@ai-ecoverse/slicc-agent 3.23.0 → 3.24.0

package/README.md

@@ -326,7 +326,7 @@ pi has no git integration and no changes list; pi coding-agent leaves that to th
   - `before` is the index version (`git show :<path>`) and `after` is the working file. Binary files and files over 1 MB get null for both, which spectrum shows as "no diff".
   - At most 200 files per repo are listed. There's no store of our own, and `agentId` is null, because git doesn't know which agent wrote a file.
 - **Without git,** `unavailable()` says git isn't installed and how to get it (`pnpm add -g @ai-ecoverse/wasm-git`). **With git but no repo,** it says to `git init` a folder under /home or clone one with slicc-node or the extension connected; cloning over HTTPS through the page alone fails. Seven doesn't preinstall git; the user or the agent installs it with that command.
-- **The `system` section** has a Git line. With `git` on PATH, it says local repositories work and that clone, fetch and push need slicc-node or the extension. Without it, it gives the agent `pnpm add -g @ai-ecoverse/wasm-git` to install it when needed. Seven doesn't preinstall git (Lars, 2026-10-09). The install line also names the other tested packages that aren't preinstalled: `@ai-ecoverse/wasi-esbuild` (esbuild), `@ai-ecoverse/wasi-typescript` (tsc), `@ai-ecoverse/wasi-biome` (biome), and for PDFs `@ai-ecoverse/wasm-poppler` (pdftotext and friends) and `@ai-ecoverse/wasm-qpdf` (qpdf).
+- **The `system` section** has a Git line. With `git` on PATH, it says local repositories work and that clone, fetch and push need slicc-node or the extension. Without it, it gives the agent `pnpm add -g @ai-ecoverse/wasm-git` to install it when needed. Seven doesn't preinstall git (Lars, 2026-10-09). The install line also names the other tested packages that aren't preinstalled: `@ai-ecoverse/wasi-esbuild` (esbuild), `@ai-ecoverse/wasi-typescript` (tsc), `@ai-ecoverse/wasi-biome` (biome), for PDFs `@ai-ecoverse/wasm-poppler` (pdftotext and friends) and `@ai-ecoverse/wasm-qpdf` (qpdf), and for Python `@ai-ecoverse/wasix-python` (python3, pip) with `@ai-ecoverse/wasix-uv-shim@0.1.0-1` (a uv-compatible shim, pinned while the package is new; only `uv run` uses the venv until kernel#168).
 - **Which repos:**
   - the repo of each live agent's cwd (`git rev-parse --show-toplevel`), with the active cone's first;
   - plus a scan of /home and each /mnt/<name>, three levels deep and at most 200 directories per level, skipping node_modules and dot-directories.
@@ -367,7 +367,7 @@ The built-in `sprinkles` skill teaches the files, the bridge and the command.
 
 ## The kernel
 
-`@ai-ecoverse/slicc-kernel` is a peer dependency (`>=1.26.3 <2`; older kernels have an IPv6-to-loopback security bug): the agent only calls `attachKernel`, the client end of the page kernel's port, so it must match the kernel the page runs. Seven chooses that version: slicc-bios pins the certified kernel next to the agent in `src/packages/agent/package.json`, and pnpm fills the peer from that pin. The devDependency is the lowest certified kernel the range allows (1.26.3), and the unit and integration tests run on it. A second CI job reruns the integration tests on the newest certified kernel (`NEWEST_CERTIFIED_KERNEL` in `.github/workflows/ci.yml`). Today both are 1.26.3; the second job moves by hand to each newer certified kernel, so both ends of the range are tested. If the port protocol ever breaks within 1.x, a patch release narrows the upper bound. Renovate opens PRs for the kernel, `wasi-pnpm`, the `wasm-*` packages and `slicc-cdp` but never merges them, because they move only after the homescoop coordinator certifies them.
