@ai-ecoverse/slicc-bios 1.11.1 → 1.12.0

package/README.md

@@ -81,8 +81,10 @@ The kernel runs with users on (slicc-kernel ≥ 1.81.0): files have owners and m
   - **Under `'report'`** nothing is protected, since protection has no report mode of its own. Installs already run as tagged writers from `/opt/slicc/base` with the clean config, and bios watches the six trees through the kernel (`fs.watch`, recursive). Each change made through the page's kernel outside bios's own installs goes to `denials.log` as `op: 'protect'`, `errno: 'EROFS'`: a write that `'enforce'` would refuse. The watch doesn't say which process wrote, so these lines have no user and no tag. Changes made outside the page's kernel (bios's install kernels, the page itself) aren't seen.
   - **Global packages** (`pnpm add -g` into `/usr/local/share/pnpm`) aren't protected and run untagged.
   - **A remembered mount** (`slicc-os.mounts`) at, under or above a protected path is dropped at boot under `'enforce'`, with a notice, *A remembered folder wasn’t mounted*.
-- **Sudo approvals:** the kernel's `approve` hook feeds `model.approvals`, spectrum's sudo dialog. It shows the resolved path and arguments, shell-quoted, the directory, the requester mapped from the tag, the target and *Always allow*. Every tab shows the request (`BroadcastChannel('slicc-approvals')`), and the first decision wins; the other tabs see *Answered in another tab*. *Always allow* is offered only for a command bios trusts to run the same way every time: the kernel's resolved path, whose real path and every directory above it are root's and not group- or other-writable (checked by a root `stat` when the request comes), that isn't a shell, interpreter or wrapper (`bash`, `python*`, `node`, `env`, `xargs`, `sudo`, `timeout`, `find -exec` and the like), doesn't write named files (`tee`, `cp`, `mv`, `chmod`, `dd`, `sed -i`, `tar -x`, `git`, `pnpm` and the like), whose operands are all absolute, inside none of `/tmp`, `/var/tmp`, `/home`, `/mnt`, `/scoops` and `/dev/shm`, and not user-writable (a file that isn't root's or is group- or other-writable, a directory above that is, or a missing path whose parent is), with no shell metacharacter in any argument, and which may not change the secret rules. Everything else gets *Allow once* only. A request that may change the secret rules never offers *Always allow* either. bios decides that at least as broadly as spectrum's dialog: it runs the dialog's own classifier (spectrum's exported `secretRules`; without it every command counts as one that may change them), its own path check (`/etc/fnox`, `/etc/slicc/secrets-policy.toml`, and for a command that isn't read-only `/`, `/etc`, `/etc/slicc`, a name with `fnox` or `secrets-policy`, a glob or `..`), and treats any `$`, backtick, quote or backslash in an argument, and any quoting or `cd` inside a `-c` script, as a possible change. For such a request bios sends `always: false`, and answers an `always` for it, from any tab, as `once`, so no `NOPASSWD` line is written for it.
+- **Sudo approvals through the agent** (slicc-agent ≥ 5.9.0): while the agent runs, the kernel's `approve` hook hands each request to the agent's `owner.approve(req, { signal, where })`. It becomes a `sudo` item in the agent's approvals, which every owner device answers with the same powers: this tab, other tabs, and linked followers with or without Control, *Always allow* included where bios offered it. bios sets `req.always` from the checks below, and turns an *Always* it didn't offer into *Allow once*. A request from a follower's shell names that device (`where`, "on <device>"), and each linked device's agent port is opened with `owner.port({ device })`, so the item records which device answered. The tab hands its own approvals port to `createAgentModel(connection, { approvals })`, so `model.approvals` lists both sets. When the agent can't take a request (it rejects with `EAGAIN`: released, restarting or an older worker) or isn't running, bios's own dialog below asks instead.
+- **Sudo approvals in bios's dialog:** the kernel's `approve` hook feeds `model.approvals`, spectrum's sudo dialog. It shows the resolved path and arguments, shell-quoted, the directory, the requester mapped from the tag, the target and *Always allow*. Every tab shows the request (`BroadcastChannel('slicc-approvals')`), and the first decision wins; the other tabs see *Answered in another tab*. *Always allow* is offered only for a command bios trusts to run the same way every time: the kernel's resolved path, whose real path and every directory above it are root's and not group- or other-writable (checked by a root `stat` when the request comes), that isn't a shell, interpreter or wrapper (`bash`, `python*`, `node`, `env`, `xargs`, `sudo`, `timeout`, `find -exec` and the like), doesn't write named files (`tee`, `cp`, `mv`, `chmod`, `dd`, `sed -i`, `tar -x`, `git`, `pnpm` and the like), whose operands are all absolute, inside none of `/tmp`, `/var/tmp`, `/home`, `/mnt`, `/scoops` and `/dev/shm`, and not user-writable (a file that isn't root's or is group- or other-writable, a directory above that is, or a missing path whose parent is), with no shell metacharacter in any argument, and which may not change the secret rules. Everything else gets *Allow once* only. A request that may change the secret rules never offers *Always allow* either. bios decides that at least as broadly as spectrum's dialog: it runs the dialog's own classifier (spectrum's exported `secretRules`; without it every command counts as one that may change them), its own path check (`/etc/fnox`, `/etc/slicc/secrets-policy.toml`, and for a command that isn't read-only `/`, `/etc`, `/etc/slicc`, a name with `fnox` or `secrets-policy`, a glob or `..`), and treats any `$`, backtick, quote or backslash in an argument, and any quoting or `cd` inside a `-c` script, as a possible change. For such a request bios sends `always: false`, and answers an `always` for it, from any tab, as `once`, so no `NOPASSWD` line is written for it.
 - **Denials:** denials under `'report'` and `'enforce'` go to `/var/log/slicc/denials.log`, one JSON line per distinct `(uid, tag, op, path, errno)` with its `count`, `first` and last `time`, plus `user`, `tag` (the process's tag, `null` for an untagged one) and `mode`. They're written within a quarter of a second, at every 100 distinct denials, and when the page is hidden (`visibilitychange`). When the page goes away (`pagehide`), the ones not yet written are kept in `localStorage` (`slicc.denials.spool.*`), and the next page writes them once its kernel is up. The log rotates to `denials.log.1` at 1 MiB. `slicc-denials` (in `/usr/local/bin`) sums up the log and its `.1`: the total and time span, then counts by tag kind (`agent`, `user`, `untagged`), op, errno and path prefix; `--json` prints the same as one object.
+- **Schedules** (slicc-agent ≥ 5.9.0, slicc-kernel ≥ 1.110.0): each user's kernel crontab (`/var/spool/cron/crontabs/<user>`, `crontab -l`) holds them, and the kernel runs a due job as its user. A job that runs `agent send <target> '<message>'` comes back as a cron lick. The agent moves an older agent's `~/.slicc/crontab` lines into the file owner's crontab (as `# name: <name>` and `<schedule> agent send …`) and keeps the file as `~/.slicc/crontab.migrated`.
 - **Not a boundary:** the kernel's loopback (`<port>.kernel.localhost`) isn't one between users (N2). A server any user starts is reachable by every process and by seven's pages.
 
