@ai-ecoverse/slicc-bios 1.10.0 → 1.11.0

package/README.md

@@ -168,14 +168,16 @@ The Files panel lists `/opt/grammars/node_modules` but doesn't scan it.
 
 #### Optional packages
 
-Below the system rows, Install / Update offers **Optional packages** (spectrum ≥ 1.42.0): tools that seven doesn't preinstall, each at the version the homescoop coordinator certified. The catalog is [`src/packages/optional/`](src/packages/optional/): `package.json` pins each package exactly, `package-lock.json` (made with `npm install --package-lock-only --ignore-scripts`, never installed) holds its integrity, and `catalog.json` gives its id, label, description, commands, tarball size and `requires`. A test keeps the three in step. Today it offers git, OpenSSH, Python, uv, Node.js (slicc-jsh's `node` and `jsh`), `sliccy:browser` for `.jsh` scripts, Ruby, Perl, esbuild, TypeScript, Biome, the PDF tools (poppler), qpdf, rsync, buf, screen, SQLite, dig, websocat, GnuPG and fnox.
+Below the system rows, Install / Update offers **Optional packages** (spectrum ≥ 1.42.0): tools that seven doesn't preinstall, each at the version the homescoop coordinator certified. The catalog is [`src/packages/optional/`](src/packages/optional/): `package.json` pins each package exactly, `package-lock.json` (made with `npm install --package-lock-only --ignore-scripts`, never installed) holds its integrity, and `catalog.json` gives its id, label, description, commands, tarball size and `requires`. A test keeps the three in step. Today it offers git, the GitHub CLI, OpenSSH, `slicc` (see [Sevens this kernel follows](#network)), Python, Node.js (slicc-jsh's `node` and `jsh`), `sliccy:browser` for `.jsh` scripts, Ruby, Perl, Biome, the PDF tools (poppler), qpdf, rsync, screen, SQLite, dig, websocat, GnuPG and fnox.
 
 - **Install** runs `pnpm add -g <package>@<version>` in the page's kernel, as a user would, under the Web Lock `slicc-optional`, so the commands work at once in every open shell. pnpm 12 gives each global add its own project under `$PNPM_HOME/global/v11/`; bios reads `PNPM_HOME` from the kernel's environment. Afterwards `os/packages.js` reads that project's `pnpm-lock.yaml`: every package in it, the one added and each dependency, must be a version in the catalog's lockfile or the base set's, with that integrity. homescoop pins `@ai-ecoverse/*` dependencies exactly (uv → Python, git → bash), so the catalog's lockfile names them all. Anything else, a dependency pnpm resolved to another version included, removes the package again and fails the row with *This version doesn't match the tested build*. An entry's `requires` (uv needs Python) are installed first.
 - **State** comes from pnpm's global projects, not from a list of bios's own, so a package installed by hand shows as installed with its version. One older than the catalog's offers **Update**, which adds the catalog's version; one at or above it offers **Remove**. bios never downgrades.
-- **Remove** runs `pnpm remove -g <package>`. It asks first only when another installed entry needs it (*Remove Python? uv needs it and stops working until Python is back.*, accent); otherwise it doesn't ask, since pnpm's global projects hold no user data and the package can be installed again. A cancelled confirm changes nothing.
+- **Remove** runs `pnpm remove -g <package>`. It asks first only when another installed entry needs it (*Remove Node.js (jsh)? Browser for jsh scripts needs it and stops working until Node.js (jsh) is back.*, accent); otherwise it doesn't ask, since pnpm's global projects hold no user data and the package can be installed again. A cancelled confirm changes nothing.
 - **Readable by everyone:** after every pnpm install of `/opt/agent`, `/opt/grammars` and an optional project in `/opt/slicc`, bios runs `chmod -R a+rX` on that tree, as root. pnpm writes some files `0600`, such as `node_modules/.pnpm-workspace-state-v1.json`, and with kernel users every user must be able to read seven's installed packages. An install from before this runs the same `chmod` once at its next check, marked by `var/lib/slicc/<project>/readable`.
 - **Failures** lead with one sentence and keep pnpm's output, starting with the package and version, under *Install log*, with **Retry**.
-- **Project entries** (`kind: "project"`): **Python data tools** (numpy, pandas, scipy and matplotlib, about 270 MB on disk) can't be a global add. pnpm 12 gives each global add its own isolated project, so every py-* package would carry its own Python (about 1 GB in total), and Python wouldn't find the packages. So the entry is a pnpm project of its own in [`src/packages/optional/projects/pydata/`](src/packages/optional/projects/pydata/):
+- **Withdrawn and kept as exceptions** (homescoop#858/#859, #864): uv, esbuild, tsc and buf are withdrawn until attested rebuilds. They're retired rows (*No longer offered*, with Remove for an earlier install), and their certs lines are gone. Instead, use `pip` for uv's work for now (uv returns as `@ai-ecoverse/wasi-uv`, Astral's uv, once that's certified), and install esbuild and typescript straight from npm with `pnpm add -g`; buf has no stand-in. **git** and **gh** stay as recorded supply-chain exceptions until their attested rebuilds: their `certs.json` entries carry an `exception` field, which `pins.test.mjs` lists, and any other uncertified pin still fails it.
+- **Python data tools are withdrawn** until numpy and pandas come from verified CI builds (homescoop#826, #730): py-numpy 2.3.2-4 to -10 and py-pandas 2.3.2-5 to -11 came from un-attested local builds, so their certs lines are gone and the catalog has no `pydata` row or project. `retired.json` lists it as a retired `kind: "project"` entry, so an earlier install shows as installed with only **Remove**, which deletes the project, its `.pth` and its receipt. Plain Python stays. The project support below is unchanged for when it returns.