+`@ai-ecoverse/slicc-kernel` is a peer dependency (`>=1.26.3 <2`; older kernels have an IPv6-to-loopback security bug): the agent only calls `attachKernel`, the client end of the page kernel's port, so it must match the kernel the page runs. Seven chooses that version: slicc-bios pins the certified kernel next to the agent in `src/packages/agent/package.json`, and pnpm fills the peer from that pin. The devDependency is the lowest certified kernel the range allows (1.26.3), and the unit and integration tests run on it. A second CI job reruns the integration tests on the newest certified kernel (`NEWEST_CERTIFIED_KERNEL` in `.github/workflows/ci.yml`). Today the floor is 1.26.3 and the newest certified kernel 1.26.6; the second job moves by hand to each newer certified kernel, so both ends of the range are tested. If the port protocol ever breaks within 1.x, a patch release narrows the upper bound. Renovate opens PRs for the kernel, `wasi-pnpm`, the `wasm-*` packages and `slicc-cdp` but never merges them, because they move only after the homescoop coordinator certifies them.
 
 ## Patched dependencies
 

package/dist/system.js

@@ -48,7 +48,7 @@ function systemSection(facts) {
     `You are SLICC's agent in seven: slicc-agent ${facts.version}, installed in /opt/agent. Your bash runs on the page's shared slicc-kernel, a WebAssembly sandbox in the user's browser, not on a server or the user's machine.`,
     "Files: / is the browser's private file system (OPFS). Work in /home and /tmp. /os and /opt are the system; change them only when asked.",
     `Commands on PATH: ${facts.commands.join(" ") || "none found"}.`,
-    "Install command-line tools with `pnpm add -g <package>`. There is no ipk. Tested packages that aren't preinstalled: `@ai-ecoverse/wasm-git` (git), `@ai-ecoverse/wasi-esbuild` (esbuild), `@ai-ecoverse/wasi-typescript` (tsc, TypeScript 7) and `@ai-ecoverse/wasi-biome` (biome: check, format, lint). PDFs: `@ai-ecoverse/wasm-poppler` (pdftotext, pdfinfo, pdftoppm, pdfimages, pdfunite, pdfseparate) and `@ai-ecoverse/wasm-qpdf` (qpdf: merge, split, rotate, encrypt).",
+    "Install command-line tools with `pnpm add -g <package>`. There is no ipk. Tested packages that aren't preinstalled: `@ai-ecoverse/wasm-git` (git), `@ai-ecoverse/wasi-esbuild` (esbuild), `@ai-ecoverse/wasi-typescript` (tsc, TypeScript 7) and `@ai-ecoverse/wasi-biome` (biome: check, format, lint). PDFs: `@ai-ecoverse/wasm-poppler` (pdftotext, pdfinfo, pdftoppm, pdfimages, pdfunite, pdfseparate) and `@ai-ecoverse/wasm-qpdf` (qpdf: merge, split, rotate, encrypt). Python: `@ai-ecoverse/wasix-python` (python3, pip); `@ai-ecoverse/wasix-uv-shim@0.1.0-1` adds `uv` (a shim over pip and venv, not Astral's uv: venv, pip, run, init, add, remove, sync), and only `uv run` uses the venv for now.",
     `Network: requests go through ${facts.transport}. localhost and 127.0.0.1 are this sandbox's own loopback, not the user's computer.`,
     ...facts.browser ? [
       `Browser: ${facts.commands.includes("curlwright") ? "playwright-cli and curlwright drive" : "playwright-cli drives"} the user's own browser through the SLICC extension, with their logins. Read the browser skill before you use it.`

package/dist/system.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/system.ts"],