 ### Folder mounts
@@ -371,7 +373,7 @@ seven can also join a tailnet, with a patched build of Tailscale's wasm client (
       - **Identity:** one persistent DTLS certificate per hub origin (`RTCPeerConnection.generateCertificate`, ECDSA P-256 for a year, in the IndexedDB database `slicc-follow`), so the device and its access survive reloads. Unlinking deletes it.
       - **The link:** the follower answers as the link's node: its HELLO says `role: 'node'`, `kind: 'seven'`, caps `join` and `permissions`, and its tab as `node`, and it opens even stream ids. The owner treats a link as a follower because the hub said `slicc-seven/1`, and closes it if HELLO disagrees. A follower gets no `.slicc.internal` name, no exit, and none of the CLI kinds: the owner refuses `kernel`, `agent` and `browsers` from it with `EOPNOTSUPP`.
       - **View, Control and Terminal:** each follower certificate has three switches in Linked devices, off by default and kept with the device in `slicc-os.devices` (`setAccess` on the network port). Control and Terminal need View, so turning either on turns View on, and turning View off clears both. Without View a follower links but gets nothing: it shows as **Asks to follow**, with Allow, and its page says it waits for the owner. The owner's HELLO carries the current switches, and every change goes to the follower as `OPEN { kind: 'permissions', view, control, terminal }` on the control channel. Losing View resets the follower's open streams with `EACCES`, and so does losing Terminal for its terminals. For a CLI, the old **Allow remote control** is the same Control switch.
-      - **Chat (`pi`):** with View, the follower opens `OPEN { kind: 'pi' }` and gets the owner's agent, the same replicated chat a follower tab has. The owner bridges the stream to `owner.port({ readOnly, pages: false })` with slicc-agent's `bridgePort` (agent ≥ 3.32.0), read-only unless the device has Control, and without `pages`, so a follower's agent can't drive the owner's panels. The follower builds its `AgentConnection` with `linkEndpoint` and `connectAgent`, and spectrum's agent model on top. The stream carries slicc-agent's frames: a `u32` length, a `u8` tag (data, hello or close) and the payload. Without Control, a send, steer or stop is refused by the owner's agent with `EACCES`, and the chat shows that it watches only. Changing Control resets the stream, so the follower reconnects with the new access, and losing View resets it with `EACCES`. The follower installs `/opt/agent` itself, for `page.js` and the agent model, in a kernel it starts only for that install. Linked devices shows *Watching* while a follower's chat is open.
+      - **Chat (`pi`):** with View, the follower opens `OPEN { kind: 'pi' }` and gets the owner's agent, the same replicated chat a follower tab has. The owner bridges the stream to `owner.port({ readOnly, pages: false, device })` with slicc-agent's `bridgePort` (agent ≥ 3.32.0; `device`, the link's id, from 5.9.0), read-only unless the device has Control, and without `pages`, so a follower's agent can't drive the owner's panels. The follower builds its `AgentConnection` with `linkEndpoint` and `connectAgent`, and spectrum's agent model on top. The stream carries slicc-agent's frames: a `u32` length, a `u8` tag (data, hello or close) and the payload. Without Control, a send, steer or stop is refused by the owner's agent with `EACCES`, and the chat shows that it watches only. Changing Control resets the stream, so the follower reconnects with the new access, and losing View resets it with `EACCES`. The follower installs `/opt/agent` itself, for `page.js` and the agent model, in a kernel it starts only for that install. Linked devices shows *Watching* while a follower's chat is open. A failed connection is tried again after 2 s, except when the owner runs another agent version: `connectAgent` then rejects with `EVERSION` (slicc-agent ≥ 5.5.2), and the follower shows the agent's sentence as bios's own warning (`follow:other-agent-version`, not dismissable) and makes no further attempt in that follow session.
       - **Terminals (`terminal`):** with View and Terminal, the follower's Terminal panel opens shells in the owner's kernel. Each one is `OPEN { kind: 'terminal', cols, rows, cwd? }`, and the owner runs `bash -i` there with its own terminals' prompt, as the same user its own terminals use (root today, so Terminal is a root shell on the owner's SLICC), and answers OPENED `{ pid }`. Both directions then carry records, each a `u32` length, a `u8` type and a payload: `0` terminal bytes, `1` a resize as `{ cols, rows }` JSON, `2` a signal name (`INT`, `TSTP`, `QUIT`, `HUP`), and, from the owner only, `3` the shell's exit status as a decimal string, just before END. A bad record or size resets the stream with `EPROTO` or `EINVAL`. The follower's END closes the shell, and the owner ends the stream when the shell exits. Linked devices shows *Terminal open* while one runs (`terminals`), and turning Terminal or View off resets every open shell with `EACCES`.
       - **Names:** both sides call themselves `SLICC on <platform>` (`navigator.userAgentData.platform`). When two show the same name, the first four hex digits of the certificate fingerprint are added.