+- **Project entries** (`kind: "project"`): **Python data tools** (numpy, pandas, scipy and matplotlib, about 270 MB on disk) can't be a global add. pnpm 12 gives each global add its own isolated project, so every py-* package would carry its own Python (about 1 GB in total), and Python wouldn't find the packages. So the entry is a pnpm project of its own in `src/packages/optional/projects/pydata/`:
   - **Install:** bios writes the project to `/opt/slicc/pydata` and installs it with `pnpm install --frozen-lockfile`, so pnpm checks every integrity against the lockfile bios ships. Its `pnpm-workspace.yaml` overrides `@ai-ecoverse/wasix-python` to nothing, and the entry `requires` the catalog's Python, which runs it.
   - **How Python finds it:** bios writes `/opt/slicc/python/slicc-pydata.pth`, which lists each package's site-packages (from its `slicc.python.sitePackages`), next to a `sitecustomize.py` that adds that folder as a site directory. The page's kernel puts `/opt/slicc/python` on every process's `PYTHONPATH`, so `python3` imports the packages from any shell or agent, as any user. Python's own discovery only looks in its own project, so the `.pth` stays. A `.pth` that an earlier version wrote to `/root/.local` is moved there the next time the optional packages are listed. The kernel's environment reaches every process, whichever client or user starts it, `sudo` included. `python -I` and `python -E` ignore `PYTHONPATH`, so they don't see the data tools; that's a known gap.
   - **State and Remove:** a receipt in `var/lib/slicc/optional/pydata/` records the installed version. **Remove** deletes the project, the `.pth` and the receipt.
@@ -329,7 +331,7 @@ seven can also join a tailnet, with a patched build of Tailscale's wasm client (
     - **No agent:** with no agent running, or a slicc-agent without page-side webhooks, the delivery is dropped with a warning. The hub has already answered the sender `202`.
   - **Remote control (`agent`):** a linked CLI can prompt, watch and stop seven's agent (`slicc prompt`, `slicc watch`, `slicc abort`). The page offers cap `agent` to a CLI on this computer always, and to a remote device only after **Control** is turned on for it in Linked devices. That setting is kept per device certificate and cleared by unlinking it. Any other link's agent OPEN gets `EACCES`.
     - Each `OPEN { kind: 'agent', op }` goes to the agent of the tab that runs the kernel, on its active cone, through slicc-agent's `remoteControl`. `prompt` answers OPENED with how the prompt was delivered (or `RESET EBUSY` for `whenBusy: 'reject'` while busy), then streams NDJSON events from the prompt's own `user` event to its `end` line. A prompt over about 60 KiB comes as `length` bytes after an empty OPENED, and the first line then says how it was delivered. `watch` answers with the transcript `head` (and `gap` when `since` is gone), then streams events. `abort` answers `{ aborted }`.
-    - A CLI that goes away ends its stream but never aborts the run; aborting is explicit.
+    - A CLI that goes away ends its stream but never aborts the run; aborting is explicit. A `watch` the CLI half-closes right after OPENED, as slicc does, still ends at once when it is later reset or its link closes, so **Watching** clears without waiting for the agent's next event.
     - Linked devices lists every device that has linked, offline ones too, with its control setting, and shows **Prompting** or **Watching** while a CLI does, also in the header.
     - A device that reconnects replaces only its own process's link, so `slicc <join> prompt` doesn't drop that machine's `follow`. Control-only links (`caps: []`) get no `.slicc.internal` name and no exit.
   - **Folders (`fs`):** a CLI started with `--mount <path>[:<name>][:ro]` lists its folders in HELLO, and later in `OPEN { kind: 'mounts' }` updates; the page offers cap `mounts`. Each is a `hostfs` source named `<device>/<name>`, so `mount -t hostfs lars-mbp/proj /mnt/proj` mounts it, and nothing is mounted unless someone asks. A bare source with no `<device>/`, as slicc-node named its folders (`mount -t hostfs project /mnt/p`, or one remembered from then), is the folder of that name on the CLI linked on this computer, when exactly one local CLI shares one. The device's row in Linked devices lists its folders (`folders`, with a Read-only badge; spectrum ≥ 1.58.0): **Mount** (`mountFolder(source)`) mounts one at `/mnt/<device>/<name>` (a folder named `.` or `..` is never listed), and **Eject** (`ejectFolder(source)`) unmounts it. The Files panel's Mounted strip shows each `hostfs` mount's source (`mountInfo()`), so `/mnt/proj · lars-mbp/proj` reads as another computer's folder. A mounted linked folder stays with the CLI process it was first granted from (`slicc-os.link-sources`), even if that process comes back under another name. If that process isn't linked, the folder goes to whichever process has the name now, but only when no other process with the same host name shares a folder of that name; otherwise it waits. So a remembered `lars-mbp/proj` never lands on another process's `proj`. A remembered linked folder that is mounted again before its CLI is back stays `nomedium`, and fills in when the CLI links. The kernel's `hostfs` hook answers such a source with a `MessagePort` (slicc-kernel ≥ 1.54.9), and the page serves it with `serveHostfsPort` over `OPEN { kind: 'fs', mount, op, … }` streams: `list` collects its NDJSON, a read over 64 KiB and every write get their own channel, and `watch` streams the CLI's change events. A read-only kernel mount, or a read-only export, sends `readonly: true` on every OPEN. A link that drops makes the mount `nomedium` until the CLI is back; files that were open reopen by path and continue if the host didn't change them.
@@ -372,6 +374,14 @@ seven can also join a tailnet, with a patched build of Tailscale's wasm client (
       - **Chat (`pi`):** with View, the follower opens `OPEN { kind: 'pi' }` and gets the owner's agent, the same replicated chat a follower tab has. The owner bridges the stream to `owner.port({ readOnly, pages: false })` with slicc-agent's `bridgePort` (agent ≥ 3.32.0), read-only unless the device has Control, and without `pages`, so a follower's agent can't drive the owner's panels. The follower builds its `AgentConnection` with `linkEndpoint` and `connectAgent`, and spectrum's agent model on top. The stream carries slicc-agent's frames: a `u32` length, a `u8` tag (data, hello or close) and the payload. Without Control, a send, steer or stop is refused by the owner's agent with `EACCES`, and the chat shows that it watches only. Changing Control resets the stream, so the follower reconnects with the new access, and losing View resets it with `EACCES`. The follower installs `/opt/agent` itself, for `page.js` and the agent model, in a kernel it starts only for that install. Linked devices shows *Watching* while a follower's chat is open.