-  "sourcesContent": ["import type { KernelClient } from './kernel/client.ts';\nimport type { Transport } from './net.ts';\n\nexport interface SystemFacts {\n  version: string;\n  commands: string[];\n  transport: string;\n  browser?: boolean;\n}\n\nconst LIST_PATH = 'IFS=:; for d in $PATH; do [ -d \"$d\" ] && ls -1 \"$d\"; done';\nconst RUNTIMES = ['node', 'python3'];\n\nexport async function commandsOnPath(client: KernelClient): Promise<string[]> {\n  const decoder = new TextDecoder();\n  let out = '';\n  try {\n    const process = await client.spawn(['bash', '-c', LIST_PATH], {\n      onStdout: (bytes) => {\n        out += decoder.decode(bytes, { stream: true });\n      },\n    });\n    await process.exited;\n  } catch {\n    return [];\n  }\n  const names = out.split('\\n').map((name) => name.trim());\n  return [...new Set(names.filter(Boolean))].sort();\n}\n\nconst BROWSER = '[ -n \"$SLICC_CDP_URL\" ] && command -v playwright-cli >/dev/null';\n\nexport async function browserConnected(client: KernelClient): Promise<boolean> {\n  try {\n    const process = await client.spawn(['bash', '-c', BROWSER], {});\n    return (await process.exited) === 0;\n  } catch {\n    return false;\n  }\n}\n\nexport function transportName(transport: Transport | undefined): string {\n  const traits = transport?.traits;\n  if (traits?.crossOrigin === 'cors') {\n    return \"the page's own fetch, so only servers that allow CORS answer\";\n  }\n  if (traits?.manualRedirects) return 'a local proxy (slicc-node) that fetches without CORS';\n  return 'a relay that fetches without CORS';\n}\n\nexport async function agentVersion(\n  fetcher: (url: URL) => Promise<Response>,\n  url = new URL('../package.json', import.meta.url)\n): Promise<string> {\n  try {\n    const response = await fetcher(url);\n    const manifest = response.ok ? ((await response.json()) as { version?: string }) : {};\n    return manifest.version ?? 'unknown';\n  } catch {\n    return 'unknown';\n  }\n}\n\nexport function systemSection(facts: SystemFacts): string {\n  const missing = RUNTIMES.filter((name) => !facts.commands.includes(name));\n  return [\n    `You are SLICC's agent in seven: slicc-agent ${facts.version}, installed in /opt/agent. Your bash runs on the page's shared slicc-kernel, a WebAssembly sandbox in the user's browser, not on a server or the user's machine.`,\n    \"Files: / is the browser's private file system (OPFS). Work in /home and /tmp. /os and /opt are the system; change them only when asked.\",\n    `Commands on PATH: ${facts.commands.join(' ') || 'none found'}.`,\n    \"Install command-line tools with `pnpm add -g <package>`. There is no ipk. Tested packages that aren't preinstalled: `@ai-ecoverse/wasm-git` (git), `@ai-ecoverse/wasi-esbuild` (esbuild), `@ai-ecoverse/wasi-typescript` (tsc, TypeScript 7) and `@ai-ecoverse/wasi-biome` (biome: check, format, lint). PDFs: `@ai-ecoverse/wasm-poppler` (pdftotext, pdfinfo, pdftoppm, pdfimages, pdfunite, pdfseparate) and `@ai-ecoverse/wasm-qpdf` (qpdf: merge, split, rotate, encrypt).\",\n    `Network: requests go through ${facts.transport}. localhost and 127.0.0.1 are this sandbox's own loopback, not the user's computer.`,\n    ...(facts.browser\n      ? [\n          `Browser: ${facts.commands.includes('curlwright') ? 'playwright-cli and curlwright drive' : 'playwright-cli drives'} the user's own browser through the SLICC extension, with their logins. Read the browser skill before you use it.`,\n        ]\n      : []),\n    facts.commands.includes('git')\n      ? 'Git: local repositories work (init, add, commit, status, diff, restore, branch, checkout, log). Clone, fetch and push over HTTPS need slicc-node or the SLICC extension; through the page alone they fail with a CORS or 502 error.'\n      : 'Git: not installed. When you need it, install it with `pnpm add -g @ai-ecoverse/wasm-git`.',\n    `Not here yet: ${[...missing, ...(facts.browser ? [] : ['a browser or CDP tool']), 'GitHub credentials'].join(', ')}.`,\n  ].join('\\n');\n}\n\nexport async function kernelBoot(client: KernelClient): Promise<string | null> {\n  const decoder = new TextDecoder();\n  let out = '';\n  try {\n    const process = await client.spawn(['cat', '/proc/stat'], {\n      onStdout: (bytes) => {\n        out += decoder.decode(bytes, { stream: true });\n      },\n    });\n    await process.exited;\n  } catch {\n    return null;\n  }\n  return /^btime (\\d+)$/m.exec(out)?.[1] ?? null;\n}\n"],