     - **Sevens this kernel follows (the in-kernel `slicc`):** the optional `slicc` package (`@ai-ecoverse/wasi-slicc`, slicc-cli's client commands built for `wasip1`) runs `slicc <join-url> prompt|watch|abort` in seven's terminal against another seven's agent, as slicc-cli's README specifies in §1.4 and §5.16. The program never touches WebRTC, the hub or the join state: it reaches the page's **link facade** at `SLICC_LINK_URL` (`tcp://127.0.0.1:7400`), which `os/os.js` declares with `createKernel({ facades: { link: { port: 7400, hook } } })` (`os/facade.js`, slicc-kernel ≥ 1.90.0), and the page follows that seven's tray for it (`os/leaders.js`).
@@ -379,9 +381,9 @@ seven can also join a tailnet, with a patched build of Tailscale's wasm client (
       - **The facade:** one connection per stream, in records of a `u8` type (`1` control, `2` data, `3` end), a `u32` length and the payload. The first record is `{ v: 1, join, open }`, and the page answers `{ opened }` or `{ reset: 'ERRNO: message' }`. Only `kind: 'agent'` with `prompt`, `watch` or `abort` opens, with only the fields those take. A long prompt (`length`) is answered at once, read whole, and sent on with the length of what it became. After that, only a `reset` may come as control, and it passes on just its errno.
       - **Secrets:** while the vault holds values, every outgoing prompt passes its scrubber (`redact`, on an agent-role port of the page's own), so a value leaves as its placeholder. While the scrubber is locked, the answer is `EACCES: unlock the vault to continue`.
       - **The link:** the page attaches as runtime `slicc-link/1`, so the other seven treats it as a CLI: it needs **Allow remote control** for this device in its Linked devices, or the answer is `EACCES` with that hint (and the link is closed, so the next run sees a fresh HELLO). The page's HELLO has `caps: []` and a fresh `node`, it opens only `agent` streams, and it refuses every stream the other seven opens with `EACCES`. There is one link per join URL, dialled on demand (45 s per dial, with retries after 1, 2 and 5 s), kept while a stream uses it and closed 10 minutes after the last one ends.
-      - **Identity and state:** one certificate per hub origin in the IndexedDB database `slicc-follow`, under `link:<hub>`, apart from a follower tab's own. `localStorage` (`slicc-os.leaders`, the newest 16) keys each join URL's state by its SHA-256 and keeps only a moved tray's new URL. The join URL itself is never stored, logged or put in an error. An `UNLINKED` refusal deletes that hub's certificate and state, so the next run is a new device.
+      - **Identity and state:** one certificate per hub origin in the IndexedDB database `slicc-follow`, under `link:<hub>`, apart from a follower tab's own. `localStorage` (`slicc-os.leaders`, the newest 16) keys each join URL's state by its SHA-256 and keeps only a moved tray's new URL. The join URL itself is never stored, logged or put in an error. Every seven on the hub sees that one certificate, as it sees a CLI's (§1.4), so they are the owner's devices recognising one device. An `UNLINKED` refusal drops only that leader's record and marks it unlinked: the certificate stays, so the other sevens on the hub keep recognising this one and keep their **Allow remote control**. The next run to the leader that unlinked it, the re-link its message asks for, mints a new hub certificate once, even if it fails and is run again, and that is the one action that makes every seven on the hub see a new device.
       - **Refusals:** a join URL on a hub seven doesn't link through, a forged or expired one, and an unlink are `EACCES`, so `slicc` exits 3 with the reason. A tray that can't be reached in time is `ENOTCONN`, which `watch` retries.
-      - **Tests:** `test/integration/follow-slicc.test.mjs` runs the real `slicc` from the catalog as a cone in seven's terminal against a second seven's real agent over a fake tray hub: refused until Allow remote control, then prompt, watch and abort; a vault value scrubbed on the way out; a forged URL, another hub, a scoop and an unlinked device refused; and a fake leader whose `unlink`, `join`, `agent` and `kernel` OPENs are refused while it is followed.
+      - **Tests:** `test/integration/follow-slicc.test.mjs` runs the real `slicc` from the catalog as a cone in seven's terminal against a second seven's real agent over a fake tray hub: refused until Allow remote control, then prompt, watch and abort; a vault value scrubbed on the way out; a forged URL, another hub, a scoop and an unlinked device refused; and a fake leader whose `unlink`, `join`, `agent` and `kernel` OPENs are refused while it is followed. `test/integration/leaders.test.mjs` has a fake leader unlink this seven while a real one keeps recognising it after a reload, with its grant, until the re-link makes a new device. Re-links that fail while that leader doesn't answer mint that new certificate once, not once per retry.
     - **The tray:** its capabilities are kept in `localStorage` (`slicc-os.tray`), so the join URL survives reloads. A hub that forgot the tray gets a new one. The leader socket pings every 30 s and reconnects with backoff. Elsewhere (`localhost`, tests) the tray starts only when `localStorage['slicc-os.tray-hub']` names a hub.
   - **Kernel side:** the kernel gets one uplink and one route table, the union of what the active exits offer, pushed with `kernel.setRoutes`.
   - **Choosing an exit:** for each destination, an exit that claims it (a tailnet address or MagicDNS name) wins. Otherwise the default exit takes it: the one that offers a default route, for example Tailscale with an exit node. Otherwise HTTP stays on the picked transport, and raw connections are `ENETUNREACH`.
@@ -471,7 +473,7 @@ Limits:
 