       - **Terminals (`terminal`):** with View and Terminal, the follower's Terminal panel opens shells in the owner's kernel. Each one is `OPEN { kind: 'terminal', cols, rows, cwd? }`, and the owner runs `bash -i` there with its own terminals' prompt, as the same user its own terminals use (root today, so Terminal is a root shell on the owner's SLICC), and answers OPENED `{ pid }`. Both directions then carry records, each a `u32` length, a `u8` type and a payload: `0` terminal bytes, `1` a resize as `{ cols, rows }` JSON, `2` a signal name (`INT`, `TSTP`, `QUIT`, `HUP`), and, from the owner only, `3` the shell's exit status as a decimal string, just before END. A bad record or size resets the stream with `EPROTO` or `EINVAL`. The follower's END closes the shell, and the owner ends the stream when the shell exits. Linked devices shows *Terminal open* while one runs (`terminals`), and turning Terminal or View off resets every open shell with `EACCES`.
       - **Names:** both sides call themselves `SLICC on <platform>` (`navigator.userAgentData.platform`). When two show the same name, the first four hex digits of the certificate fingerprint are added.
+    - **Sevens this kernel follows (the in-kernel `slicc`):** the optional `slicc` package (`@ai-ecoverse/wasi-slicc`, slicc-cli's client commands built for `wasip1`) runs `slicc <join-url> prompt|watch|abort` in seven's terminal against another seven's agent, as slicc-cli's README specifies in §1.4 and §5.16. The program never touches WebRTC, the hub or the join state: it reaches the page's **link facade** at `SLICC_LINK_URL` (`tcp://127.0.0.1:7400`), which `os/os.js` declares with `createKernel({ facades: { link: { port: 7400, hook } } })` (`os/facade.js`, slicc-kernel ≥ 1.90.0), and the page follows that seven's tray for it (`os/leaders.js`).
+      - **Who may:** only under kernel users `enforce`, and only root and members of `sudo` (cones), as the kernel's stamp on the connection says. A scoop gets `EACCES` and a `connect` denial in `denials.log`; under `off` and `report` everyone gets `EACCES`.
+      - **The facade:** one connection per stream, in records of a `u8` type (`1` control, `2` data, `3` end), a `u32` length and the payload. The first record is `{ v: 1, join, open }`, and the page answers `{ opened }` or `{ reset: 'ERRNO: message' }`. Only `kind: 'agent'` with `prompt`, `watch` or `abort` opens, with only the fields those take. A long prompt (`length`) is answered at once, read whole, and sent on with the length of what it became. After that, only a `reset` may come as control, and it passes on just its errno.
+      - **Secrets:** while the vault holds values, every outgoing prompt passes its scrubber (`redact`, on an agent-role port of the page's own), so a value leaves as its placeholder. While the scrubber is locked, the answer is `EACCES: unlock the vault to continue`.
+      - **The link:** the page attaches as runtime `slicc-link/1`, so the other seven treats it as a CLI: it needs **Allow remote control** for this device in its Linked devices, or the answer is `EACCES` with that hint (and the link is closed, so the next run sees a fresh HELLO). The page's HELLO has `caps: []` and a fresh `node`, it opens only `agent` streams, and it refuses every stream the other seven opens with `EACCES`. There is one link per join URL, dialled on demand (45 s per dial, with retries after 1, 2 and 5 s), kept while a stream uses it and closed 10 minutes after the last one ends.
+      - **Identity and state:** one certificate per hub origin in the IndexedDB database `slicc-follow`, under `link:<hub>`, apart from a follower tab's own. `localStorage` (`slicc-os.leaders`, the newest 16) keys each join URL's state by its SHA-256 and keeps only a moved tray's new URL. The join URL itself is never stored, logged or put in an error. An `UNLINKED` refusal deletes that hub's certificate and state, so the next run is a new device.
+      - **Refusals:** a join URL on a hub seven doesn't link through, a forged or expired one, and an unlink are `EACCES`, so `slicc` exits 3 with the reason. A tray that can't be reached in time is `ENOTCONN`, which `watch` retries.
+      - **Tests:** `test/integration/follow-slicc.test.mjs` runs the real `slicc` from the catalog as a cone in seven's terminal against a second seven's real agent over a fake tray hub: refused until Allow remote control, then prompt, watch and abort; a vault value scrubbed on the way out; a forged URL, another hub, a scoop and an unlinked device refused; and a fake leader whose `unlink`, `join`, `agent` and `kernel` OPENs are refused while it is followed.
     - **The tray:** its capabilities are kept in `localStorage` (`slicc-os.tray`), so the join URL survives reloads. A hub that forgot the tray gets a new one. The leader socket pings every 30 s and reconnects with backoff. Elsewhere (`localhost`, tests) the tray starts only when `localStorage['slicc-os.tray-hub']` names a hub.
   - **Kernel side:** the kernel gets one uplink and one route table, the union of what the active exits offer, pushed with `kernel.setRoutes`.
   - **Choosing an exit:** for each destination, an exit that claims it (a tailnet address or MagicDNS name) wins. Otherwise the default exit takes it: the one that offers a default route, for example Tailscale with an exit node. Otherwise HTTP stays on the picked transport, and raw connections are `ENETUNREACH`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",
@@ -42,7 +42,7 @@
     "format": "biome check --write ."