+  "sourcesContent": ["import type { KernelClient } from './kernel/client.ts';\nimport type { Transport } from './net.ts';\n\nexport interface SystemFacts {\n  version: string;\n  commands: string[];\n  transport: string;\n  browser?: boolean;\n}\n\nconst LIST_PATH = 'IFS=:; for d in $PATH; do [ -d \"$d\" ] && ls -1 \"$d\"; done';\nconst RUNTIMES = ['node', 'python3'];\n\nexport async function commandsOnPath(client: KernelClient): Promise<string[]> {\n  const decoder = new TextDecoder();\n  let out = '';\n  try {\n    const process = await client.spawn(['bash', '-c', LIST_PATH], {\n      onStdout: (bytes) => {\n        out += decoder.decode(bytes, { stream: true });\n      },\n    });\n    await process.exited;\n  } catch {\n    return [];\n  }\n  const names = out.split('\\n').map((name) => name.trim());\n  return [...new Set(names.filter(Boolean))].sort();\n}\n\nconst BROWSER = '[ -n \"$SLICC_CDP_URL\" ] && command -v playwright-cli >/dev/null';\n\nexport async function browserConnected(client: KernelClient): Promise<boolean> {\n  try {\n    const process = await client.spawn(['bash', '-c', BROWSER], {});\n    return (await process.exited) === 0;\n  } catch {\n    return false;\n  }\n}\n\nexport function transportName(transport: Transport | undefined): string {\n  const traits = transport?.traits;\n  if (traits?.crossOrigin === 'cors') {\n    return \"the page's own fetch, so only servers that allow CORS answer\";\n  }\n  if (traits?.manualRedirects) return 'a local proxy (slicc-node) that fetches without CORS';\n  return 'a relay that fetches without CORS';\n}\n\nexport async function agentVersion(\n  fetcher: (url: URL) => Promise<Response>,\n  url = new URL('../package.json', import.meta.url)\n): Promise<string> {\n  try {\n    const response = await fetcher(url);\n    const manifest = response.ok ? ((await response.json()) as { version?: string }) : {};\n    return manifest.version ?? 'unknown';\n  } catch {\n    return 'unknown';\n  }\n}\n\nexport function systemSection(facts: SystemFacts): string {\n  const missing = RUNTIMES.filter((name) => !facts.commands.includes(name));\n  return [\n    `You are SLICC's agent in seven: slicc-agent ${facts.version}, installed in /opt/agent. Your bash runs on the page's shared slicc-kernel, a WebAssembly sandbox in the user's browser, not on a server or the user's machine.`,\n    \"Files: / is the browser's private file system (OPFS). Work in /home and /tmp. /os and /opt are the system; change them only when asked.\",\n    `Commands on PATH: ${facts.commands.join(' ') || 'none found'}.`,\n    \"Install command-line tools with `pnpm add -g <package>`. There is no ipk. Tested packages that aren't preinstalled: `@ai-ecoverse/wasm-git` (git), `@ai-ecoverse/wasi-esbuild` (esbuild), `@ai-ecoverse/wasi-typescript` (tsc, TypeScript 7) and `@ai-ecoverse/wasi-biome` (biome: check, format, lint). PDFs: `@ai-ecoverse/wasm-poppler` (pdftotext, pdfinfo, pdftoppm, pdfimages, pdfunite, pdfseparate) and `@ai-ecoverse/wasm-qpdf` (qpdf: merge, split, rotate, encrypt). Python: `@ai-ecoverse/wasix-python` (python3, pip); `@ai-ecoverse/wasix-uv-shim@0.1.0-1` adds `uv` (a shim over pip and venv, not Astral's uv: venv, pip, run, init, add, remove, sync), and only `uv run` uses the venv for now.