 [`.github/workflows/canary.yml`](.github/workflows/canary.yml) answers "is bios main green with these candidate versions?" before anyone asks for a pin. It never pushes, pins or opens a PR: it reports.
 
-- **Triggers:** `workflow_dispatch` and `workflow_call` with `overrides`, a JSON list of `name@version` (`["@ai-ecoverse/slicc-kernel@1.81.0"]`), and optionally `runner`, `shards` (names from [`scripts/canary/shards.json`](scripts/canary/shards.json); ci.yml's `follow-chat`, `remote-pydata`, `users-agent-ui`, `packages-update-cdp`, `guard`, `k4-link` and `rest` by default, or `sweep` for just the base-set sweep and the certs check), `expect` and `bios-ref` (any branch or sha of slicc-bios: the shard jobs check it out and lay this ref's `scripts/canary`, and `sweep.test.mjs` if it has none, over it; a ref whose `pins.test.mjs` has no canary mode gets the candidates in its working copy of `certs.json` instead, and the report still lists them as candidates). A proof in `proofs.json` can name its own `ref` the same way. An hourly `schedule` checks npm's `latest` of every kernel, jsh, cdp, agent, `wasm-*`, `wasi-*`, `wasix-*` and `py-*` package that a `src/packages/**/package.json` pins, and runs once with every newer one as the overrides, only when that list differs from the last scheduled canary's (its inputs are kept in the Actions cache). A `pull_request` trigger, filtered to the canary's own files, runs the proof in [`scripts/canary/proofs.json`](scripts/canary/proofs.json) from one plan job, cancelling a superseded run: kernel 1.78.0 on the `sweep` shard must regress grep, sed, jq, xz, findutils, diffutils and patch with exit 70 (kernel #483). A second proof packs `@ai-ecoverse/slicc-cdp@1.26.2` with `npm pack`, uploads it from the plan job, and runs it as a candidate artifact on `packages-update-cdp` and `guard` with `repeat: 3`.
+- **Triggers:** `workflow_dispatch` and `workflow_call` with `overrides`, a JSON list of `name@version` (`["@ai-ecoverse/slicc-kernel@1.81.0"]`), and optionally `runner`, `shards` (names from [`scripts/canary/shards.json`](scripts/canary/shards.json); ci.yml's `follow-chat`, `remote-pydata`, `users-agent-ui`, `packages-update-cdp`, `guard`, `guard-set-extension-prompt`, `guard-set-extension-lagging`, `guard-set-proxy-prompt`, `guard-set-proxy-lagging`, `k4-link`, `user-packages-keys-favicon` and `rest` by default; a shard's `env` in that file, such as `GUARD_VARIANTS`, is set for its tests, or `sweep` for just the base-set sweep and the certs check), `expect` and `bios-ref` (any branch or sha of slicc-bios: the shard jobs check it out and lay this ref's `scripts/canary`, and `sweep.test.mjs` if it has none, over it; a ref whose `pins.test.mjs` has no canary mode gets the candidates in its working copy of `certs.json` instead, and the report still lists them as candidates). A proof in `proofs.json` can name its own `ref` the same way. An hourly `schedule` checks npm's `latest` of every kernel, jsh, cdp, agent, `wasm-*`, `wasi-*`, `wasix-*` and `py-*` package that a `src/packages/**/package.json` pins, and runs once with every newer one as the overrides, only when that list differs from the last scheduled canary's (its inputs are kept in the Actions cache). A `pull_request` trigger, filtered to the canary's own files, runs the proof in [`scripts/canary/proofs.json`](scripts/canary/proofs.json) from one plan job, cancelling a superseded run: kernel 1.78.0 on the `sweep` shard must regress grep, sed, jq, xz, findutils, diffutils and patch with exit 70 (kernel #483). A second proof packs `@ai-ecoverse/slicc-cdp@1.26.2` with `npm pack`, uploads it from the plan job, and runs it as a candidate artifact on `packages-update-cdp` and `guard` with `repeat: 3`.
 - **A candidate from another repo's run:** `candidate-package` (the package it replaces, `@ai-ecoverse/slicc-cdp`), `candidate-artifact` (an artifact holding one `npm pack` tarball of it), `candidate-run` (the run that uploaded it), `candidate-sha256` and optionally `candidate-repo` (the caller's repository by default). Each shard job downloads the artifact with `github.token`, which under `workflow_call` is the caller's, so the caller's job needs `actions: read`. [`override-pins.mjs`](scripts/canary/override-pins.mjs) checks the tarball's sha256 before it reads anything and refuses a mismatch, then checks the tarball is that package with an exact version. It seeds the harness download cache with the bytes at the npm URL of that version, and rewrites the pins and locks through a local registry that serves npm's packuments with that version added, so an unpublished `x.y.z-pr.N.M` locks like a published one (npm's lock gets the registry URL back). Everything else stays a registry version. The report lists it as `candidate (artifact <run>/<name>, sha256 …)`.
 - **`repeat`** (1 to 10, default 1): each selected test file runs that many times with the candidates, and the files with a failure run that many times on main's pins. A test failing in every candidate run and no baseline run is a regression, one failing in every run of both is a failure on both, and anything mixed is flaky. Each row carries its counts, `candidate 2/3, baseline 0/3`.
 - **`result`**, a `workflow_call` output next to `ok`: the JSON summary (`ok`, `counts`, `regressions`, `both`, `flaky`, `failures`, `missingShards`, `unexplainedExits`, `candidates`, `overrides`, `repeat`) plus the `canary` artifact's name and URL.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.11.1",
+  "version": "1.12.0",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",
@@ -46,8 +46,8 @@
     "@ai-ecoverse/slicc-browsers": "1.7.6",
     "@ai-ecoverse/slicc-node": "2.5.1",
     "@ai-ecoverse/slicc-shared-web": "1.23.1",
-    "@ai-ecoverse/slicc-spectrum": "1.77.0",
-    "@ai-ecoverse/slicc-vault": "1.9.1",
+    "@ai-ecoverse/slicc-spectrum": "1.84.2",
+    "@ai-ecoverse/slicc-vault": "1.9.2",
     "@biomejs/biome": "2.5.15",
     "es-module-lexer": "3.0.3",
     "fake-indexeddb": "6.2.5",