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc": "1.42.0",
+    "@ai-ecoverse/slicc": "1.42.4",
     "@ai-ecoverse/slicc-browsers": "1.7.6",
     "@ai-ecoverse/slicc-node": "2.5.1",
     "@ai-ecoverse/slicc-shared-web": "1.23.1",
@@ -56,7 +56,7 @@
     "monocart-coverage-reports": "2.13.2",
     "playwright-core": "1.64.0",
     "semantic-release": "25.0.9",
-    "wrangler": "4.148.0",
+    "wrangler": "4.149.0",
     "ws": "8.22.0"
   }
 }

package/src/packages/certs.json

@@ -7,22 +7,6 @@
     "integrity": "sha512-VKNEZPMgROHP+EYcuXBE3gHny+K29ATHsg+ruxoO97gDTJMoggbj3VhbsCnxnH27JD6m9tVkWdUAAsdDK1Sr+Q==",
     "sha256": "c4e2cee8f42acd79ed84d8ac88860a545031cc51c4f842e87aaed03c35c35f76"
   },
-  "@ai-ecoverse/py-cycler@0.12.1-5": {
-    "integrity": "sha512-6ikdLdovKfH4GKersS107LxKeo3KOGNuGxC++2RxauiBuXRL1Zk9ERFw16SdDpAeKSC40xshj+sfFbejNfVjQA==",
-    "sha256": "4f82499628639b01ae022afd8a84fa2f08079dbf6b51dc63539709a25e947016"
-  },
-  "@ai-ecoverse/py-cycler@0.12.1-6": {
-    "integrity": "sha512-S/nIJ7Vd7WDB+jFVY18Q1FJzWNK1Z7BAOdJ+05Tnwjh5CTM+GZA6TvBD3vpl0x/C9eq1l10aQeldhaFt4uh4Rg==",
-    "sha256": "ef2f42591ccc499337e66b83677912a3a710587bece849ef6b47b23ad0e961d6"
-  },
-  "@ai-ecoverse/py-fonttools@4.66.1-5": {
-    "integrity": "sha512-K0IoyfKlhZe7pWn/p/mK7GKGnu4+rsAkEpl/9If5mxGPw/04ys2o/ja5o1ZazltN1aN0JXqD0MQ59zl6d4EDrQ==",
-    "sha256": "c72b5900b5cf72f53e2f0f30f27f191003ab19660574099dbbb6ce3295f65324"
-  },
-  "@ai-ecoverse/py-fonttools@4.66.1-6": {
-    "integrity": "sha512-H+oUWs5RzTDIQVOOb4FKg9iBZiXIAa3NXLR2by92VdSnbob8YWAieDFdLMr1GpEc4WCkblAlnsGaOmo22BuhqQ==",
-    "sha256": "c8d0136d356cc41c32bf3034f1231b0cb1e6926ab23b5f9893c10a57345e17be"
-  },
   "@ai-ecoverse/py-kiwisolver@1.5.1-5": {
     "integrity": "sha512-iPlyNsJP6gLptvS6YwMm32zRCTrZiJjTDmJWDMtalQ6xNorR0Hvx+DW2WGaktsb92RuggbTQmJhrVY85j3UO2A==",
     "sha256": "b5eec3bb653874580f5e6ccb527e0a4fade7a9ccc98d62ae950d01e9a9873a7d"
@@ -31,38 +15,6 @@
     "integrity": "sha512-hNUM+rB+IEotVQ76pztZMY1nwcADXbnNZg2IQxKayfRTXbvkCaLjpfJlTxSNpC7xgVGqYyJZ5RGm9KJAA/D/QA==",
     "sha256": "ac43056dbe4b320a4b51ca2026eceec378d9ec401c8c41332b6329ad7231c65d"
   },
-  "@ai-ecoverse/py-matplotlib@3.11.2-6": {
-    "integrity": "sha512-uEjcO76jBkmnamlAQQ1RmgvDMX8DenfvuEb3G32aQO1jogjY5omfoQ9MMS4eMf9TnVtHK3dp6lvBbPRzuaFVhA==",
-    "sha256": "5f6e38db1047c5bb512350272068fbbef04b4740b22b665b26ccbe4f932a04bc"
-  },
-  "@ai-ecoverse/py-matplotlib@3.11.2-7": {
-    "integrity": "sha512-F9c37Mqst9w8xochnG7tfITKZCwWu6+oIeiAyYKbW+dI8KliWS6B3ShrFtIbE/Riunbw7HSkFRVDBAtQaj45tg==",
-    "sha256": "4d33e1e92be0848662679725825d8dce1ecf01bd4c7597b9125b0fa4daf2868f"
-  },
-  "@ai-ecoverse/py-numpy@2.3.2-8": {
-    "integrity": "sha512-WEScW3EQEEWo0JcvnR7v/9Qax4dYpCu95yAU5Xx/fDteNzpXUWIpkSjN8/xd2lRW+9mdenorBdEVCagGj56qNA==",
-    "sha256": "cf97ea1e463db39facfc5c8f00e1f72e2349de0830a3959990eeb1b1428c8af8"
-  },
-  "@ai-ecoverse/py-numpy@2.3.2-9": {
-    "integrity": "sha512-bTq0DxMlzCWroiKcVJw4WSd//AnHLS2BXMW95sKUpH8PkfDguB+gqcWjPkaej9lT8R5GgwVcekNN1R7PRX2ELw==",
-    "sha256": "50f36746d4e3773961c5aeaaef9186318d94a61c84517ae8a7d6ce5cdaca5587"
-  },
-  "@ai-ecoverse/py-packaging@26.3.0-5": {
-    "integrity": "sha512-syvuROdk7JkbVO9OYKeKZ+Wc2ib97K98rjOnNhK+1qb8+QefeDwMeix7kvL7ow82LRTkfoV0yVrzuNcOh7hxCA==",
-    "sha256": "e6b89f4b730a2d75a66d65e3791276b338c580850ecb6ed6dd34bec3dcd6059c"
-  },
-  "@ai-ecoverse/py-packaging@26.3.0-6": {
-    "integrity": "sha512-qn7qAxSYoIIng+Yk26Z/SzBu2wJfRWtN5zR1FR9jcfvSgxOhwi2yd4rnkB1pYzB/5vn0zPNRLQ5NsLdE/U1g0w==",
-    "sha256": "35e36090847bf0040cc06870794d22ca4ce91dc6da5676487edea6147813f3a8"
-  },
-  "@ai-ecoverse/py-pandas@2.3.2-10": {
-    "integrity": "sha512-zEUoIjsicPbuCbBNNlS12qfqaMcI3YfBxvmB+jawFU8Q2gUvrOiOaIyBa4pa5O5zGEAoh1S6s9YXadNHKTQbng==",