\",\n    `Network: requests go through ${facts.transport}. localhost and 127.0.0.1 are this sandbox's own loopback, not the user's computer.`,\n    ...(facts.browser\n      ? [\n          `Browser: ${facts.commands.includes('curlwright') ? 'playwright-cli and curlwright drive' : 'playwright-cli drives'} the user's own browser through the SLICC extension, with their logins. Read the browser skill before you use it.`,\n        ]\n      : []),\n    facts.commands.includes('git')\n      ? 'Git: local repositories work (init, add, commit, status, diff, restore, branch, checkout, log). Clone, fetch and push over HTTPS need slicc-node or the SLICC extension; through the page alone they fail with a CORS or 502 error.'\n      : 'Git: not installed. When you need it, install it with `pnpm add -g @ai-ecoverse/wasm-git`.',\n    `Not here yet: ${[...missing, ...(facts.browser ? [] : ['a browser or CDP tool']), 'GitHub credentials'].join(', ')}.`,\n  ].join('\\n');\n}\n\nexport async function kernelBoot(client: KernelClient): Promise<string | null> {\n  const decoder = new TextDecoder();\n  let out = '';\n  try {\n    const process = await client.spawn(['cat', '/proc/stat'], {\n      onStdout: (bytes) => {\n        out += decoder.decode(bytes, { stream: true });\n      },\n    });\n    await process.exited;\n  } catch {\n    return null;\n  }\n  return /^btime (\\d+)$/m.exec(out)?.[1] ?? null;\n}\n"],
   "mappings": "AAUA,MAAM,YAAY;AAClB,MAAM,WAAW,CAAC,QAAQ,SAAS;AAEnC,eAAsB,eAAe,QAAyC;AAC5E,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,MAAM;AACV,MAAI;AACF,UAAM,UAAU,MAAM,OAAO,MAAM,CAAC,QAAQ,MAAM,SAAS,GAAG;AAAA,MAC5D,UAAU,CAAC,UAAU;AACnB,eAAO,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAAA,MAC/C;AAAA,IACF,CAAC;AACD,UAAM,QAAQ;AAAA,EAChB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,QAAM,QAAQ,IAAI,MAAM,IAAI,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;AACvD,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK;AAClD;AAEA,MAAM,UAAU;AAEhB,eAAsB,iBAAiB,QAAwC;AAC7E,MAAI;AACF,UAAM,UAAU,MAAM,OAAO,MAAM,CAAC,QAAQ,MAAM,OAAO,GAAG,CAAC,CAAC;AAC9D,WAAQ,MAAM,QAAQ,WAAY;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,cAAc,WAA0C;AACtE,QAAM,SAAS,WAAW;AAC1B,MAAI,QAAQ,gBAAgB,QAAQ;AAClC,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,gBAAiB,QAAO;AACpC,SAAO;AACT;AAEA,eAAsB,aACpB,SACA,MAAM,IAAI,IAAI,mBAAmB,YAAY,GAAG,GAC/B;AACjB,MAAI;AACF,UAAM,WAAW,MAAM,QAAQ,GAAG;AAClC,UAAM,WAAW,SAAS,KAAO,MAAM,SAAS,KAAK,IAA8B,CAAC;AACpF,WAAO,SAAS,WAAW;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,cAAc,OAA4B;AACxD,QAAM,UAAU,SAAS,OAAO,CAAC,SAAS,CAAC,MAAM,SAAS,SAAS,IAAI,CAAC;AACxE,SAAO;AAAA,IACL,+CAA+C,MAAM,OAAO;AAAA,IAC5D;AAAA,IACA,qBAAqB,MAAM,SAAS,KAAK,GAAG,KAAK,YAAY;AAAA,IAC7D;AAAA,IACA,gCAAgC,MAAM,SAAS;AAAA,IAC/C,GAAI,MAAM,UACN;AAAA,MACE,YAAY,MAAM,SAAS,SAAS,YAAY,IAAI,wCAAwC,uBAAuB;AAAA,IACrH,IACA,CAAC;AAAA,IACL,MAAM,SAAS,SAAS,KAAK,IACzB,wOACA;AAAA,IACJ,iBAAiB,CAAC,GAAG,SAAS,GAAI,MAAM,UAAU,CAAC,IAAI,CAAC,uBAAuB,GAAI,oBAAoB,EAAE,KAAK,IAAI,CAAC;AAAA,EACrH,EAAE,KAAK,IAAI;AACb;AAEA,eAAsB,WAAW,QAA8C;AAC7E,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,MAAM;AACV,MAAI;AACF,UAAM,UAAU,MAAM,OAAO,MAAM,CAAC,OAAO,YAAY,GAAG;AAAA,MACxD,UAAU,CAAC,UAAU;AACnB,eAAO,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAAA,MAC/C;AAAA,IACF,CAAC;AACD,UAAM,QAAQ;AAAA,EAChB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,iBAAiB,KAAK,GAAG,IAAI,CAAC,KAAK;AAC5C;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-agent",
-  "version": "3.23.0",
+  "version": "3.24.0",
   "description": "SLICC's agent core on pi durable: an agent worker, session storage, remoting and pi extensions",
   "type": "module",
   "license": "Apache-2.0",