package/src/packages/agent/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "description": "SLICC's agent, which the UI installs with pnpm in the background into /opt/agent in OPFS",
   "dependencies": {
-    "@ai-ecoverse/slicc-agent": "5.0.3",
+    "@ai-ecoverse/slicc-agent": "6.0.1",
     "@ai-ecoverse/slicc-kernel": "1.113.0"
   }
 }

package/src/packages/agent/pnpm-lock.yaml

@@ -12,26 +12,26 @@ importers:
   .:
     dependencies:
       '@ai-ecoverse/slicc-agent':
-        specifier: 5.0.3
-        version: 5.0.3(@ai-ecoverse/slicc-kernel@1.113.0)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
+        specifier: 6.0.1
+        version: 6.0.1(@ai-ecoverse/slicc-kernel@1.113.0)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
       '@ai-ecoverse/slicc-kernel':
         specifier: 1.113.0
         version: 1.113.0
 
 packages:
 
-  '@ai-ecoverse/slicc-agent@5.0.3':
-    resolution: {integrity: sha512-5mQ7TbLZCfdRaS4YFJXamjLCyzD9DxsWAImD2EU4sl85VNhgeXe6axRiOBkY45tpeKHBWG/MQUV5Mi75llUJMg==}
+  '@ai-ecoverse/slicc-agent@6.0.1':
+    resolution: {integrity: sha512-CB2rbanCVqwE8gdgrTJQ/iIvt5nHBvav9BIITQKuAT92YnRhgrqYYJVgXazoC1zwGn10qc1rlWitrHdA2ajGsQ==}
     engines: {node: '>=24'}
     peerDependencies:
-      '@ai-ecoverse/slicc-kernel': '>=1.90.0 <2'
-      '@ai-ecoverse/slicc-spectrum': ^1.75.0
+      '@ai-ecoverse/slicc-kernel': '>=1.110.0 <2'
+      '@ai-ecoverse/slicc-spectrum': ^1.84.0
     peerDependenciesMeta:
       '@ai-ecoverse/slicc-spectrum':
         optional: true
 
-  '@ai-ecoverse/slicc-browsers@1.7.1':
-    resolution: {integrity: sha512-35vGFMbZrl33ZQ9/VgjwZDBXp0RP87mKY0hnIG31tW5Nt5hh+icdp+3Y/t1kypoENAre+jnVEDa9W/H+yK6zyA==}
+  '@ai-ecoverse/slicc-browsers@1.7.6':
+    resolution: {integrity: sha512-clzlvrVLjmWEiKXhuK/Lez7y3Dwmo+FJ8POUs5GYqLJy5u8cOAiXyliQlNUNOVkNx9EoPm0RVvdfFkSTgv/isg==}
     engines: {node: '>=24'}
 