-    "sha256": "305a7394dc94dc3d0b5205e247a306c8a52e7136c6dde8e91fdfc9e2b3cca912"
-  },
-  "@ai-ecoverse/py-pandas@2.3.2-9": {
-    "integrity": "sha512-CLbOzjLivGA0jme1gdKV+BlcUkL/cffRyt34ugfnY77tA5WrK8HSA1BGH3hDfk9M00ZnpdtFslGSTlIQy1PV/w==",
-    "sha256": "22c7b67999343c8ebd6b2bae890871e386ac307196cf6d898080c61ae82fcbdd"
-  },
   "@ai-ecoverse/py-pillow@12.3.0-6": {
     "integrity": "sha512-oyuDfimQshBOfzQzWycwqxm4/a9FRojIHkPL/buwyyKE9zbGXdR7NRNFvmoNyOayNcgmUct0/sGXRVGXl4e7SA==",
     "sha256": "1e7811bc2f0c46ccef65588b8b323c2bf3e2cbcc7ad0ec7ec271edc7b8b4e134"
@@ -71,14 +23,6 @@
     "integrity": "sha512-dm7sI+Lj8MoAmRa/ZsDINSbbRc9UPx7hMxfhJpoT6z70h65Bkc9nHdkRyKawOqqoSJKyW2F3XwEq9X4uwDAV0A==",
     "sha256": "6aa31dfbbd35bd2edbe9e2cc51f1c9467c0fe707ea348e4b7b888ad1940dcf20"
   },
-  "@ai-ecoverse/py-pyparsing@3.3.3-5": {
-    "integrity": "sha512-RoiKQMo0Hdnp0snet9D1yLNY2Szq0ToAeT1m4TSPR8AooC2tlYiLgfJh5XXz7z+Fj5jzttW6Yx7KWd+ghUN96Q==",
-    "sha256": "2b2a9e8acd76e0b160bfdff288d2aa8a0055df5735d2e2945e2d596eb310068d"
-  },
-  "@ai-ecoverse/py-pyparsing@3.3.3-6": {
-    "integrity": "sha512-fHG4DtnxQ8N3bOKbJZ7SU5xzz7W9xzgw8580SLF6SHr5NRh1TJ/gYJFxpjKm9MlRx+Yk3ddvZY96W5ZpFyr0mA==",
-    "sha256": "fed54c6136fee0a471cc1156c7375e48d7df9b02da50ee9afa0cdaf2e0fa947f"
-  },
   "@ai-ecoverse/py-python-dateutil@2.9.0-post0.2": {
     "integrity": "sha512-RCa4x3MbuASOiDFxmiK6vmstyUvl8KffqQWJarGQa4MAHvtoT8tM3vl3iPTqbgGIPPUVfYSTy0bMKLNWx7uG9w==",
     "sha256": "2a355c9dd7e008d27970b8cd4eef641756bec74d61f393dae7452a7a55f61c48"
@@ -87,14 +31,6 @@
     "integrity": "sha512-fdYh2M/sSwFd8Y1rnUkZCbyFxkF5GB5otiSpJxNphLlFQa3kHDdU7dpwK6XGpJ3ZH2YvmNo01qY5eWbw+Gq9mw==",
     "sha256": "a9f47842a14d204823694ce95105ba9fa745a504e0dcaa9c9e8fd0e2ded27470"
   },
-  "@ai-ecoverse/py-scipy@1.18.0-10": {
-    "integrity": "sha512-kF/DI0T7qHI5TIkV63AUj8lMkBP1enUdkwkKQw78OZeRpLHP5riZX88bEW/tcdD3pUzMr1NAz5tsC4VRkBXvSw==",
-    "sha256": "b6ab14cdb98e3f3cf8670fda175a233ca91579efd8518d3e73de009434e5f85e"
-  },
-  "@ai-ecoverse/py-scipy@1.18.0-11": {
-    "integrity": "sha512-YUJ8Cvt31TQFScem5oXUVTDtE/8rgBnUGBGeNWZ+NtxNEbECErtd93o4DhYbYpWLVW5E/LE6KWqnThvBT73y+Q==",
-    "sha256": "517304bd038d28c49b9dd803bf8bec2b38c0befdb0ace63d3828e4b9d5b1205c"
-  },
   "@ai-ecoverse/py-six@1.17.0-2": {
     "integrity": "sha512-BNEgSp4l+y5dhmvKqqId7TO2Krchq/uw5vg/Q6bB6UKj+dfmr8ad42vGs4VFzTCnmqpGSgNRVg+TYeRi50t3yg==",
     "sha256": "53fd2ac9ba87baebe147fdfcbdd0ea0af9498f725d0d3702d960a209722779cc"
@@ -295,10 +231,6 @@
     "integrity": "sha512-hTKxTKNCvvfzXoVp30xFe8o/iB3cZ+FxjxYPv4kvyTuvG9i6InbGmZH/IgPsfRgMIL3g0TYIZQcFNlaOHjCTCg==",
     "sha256": "6e3c79623cb82067121e971e8fb4b879c64591cd756c89cea33a3487b7928c7f"
   },
-  "@ai-ecoverse/wasi-buf@1.73.0-2": {
-    "integrity": "sha512-zkfuvCUoe8VbKicU1GbHnGFRx6S3EI2laW37y8fJdVxfU22L2vyBLHUfCe2wVq/DDKzoQRz7OA8FxJ0xH4zIFQ==",
-    "sha256": "0499c7c91181aefd49e7b8838409f52241e344ef826a857ab131e41052a7753a"
-  },
   "@ai-ecoverse/wasi-dig@0.1.0-1": {
     "integrity": "sha512-jGCiTdo9CRNEH+iJ1+pl7IYvghP3A5curSXhr9WigKccKkTpyzhGMpoQRfRdNIeVcy1jgbgZOoDgA4GDJpdupQ==",
     "sha256": "7d173721a83c63cd2231111d063410f078999df12172dba5f0734f5fd8605205"
@@ -311,13 +243,10 @@
     "integrity": "sha512-puU9FN7kXKnlxaClZyqGd/m/229HHmVOA50+YExQBxzb1IrwPz/yS0Q1KDw0GnzC/glVLqu6jkSyc05LK1Fzyg==",
     "sha256": "3b6607de060ea30756807aa936774842b3bded9f463025c4d10732a8b474b175"
   },
-  "@ai-ecoverse/wasi-esbuild@0.28.2-2": {
-    "integrity": "sha512-Z6LXuBY2G9Po4cbEUFhbASSQ0ab5tdSHqtt1qDxNCgJFquAk525swjbTRVsj/j0v2iJVlq3Um1r2eYiYkGyLrQ==",
-    "sha256": "9d9ed5820c8b5e8cb1924d4f2756e8a9a59f82ed344508ff1704b213bc1199ca"
-  },
   "@ai-ecoverse/wasi-gh@2.102.0-1": {
