2, `${requestOut}
 `);
     return EXIT_INPUT_REQUIRED;
   }
   const isTty = platform2.kind === "host" && platform2.isatty(0) && platform2.isatty(2);
-  const elicitResult = await handleElicitation(platform2, inputReq, isTty, respondData);
+  const elicitResult = await handleElicitation(
+    redactWrites(platform2, redact2),
+    inputReq,
+    isTty,
+    respondData
+  );
   if ("exitCode" in elicitResult) {
-    await platform2.write(2, `${sanitizeJson(err.requestJson)}
+    await platform2.write(2, `${requestOut}
 `);
     return EXIT_INPUT_REQUIRED;
   }
@@ -16175,7 +16209,7 @@ async function handleInputRequired(platform2, conn, err, respondData, json) {
     return renderCallResult(platform2, retryResult, { json });
   } catch (retryErr) {
     const e2 = classifyError(retryErr);
-    await writeErr(platform2, json, e2.kind, e2.msg);
+    await writeErrRedacted(platform2, json, e2.kind, e2.msg, redact2);
     return e2.code;
   }
 }
@@ -16251,11 +16285,7 @@ async function runClientVerb(platform2, version, parsed) {
   const redact2 = (text) => {
     let result = text;
     for (const secret of allSecrets) {
-      if (secret.length > 0) {
-        while (result.includes(secret)) {
-          result = result.replace(secret, "[REDACTED]");
-        }
-      }
+      if (secret.length > 0) result = result.replaceAll(secret, "[REDACTED]");
     }
     return result;
   };
@@ -16333,7 +16363,7 @@ async function runClientVerb(platform2, version, parsed) {
       return termExitCode;
     }
     if (err instanceof InputRequiredError) {
-      return handleInputRequired(platform2, conn, err, respondData, parsed.jsonOutput);
+      return handleInputRequired(platform2, conn, err, respondData, parsed.jsonOutput, redact2);
     }
     const e = classifyError(err);
     await writeErrRedacted(platform2, parsed.jsonOutput, e.kind, e.msg, redact2);
@@ -16736,7 +16766,7 @@ async function main(ctx) {
     packageDir: "/node_modules/@ai-ecoverse/mcpcat"
   });
   const args = ctx.argv.slice(1);
-  return run(platform2, "0.17.4", args);
+  return run(platform2, "0.17.6", args);
 }
 export {
   main as default

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/mcpcat",
-  "version": "0.17.4",
+  "version": "0.17.6",
   "description": "A curl for the Model Context Protocol",
   "type": "module",
   "license": "Apache-2.0",
@@ -61,15 +61,15 @@
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-bios": "1.33.1",
-    "@ai-ecoverse/slicc-kernel": "1.140.0",
-    "@ai-ecoverse/slicc-shared-web": "1.29.2",
+    "@ai-ecoverse/slicc-bios": "1.36.1",
+    "@ai-ecoverse/slicc-kernel": "1.141.2",
+    "@ai-ecoverse/slicc-shared-web": "1.29.8",
     "@biomejs/biome": "2.5.15",
     "@earendil-works/pi-codemode": "1.2.0",
     "@earendil-works/pi-mcp": "1.2.0",
     "@types/node": "26.6.5",
     "esbuild": "0.28.2",
-    "kernel-cert-new": "npm:@ai-ecoverse/slicc-kernel@1.140.0",
+    "kernel-cert-new": "npm:@ai-ecoverse/slicc-kernel@1.141.2",
     "lefthook": "2.2.2",
     "monocart-coverage-reports": "2.13.2",
     "proper-lockfile": "4.1.2",