   '@ai-ecoverse/slicc-kernel@1.113.0':
@@ -135,25 +135,25 @@ packages:
     resolution: {integrity: sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==}
     engines: {node: '>=6.9.0'}
 
-  '@earendil-works/chord@1.2.0':
-    resolution: {integrity: sha512-Xh3M5B4D9YotOyBXyVbZ/5WfoUwP6Kt+TheCIDLxLCUx72UExuxZF//hNmIQGD13EkAHf2svKpXr/rCCT1gXTg==}
+  '@earendil-works/chord@1.3.0':
+    resolution: {integrity: sha512-qqYhjALZ193atpBzmmS+M5pHQoiI4Aynetc1jXpv+5O2crXH3Y8wbFEy33orU2nmFrlw1U36rsdgUjaW4b3m/w==}
     engines: {node: '>=22.19.0'}
 
-  '@earendil-works/pi-ai@1.2.0':
-    resolution: {integrity: sha512-U5/1zXqfV1on7/9sbez03tT4Ru49Lvfb4+zXSDK3DBKF5cRk6KxvAOTOY3HJ4jimlZth+rs7vbJqN6iBQAoNuQ==}
+  '@earendil-works/pi-ai@1.3.0':
+    resolution: {integrity: sha512-KaBI8x7q7sPoFUXICNGD9efHzDG+oRNwVvkA9jdIsSQWH1RjFssOlEGsbLtewUPPgCrvmz0l2KTgSLXTyj3acw==}
     engines: {node: '>=22.19.0'}
     hasBin: true
 
-  '@earendil-works/pi-codemode@1.2.0':
-    resolution: {integrity: sha512-UZF7IN0IIrf3bop2wTxrwoAakGctH6d3zdPwhPN+QHMECfoI5E6B6l6I17YGFZPj8cmGex6xX7mLCNJXRf7wsw==}
+  '@earendil-works/pi-codemode@1.3.0':
+    resolution: {integrity: sha512-2G9tmbsPhgzwfz7cmzJpbLSLqOx3eu22Gbzm+Wc3HqeZMjLQS4F3KfAabozVhv7uEjq3k2O1dZTHmhhWr2xbfQ==}
     engines: {node: '>=22.19.0'}
 
-  '@earendil-works/pi-durable@1.2.0':
-    resolution: {integrity: sha512-2kDyK7HVCTcxf3CTHkDR0rRGCUfIpoZr76fC6n/KZDu7hkDWR62anEujIkJ+8sKjtNpEM+zyKW3bi2NIEUyiCw==}
+  '@earendil-works/pi-durable@1.3.0':
+    resolution: {integrity: sha512-2aD0xead1LH0BBwUBxex28in/PpUJEwyaEiW/nLoTFUcZ/lDYEl6LHX6mGZKJG8tUHzERwJyysDgy0ruidt84w==}
     engines: {node: '>=22.19.0'}
 
-  '@earendil-works/pi-mcp@1.2.0':
-    resolution: {integrity: sha512-ertUv40rUBgssTzw2lIPlejjIBdhvdg4uw+whWCDJYKYHU+ldp1ezhbB0BzwpBfnwef6/YN+m6eKLscj+r3p7w==}
+  '@earendil-works/pi-mcp@1.3.0':
+    resolution: {integrity: sha512-lbktLplmdGamM2t460Q0ziNEfpUEHDTVNf79g/AialJ3XZ+SHgNqa/OJXRR+fU+GV/l+gBhRPcyP8XkQlv8Avw==}
     engines: {node: '>=22.19.0'}
 
   '@earendil-works/pi-telemetry@1.3.0':
@@ -324,16 +324,17 @@ packages:
 
 snapshots:
 
-  '@ai-ecoverse/slicc-agent@5.0.3(@ai-ecoverse/slicc-kernel@1.113.0)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
+  '@ai-ecoverse/slicc-agent@6.0.1(@ai-ecoverse/slicc-kernel@1.113.0)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
     dependencies:
-      '@ai-ecoverse/slicc-browsers': 1.7.1
+      '@ai-ecoverse/slicc-browsers': 1.7.6
       '@ai-ecoverse/slicc-kernel': 1.113.0
       '@ai-ecoverse/slicc-vault': 1.9.1
-      '@earendil-works/chord': 1.2.0
-      '@earendil-works/pi-ai': 1.2.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
-      '@earendil-works/pi-codemode': 1.2.0
-      '@earendil-works/pi-durable': 1.2.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
-      '@earendil-works/pi-mcp': 1.2.0
+      '@aws-sdk/middleware-websocket': 3.972.54
+      '@earendil-works/chord': 1.3.0
+      '@earendil-works/pi-ai': 1.3.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
+      '@earendil-works/pi-codemode': 1.3.0
+      '@earendil-works/pi-durable': 1.3.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
+      '@earendil-works/pi-mcp': 1.3.0
       '@sqlite.org/sqlite-wasm': 3.53.4-build2
       typebox: 1.3.36
     transitivePeerDependencies:
@@ -346,7 +347,7 @@ snapshots:
       - ws
       - zod
 
-  '@ai-ecoverse/slicc-browsers@1.7.1': {}
+  '@ai-ecoverse/slicc-browsers@1.7.6': {}
 