     "integrity": "sha512-LX/ieGLiCbc7GMevt4hctBMaBYoK9jvrGKv+bRIOrs0qy5qdAm8E6RvZopm1Yaaa30d9as/hZbytDx9P2hKKjw==",
-    "sha256": "134acd4ccc67ba48e98102e5a6b4ee995a21eb87b628e2b683b750437319a631"
+    "sha256": "134acd4ccc67ba48e98102e5a6b4ee995a21eb87b628e2b683b750437319a631",
+    "exception": "unverifiable build (homescoop#864): kept because gh is core; bump when its reproduce check or a CI-built gh is certified"
   },
   "@ai-ecoverse/wasi-pnpm@12.9.1-8": {
     "integrity": "sha512-/3LRssC7T2t9HovusS9neuDg5+FNMhf90MkECauL1vZI/6BsQSadLyopnzn3ifYvY0LDC+Q8Src22oGCE+x1QA==",
@@ -331,9 +260,9 @@
     "integrity": "sha512-UYnMCCev7OQYAOGJ+sO/wbmZGg5mOlsaa8zJPtsrere2mrKHczvwMYmLnGeC1cqV3XW/AwRlMNk0j+S3pYUZ2A==",
     "sha256": "d7db54ccdade9379aff3fa90fd8b07bb48990d96097fde39691b0fa17bffe2fe"
   },
-  "@ai-ecoverse/wasi-typescript@7.0.2-1": {
-    "integrity": "sha512-FvlAbqh0x+1ckznDGMw3zy7Ttyu07ICtzg9fP0nTaeuP2VXJ8OJTCTKp1GxY+OZEc7t6qb48VuZTgazv7AnRVA==",
-    "sha256": "348de00af6350011d4e8f6cec8e8afd0de420a57c87249b6c260e604ebcdaccc"
+  "@ai-ecoverse/wasi-slicc@1.41.0": {
+    "integrity": "sha512-uPFR8MkUZ5IeDF6EHEehG74ZXpS5imlxZLSxqevMtbPTeNUHOMl+jTHo4INnPE6avtT1aY5LQnAPs1EM8Nh8Aw==",
+    "sha256": "15d742df5303089573122181d510d9e8700fff6c72cb0f3cbed650ecccabf3a9"
   },
   "@ai-ecoverse/wasix-gnupg@2.4.9-4": {
     "integrity": "sha512-O1V9mpj62CiI6gkKcD0YxBaHKRZ3pDLdwVB8hif2DBOin4bQsWaHgUn0P7jaoArIUjlD/Ak3Wk/u+wJawto/FA==",
@@ -387,14 +316,6 @@
     "integrity": "sha512-qTMGYM+x0738OjxXdBuzTDadzDJb1XrR92ER3V1Y7l5Rw6IHfHSalizKuO+Jo+zM6qAa81OAmoYe61NrI50jgg==",
     "sha256": "a2efdbf4a3977e7cb6e158b51d619772f92b062aef8dca32236ed7be261c2606"
   },
-  "@ai-ecoverse/wasix-uv-shim@0.1.0-5": {
-    "integrity": "sha512-EvvD894Dc8agRIvdhQ12nrXJIKtPOWXibiN/RYT7/SgtX4JyxrBfFxFa4Fo5VVnRp8u6QNSwN7FeGGpPryt6Jw==",
-    "sha256": "97cea396f18264d8358259ea9e103b9459c80da33c022a2593c3b0f3e469fdac"
-  },
-  "@ai-ecoverse/wasix-uv-shim@0.1.0-6": {
-    "integrity": "sha512-fEmBJVZ6DDWwogpP7mmgQGnOHqQ0VPCeuhJh/IkHsril59T5InBczSEZ2y8KY+Vl71lVQRKt5IJ5Au7JP4YpAQ==",
-    "sha256": "b3ecab2258cd2e07fc71d38358eeaff3818d366559b41d37eb5d9af3fc10f5b8"
-  },
   "@ai-ecoverse/wasix-websocat@4.0.0-alpha3-3": {
     "integrity": "sha512-D3iGDb+tx30SUwuONfyMfRDY9ZIJnEnF8A4X5r4P8uPXYUge9ZTL8wVTMW9x060kq0VN1w9mifNzDF6Lb1/fFA==",
     "sha256": "50062e7d8f0d05eb04735aa3f5fd71b561bd831d7426f5a4baa0621980c20a61"
@@ -443,10 +364,6 @@
     "integrity": "sha512-k8vezSs6/M0Mu/PxymsxvyM6lYym7nm+otzb+Epnw6dN9TiW/67Rtpk1YcbcLcIvqMIQpvUIzqVFhTBMIjoYMQ==",
     "sha256": "0fcb72f0a420af33d4e24370bc3c3284c6df78bda0d33dd544f71de1ee6729dd"
   },
-  "@ai-ecoverse/wasm-emscripten@6.0.9-16": {
-    "integrity": "sha512-Uknz71uTLXOuR/tj71tWXM6sXPY16yBPm5n1Bzn2nub46s5oGC0aBbXv+xn7lK1yS9sBl6XFN/oCzo4S+R/HKA==",
-    "sha256": "6f9bc18f388977f1959bf6f2c6ac47125e2aa40071550d399bc62cc58a33f9ba"
-  },
   "@ai-ecoverse/wasm-findutils@4.11.0-1": {
     "integrity": "sha512-MKF21UnnF5IQCkMcwGfjbdgsq3eb0vzW76HHAl4XGkdf46wPvjPsNFdqBcgavkPO5YGhukLwZLT2EawnKeV88A=="
   },
@@ -456,7 +373,8 @@
   },
   "@ai-ecoverse/wasm-git@2.55.0-15": {
     "integrity": "sha512-iN+it7A5iVGAV4UL7p2ulLcopY/7vGADgin7GTk+8JKC5bmE++BkGSbDCHvv+FTBe17KHVljzHQ5Mz8SZlMZ/A==",
-    "sha256": "42605553b8afb9471114530422cb3e69ec0e039cbac14aae16f17ace6e58c459"
+    "sha256": "42605553b8afb9471114530422cb3e69ec0e039cbac14aae16f17ace6e58c459",
+    "exception": "unverifiable build (homescoop#858/#859): kept because git is core; bump when its reproduce check or a CI-built git is certified"
   },
   "@ai-ecoverse/wasm-grep@3.12.0-3": {
     "integrity": "sha512-2zUPO95WUlvdlRp2EOZW4ABaTvPdmF6qwX/mSWke1r51vW1NXTsqx1G+EXRwNFPzeYcOih17GViA0XGA7ph3/g=="

package/src/packages/optional/catalog.json

@@ -20,6 +20,13 @@
     "commands": ["ssh", "scp", "sftp", "ssh-keygen", "ssh-add"],
     "size": 3355615
   },
+  "@ai-ecoverse/wasi-slicc": {
+    "id": "slicc",
+    "label": "slicc",
+    "description": "Prompts, watches and aborts another seven's agent from this terminal: slicc <join-url> prompt, watch or abort. For root and cones; the other seven must allow remote control from this one in its Linked devices.",
+    "commands": ["slicc"],
+    "size": 1324902
+  },
   "@ai-ecoverse/wasix-python": {
     "id": "python",
     "label": "Python",
@@ -27,23 +34,6 @@
     "commands": ["python3", "pip", "pip3"],
     "size": 49598727
   },
-  "@ai-ecoverse/wasix-uv-shim": {
-    "id": "uv",
-    "label": "uv",
-    "description": "Python projects and virtual environments, as a shim over pip and venv.",
-    "commands": ["uv"],
-    "requires": ["python"],
-    "size": 10326
-  },
-  "slicc-py-datatools": {
-    "id": "pydata",
-    "kind": "project",
-    "label": "Python data tools",
-    "description": "numpy, pandas, scipy and matplotlib for Python, about 270 MB on disk.",
-    "commands": [],
-    "requires": ["python"],
-    "size": 71955355
-  },
   "@ai-ecoverse/slicc-jsh": {
     "id": "node",
     "label": "Node.js (jsh)",
@@ -73,20 +63,6 @@
     "commands": ["perl", "cpan", "perldoc", "prove", "pod2html", "pod2man", "pod2text"],
     "size": 15533777
   },
-  "@ai-ecoverse/wasi-esbuild": {
-    "id": "esbuild",
-    "label": "esbuild",
-    "description": "Bundles and minifies JavaScript and TypeScript.",
-    "commands": ["esbuild"],
-    "size": 5093287
-  },
-  "@ai-ecoverse/wasi-typescript": {
-    "id": "tsc",
-    "label": "TypeScript",
-    "description": "The TypeScript 7 compiler and type checker.",
-    "commands": ["tsc"],
-    "size": 10814667
-  },
   "@ai-ecoverse/wasi-biome": {
     "id": "biome",
     "label": "Biome",
@@ -129,13 +105,6 @@
     "commands": ["sqlite3"],
     "size": 668627
   },
-  "@ai-ecoverse/wasi-buf": {
-    "id": "buf",
-    "label": "buf",
-    "description": "Lints, formats and builds Protocol Buffers.",
-    "commands": ["buf"],
-    "size": 16875828
-  },
   "@ai-ecoverse/wasm-screen": {
     "id": "screen",
     "label": "screen",

package/src/packages/optional/package-lock.json

@@ -9,18 +9,15 @@
         "@ai-ecoverse/slicc-jsh": "0.27.2",
         "@ai-ecoverse/sliccy-browser": "0.1.3",
         "@ai-ecoverse/wasi-biome": "2.5.15-4",
-        "@ai-ecoverse/wasi-buf": "1.73.0-2",
         "@ai-ecoverse/wasi-dig": "0.1.0-2",
-        "@ai-ecoverse/wasi-esbuild": "0.28.2-2",
         "@ai-ecoverse/wasi-fnox": "1.39.0-2",
         "@ai-ecoverse/wasi-gh": "2.102.0-1",
-        "@ai-ecoverse/wasi-typescript": "7.0.2-1",
+        "@ai-ecoverse/wasi-slicc": "1.41.0",
         "@ai-ecoverse/wasix-gnupg": "2.4.9-5",
         "@ai-ecoverse/wasix-openssh": "10.6.0-6",
         "@ai-ecoverse/wasix-perl": "5.42.0-11",
         "@ai-ecoverse/wasix-python": "3.14.2-20",
         "@ai-ecoverse/wasix-ruby": "3.4.11-12",
-        "@ai-ecoverse/wasix-uv-shim": "0.1.0-6",
         "@ai-ecoverse/wasix-websocat": "4.0.0-alpha3-3",
         "@ai-ecoverse/wasm-git": "2.55.0-15",
         "@ai-ecoverse/wasm-libheif": "1.23.6-1",
@@ -74,30 +71,12 @@
       "integrity": "sha512-hTKxTKNCvvfzXoVp30xFe8o/iB3cZ+FxjxYPv4kvyTuvG9i6InbGmZH/IgPsfRgMIL3g0TYIZQcFNlaOHjCTCg==",
       "license": "MIT OR Apache-2.0"
     },
-    "node_modules/@ai-ecoverse/wasi-buf": {
-      "version": "1.73.0-2",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasi-buf/-/wasi-buf-1.73.0-2.tgz",
-      "integrity": "sha512-zkfuvCUoe8VbKicU1GbHnGFRx6S3EI2laW37y8fJdVxfU22L2vyBLHUfCe2wVq/DDKzoQRz7OA8FxJ0xH4zIFQ==",
-      "license": "Apache-2.0",
-      "engines": {
-        "slicc-kernel": ">=1.30.0"
-      }
-    },
     "node_modules/@ai-ecoverse/wasi-dig": {