   '@ai-ecoverse/slicc-kernel@1.113.0': {}
 
@@ -541,11 +542,11 @@ snapshots:
 
   '@babel/runtime@7.29.7': {}
 
-  '@earendil-works/chord@1.2.0':
+  '@earendil-works/chord@1.3.0':
     dependencies:
       typebox: 1.3.27
 
-  '@earendil-works/pi-ai@1.2.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
+  '@earendil-works/pi-ai@1.3.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
     dependencies:
       '@anthropic-ai/sdk': 0.129.0
       '@aws-sdk/client-bedrock-runtime': 3.1127.0
@@ -566,15 +567,15 @@ snapshots:
       - ws
       - zod
 
-  '@earendil-works/pi-codemode@1.2.0':
+  '@earendil-works/pi-codemode@1.3.0':
     dependencies:
       quickjs-wasi: 3.6.2
 
-  '@earendil-works/pi-durable@1.2.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
+  '@earendil-works/pi-durable@1.3.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
     dependencies:
-      '@earendil-works/chord': 1.2.0
-      '@earendil-works/pi-ai': 1.2.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
-      '@earendil-works/pi-codemode': 1.2.0
+      '@earendil-works/chord': 1.3.0
+      '@earendil-works/pi-ai': 1.3.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
+      '@earendil-works/pi-codemode': 1.3.0
       '@silvia-odwyer/photon': 0.3.3
       diff: 8.0.4
       typebox: 1.3.27
@@ -588,7 +589,7 @@ snapshots:
       - ws
       - zod
 
-  '@earendil-works/pi-mcp@1.2.0':
+  '@earendil-works/pi-mcp@1.3.0':
     dependencies:
       cross-spawn: 7.0.6
 

package/src/packages/certs.json

@@ -87,6 +87,10 @@
     "integrity": "sha512-gBj/wHcDmRC0e4oSdgThodGLoCQWk3crEfAv/sOg1mH3MnBdEzUjIWArnvnH8m8dovz+MB2KC5Z20jXzJIcaZw==",
     "sha256": "713fba137c1a682039bca80268ce4e4005f29c4a0e1f1a537f51b4e22347821e"
   },
+  "@ai-ecoverse/slicc-cdp@1.26.2": {
+    "integrity": "sha512-YSmqvEOQMcwu3aQrPZ4W1XpHl+O7Sm4QE7MOtG4wnfjx8go2XakagTHrPiPE199GQ2QuQAJE+dluRNZn3bB4cg==",
+    "sha256": "67fa941ce0afe790b60ade22c0014658fb5d0ef993e35437c43144361f3f82b3"
+  },
   "@ai-ecoverse/slicc-clipboard@1.0.2": {
     "integrity": "sha512-p7b1h85qkiU0LKjNLCLiU7GVXjGigkyR2+VUCInM1cZo2yjLFxr7tGAOO09e6OG9nB7XKiQn3W88wb3s0gxy+g==",
     "sha256": "1bd73c6ae4c5c0dc149ba6a301e7615a78bf4b97ff88c5b0f6eb7d8e270588aa"

package/src/packages/package-lock.json

@@ -7,10 +7,10 @@
       "name": "slicc-bios-packages",
       "dependencies": {
         "@ai-ecoverse/slicc-browsers": "1.7.6",
-        "@ai-ecoverse/slicc-cdp": "1.25.1",
+        "@ai-ecoverse/slicc-cdp": "1.26.2",
         "@ai-ecoverse/slicc-clipboard": "1.0.2",
         "@ai-ecoverse/slicc-kernel": "1.113.0",
-        "@ai-ecoverse/slicc-spectrum": "1.77.0",
+        "@ai-ecoverse/slicc-spectrum": "1.84.2",
         "@ai-ecoverse/wasi-pnpm": "12.9.1-9",
         "@ai-ecoverse/wasi-ripgrep": "15.2.0-3",
         "@ai-ecoverse/wasm-bash": "5.3.0-18",
@@ -46,13 +46,16 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-cdp": {
-      "version": "1.25.1",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-cdp/-/slicc-cdp-1.25.1.tgz",
-      "integrity": "sha512-gBj/wHcDmRC0e4oSdgThodGLoCQWk3crEfAv/sOg1mH3MnBdEzUjIWArnvnH8m8dovz+MB2KC5Z20jXzJIcaZw==",
+      "version": "1.26.2",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-cdp/-/slicc-cdp-1.26.2.tgz",
+      "integrity": "sha512-YSmqvEOQMcwu3aQrPZ4W1XpHl+O7Sm4QE7MOtG4wnfjx8go2XakagTHrPiPE199GQ2QuQAJE+dluRNZn3bB4cg==",
       "license": "Apache-2.0",
       "workspaces": [
         "packages/sliccy-browser"
       ],
+      "bin": {
+        "slicc-cdp": "src/cli.js"
+      },
       "engines": {
         "node": ">=24"
       }
@@ -77,9 +80,9 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-spectrum": {
-      "version": "1.77.0",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-spectrum/-/slicc-spectrum-1.77.0.tgz",
-      "integrity": "sha512-2IDp53NpmNoqKqdIgtv3H+wEAEYCp3Z4GeNp0DFnzqx/PUiC9crEdKt9ce3a3NHNJKtcPeDGwr1lu7GLRfEWPg==",
+      "version": "1.84.2",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-spectrum/-/slicc-spectrum-1.84.2.tgz",
+      "integrity": "sha512-7nSam2gjvT18jjpajcEn4Q7IqX0qTITU5G4ZrH1oipcgiOMmNmXTMeWOra1CAPL1+JZMHHQIIdYmh6nBCLAGlw==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=24"