       "version": "0.1.0-2",
       "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasi-dig/-/wasi-dig-0.1.0-2.tgz",
       "integrity": "sha512-xpi0li0G2wD3ezIlHGcfDJ8Pd1/pT9w+dNU5U3vrx8XlkIAEnpjJRpPU/+sIDeBy81EauPd9H0M3ke33wZD53g==",
       "license": "Apache-2.0"
     },
-    "node_modules/@ai-ecoverse/wasi-esbuild": {
-      "version": "0.28.2-2",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasi-esbuild/-/wasi-esbuild-0.28.2-2.tgz",
-      "integrity": "sha512-Z6LXuBY2G9Po4cbEUFhbASSQ0ab5tdSHqtt1qDxNCgJFquAk525swjbTRVsj/j0v2iJVlq3Um1r2eYiYkGyLrQ==",
-      "license": "MIT",
-      "engines": {
-        "slicc-kernel": ">=1.30.0"
-      }
-    },
     "node_modules/@ai-ecoverse/wasi-fnox": {
       "version": "1.39.0-2",
       "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasi-fnox/-/wasi-fnox-1.39.0-2.tgz",
@@ -116,11 +95,14 @@
         "slicc-kernel": ">=1.30.0"
       }
     },
-    "node_modules/@ai-ecoverse/wasi-typescript": {
-      "version": "7.0.2-1",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasi-typescript/-/wasi-typescript-7.0.2-1.tgz",
-      "integrity": "sha512-FvlAbqh0x+1ckznDGMw3zy7Ttyu07ICtzg9fP0nTaeuP2VXJ8OJTCTKp1GxY+OZEc7t6qb48VuZTgazv7AnRVA==",
-      "license": "Apache-2.0"
+    "node_modules/@ai-ecoverse/wasi-slicc": {
+      "version": "1.41.0",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasi-slicc/-/wasi-slicc-1.41.0.tgz",
+      "integrity": "sha512-uPFR8MkUZ5IeDF6EHEehG74ZXpS5imlxZLSxqevMtbPTeNUHOMl+jTHo4INnPE6avtT1aY5LQnAPs1EM8Nh8Aw==",
+      "license": "Apache-2.0",
+      "engines": {
+        "slicc-kernel": ">=1.92.0"
+      }
     },
     "node_modules/@ai-ecoverse/wasix-gnupg": {
       "version": "2.4.9-5",
@@ -167,24 +149,6 @@
         "slicc-kernel": ">=1.44.0"
       }
     },
-    "node_modules/@ai-ecoverse/wasix-uv-shim": {
-      "version": "0.1.0-6",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasix-uv-shim/-/wasix-uv-shim-0.1.0-6.tgz",
-      "integrity": "sha512-fEmBJVZ6DDWwogpP7mmgQGnOHqQ0VPCeuhJh/IkHsril59T5InBczSEZ2y8KY+Vl71lVQRKt5IJ5Au7JP4YpAQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@ai-ecoverse/wasix-python": "3.14.2-16"
-      }
-    },
-    "node_modules/@ai-ecoverse/wasix-uv-shim/node_modules/@ai-ecoverse/wasix-python": {
-      "version": "3.14.2-16",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasix-python/-/wasix-python-3.14.2-16.tgz",
-      "integrity": "sha512-Ca0Gnv8bcxUvbQAc2OBt+47xgiQp8jmD9k+uyud+8Q7tc211l9gytTQLGgWCetCYycaXd3McmEfuuMe6NAkRiQ==",
-      "license": "PSF-2.0 AND GPL-3.0-or-later",
-      "engines": {
-        "slicc-kernel": ">=1.51.0"
-      }
-    },
     "node_modules/@ai-ecoverse/wasix-websocat": {
       "version": "4.0.0-alpha3-3",
       "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasix-websocat/-/wasix-websocat-4.0.0-alpha3-3.tgz",

package/src/packages/optional/package.json

@@ -6,18 +6,15 @@
     "@ai-ecoverse/slicc-jsh": "0.27.2",
     "@ai-ecoverse/sliccy-browser": "0.1.3",
     "@ai-ecoverse/wasi-biome": "2.5.15-4",
-    "@ai-ecoverse/wasi-buf": "1.73.0-2",
     "@ai-ecoverse/wasi-dig": "0.1.0-2",
-    "@ai-ecoverse/wasi-esbuild": "0.28.2-2",
     "@ai-ecoverse/wasi-fnox": "1.39.0-2",
     "@ai-ecoverse/wasi-gh": "2.102.0-1",
-    "@ai-ecoverse/wasi-typescript": "7.0.2-1",
+    "@ai-ecoverse/wasi-slicc": "1.41.0",
     "@ai-ecoverse/wasix-gnupg": "2.4.9-5",
     "@ai-ecoverse/wasix-openssh": "10.6.0-6",
     "@ai-ecoverse/wasix-perl": "5.42.0-11",
     "@ai-ecoverse/wasix-python": "3.14.2-20",
     "@ai-ecoverse/wasix-ruby": "3.4.11-12",
-    "@ai-ecoverse/wasix-uv-shim": "0.1.0-6",
     "@ai-ecoverse/wasix-websocat": "4.0.0-alpha3-3",
     "@ai-ecoverse/wasm-git": "2.55.0-15",
     "@ai-ecoverse/wasm-libheif": "1.23.6-1",