package/src/packages/package.json

@@ -4,10 +4,10 @@
   "description": "Packages the BIOS installs from npm into OPFS, pinned by package-lock.json and pnpm-lock.yaml",
   "dependencies": {
     "@ai-ecoverse/slicc-browsers": "1.7.6",
-    "@ai-ecoverse/slicc-cdp": "1.25.1",
+    "@ai-ecoverse/slicc-cdp": "1.26.2",
     "@ai-ecoverse/slicc-clipboard": "1.0.2",
     "@ai-ecoverse/slicc-kernel": "1.113.0",
-    "@ai-ecoverse/slicc-spectrum": "1.77.0",
+    "@ai-ecoverse/slicc-spectrum": "1.84.2",
     "@ai-ecoverse/wasi-pnpm": "12.9.1-9",
     "@ai-ecoverse/wasi-ripgrep": "15.2.0-3",
     "@ai-ecoverse/wasm-bash": "5.3.0-18",

package/src/packages/pnpm-lock.yaml

@@ -12,8 +12,8 @@ importers:
         specifier: 1.7.6
         version: 1.7.6
       '@ai-ecoverse/slicc-cdp':
-        specifier: 1.25.1
-        version: 1.25.1
+        specifier: 1.26.2
+        version: 1.26.2
       '@ai-ecoverse/slicc-clipboard':
         specifier: 1.0.2
         version: 1.0.2
@@ -21,8 +21,8 @@ importers:
         specifier: 1.113.0
         version: 1.113.0
       '@ai-ecoverse/slicc-spectrum':
-        specifier: 1.77.0
-        version: 1.77.0
+        specifier: 1.84.2
+        version: 1.84.2
       '@ai-ecoverse/wasi-pnpm':
         specifier: 12.9.1-9
         version: 12.9.1-9
@@ -99,9 +99,10 @@ packages:
     resolution: {integrity: sha512-clzlvrVLjmWEiKXhuK/Lez7y3Dwmo+FJ8POUs5GYqLJy5u8cOAiXyliQlNUNOVkNx9EoPm0RVvdfFkSTgv/isg==}
     engines: {node: '>=24'}
 
-  '@ai-ecoverse/slicc-cdp@1.25.1':
-    resolution: {integrity: sha512-gBj/wHcDmRC0e4oSdgThodGLoCQWk3crEfAv/sOg1mH3MnBdEzUjIWArnvnH8m8dovz+MB2KC5Z20jXzJIcaZw==}
+  '@ai-ecoverse/slicc-cdp@1.26.2':
+    resolution: {integrity: sha512-YSmqvEOQMcwu3aQrPZ4W1XpHl+O7Sm4QE7MOtG4wnfjx8go2XakagTHrPiPE199GQ2QuQAJE+dluRNZn3bB4cg==}
     engines: {node: '>=24'}
+    hasBin: true
 
   '@ai-ecoverse/slicc-clipboard@1.0.2':
     resolution: {integrity: sha512-p7b1h85qkiU0LKjNLCLiU7GVXjGigkyR2+VUCInM1cZo2yjLFxr7tGAOO09e6OG9nB7XKiQn3W88wb3s0gxy+g==}
@@ -111,8 +112,8 @@ packages:
     resolution: {integrity: sha512-PGJvZUm/oQYuS9pbUxDIpBSCeyaW91wDN2yWPCZIv664WDWKsiCTeQ1c4i8xU4Bq7C66viFK6EzZhvvofQ6b3Q==}
     engines: {node: '>=24'}
 
-  '@ai-ecoverse/slicc-spectrum@1.77.0':
-    resolution: {integrity: sha512-2IDp53NpmNoqKqdIgtv3H+wEAEYCp3Z4GeNp0DFnzqx/PUiC9crEdKt9ce3a3NHNJKtcPeDGwr1lu7GLRfEWPg==}
+  '@ai-ecoverse/slicc-spectrum@1.84.2':
+    resolution: {integrity: sha512-7nSam2gjvT18jjpajcEn4Q7IqX0qTITU5G4ZrH1oipcgiOMmNmXTMeWOra1CAPL1+JZMHHQIIdYmh6nBCLAGlw==}
     engines: {node: '>=24'}
     peerDependencies:
       '@shikijs/langs': 4.5.0
@@ -201,13 +202,13 @@ snapshots:
 
   '@ai-ecoverse/slicc-browsers@1.7.6': {}
 
-  '@ai-ecoverse/slicc-cdp@1.25.1': {}
+  '@ai-ecoverse/slicc-cdp@1.26.2': {}
 
   '@ai-ecoverse/slicc-clipboard@1.0.2': {}
 
   '@ai-ecoverse/slicc-kernel@1.113.0': {}
 
-  '@ai-ecoverse/slicc-spectrum@1.77.0': {}
+  '@ai-ecoverse/slicc-spectrum@1.84.2': {}
 
   '@ai-ecoverse/wasi-pnpm@12.9.1-9': {}