@ai-ecoverse/slicc-bios 1.17.2 → 1.17.4

package/README.md

@@ -6,7 +6,7 @@ The page shows six boot steps as they run:
 
 1. **Acquire OPFS** – open the origin private file system and ask for persistent storage.
 2. **Create installer worker** – start `installer.js`, a shared worker that does all of the BIOS's OPFS writes and is shared by every tab.
-3. **Install packages from npm into OPFS** – the installer reads [`src/packages/package-lock.json`](src/packages/package-lock.json), the lockfile the BIOS ships with. It skips packages that name an `os` or `cpu` (native binaries such as esbuild's, which can't run in a browser). For every other locked package it downloads the tarball from `registry.npmjs.org` and checks its `integrity`, then unpacks it with the built-in `DecompressionStream` and [`modern-tar`](https://github.com/ayuhito/modern-tar) into OPFS at its lockfile path (`node_modules/…`), dropping `.` segments from entry names and skipping any entry with `..`. While it unpacks, it hashes every file (SHA-256) and records the hashes in IndexedDB (see [Integrity](#integrity)). It also keeps each file's mode from the tarball, owned by root: once a package's files are in, it hands their paths and modes to the kernel's `writeMetadata` (`@ai-ecoverse/slicc-kernel/meta`, read from the installed kernel), in one batch per run, so an executable outside `bin/`, such as pnpm's `shims/i`, stays executable when the kernel checks modes. The seed's files are recorded as root's `0644`. A kernel without `/meta` skips this. A package installed before the kernel had `/meta` gets its modes once, on the first run with it: the installer fetches its tarball again, checks its integrity, reads the modes from the headers without unpacking, and marks the receipt (`modes: true`). A package installed or replaced later is marked when it's stamped. It also records a receipt in `var/lib/bios/`. A package whose recorded integrity matches the lockfile's and whose files are still there isn't downloaded again, so pinning a new version replaces just that package. Replacing a package keeps its nested `node_modules`, and packages the lockfile no longer lists are deleted along with their receipts and hashes. A package without recorded hashes is downloaded again, even with a receipt, so the first boot after integrity checks arrived downloads the base set once. Last, the installer copies the deployment's `package.json` and `pnpm-lock.yaml` to the OPFS root for pnpm, and the lockfile once more to `var/lib/slicc/pnpm-lock.yaml`, which records what is installed (see [Updates](#updates)).
+3. **Install packages from npm into OPFS** – the installer reads [`src/packages/package-lock.json`](src/packages/package-lock.json), the lockfile the BIOS ships with. It skips packages that name an `os` or `cpu` (native binaries such as esbuild's, which can't run in a browser). For every other locked package it downloads the tarball from `registry.npmjs.org` and checks its `integrity`, then unpacks it with the built-in `DecompressionStream` and [`modern-tar`](https://github.com/ayuhito/modern-tar) into OPFS at its lockfile path (`node_modules/…`), dropping `.` segments from entry names and skipping any entry with `..`. A package that is already there is rewritten in place, never emptied first: every file is overwritten whole (an OPFS write commits on close), the entry points (`package.json`, its `bin` and `main`) come last, and only then do the files the new version no longer has go, so a running kernel or another tab never finds the package missing. While it unpacks, it hashes every file (SHA-256) and records the hashes in IndexedDB (see [Integrity](#integrity)). It also keeps each file's mode from the tarball, owned by root: once a package's files are in, it hands their paths and modes to the kernel's `writeMetadata` (`@ai-ecoverse/slicc-kernel/meta`, read from the installed kernel), in one batch per run, so an executable outside `bin/`, such as pnpm's `shims/i`, stays executable when the kernel checks modes. The seed's files are recorded as root's `0644`. A kernel without `/meta` skips this. A package installed before the kernel had `/meta` gets its modes once, on the first run with it: the installer fetches its tarball again, checks its integrity, reads the modes from the headers without unpacking, and marks the receipt (`modes: true`). A package installed or replaced later is marked when it's stamped. It also records a receipt in `var/lib/bios/`. A package whose recorded integrity matches the lockfile's and whose files are still there isn't downloaded again, so pinning a new version replaces just that package. Replacing a package keeps its nested `node_modules`, and packages the lockfile no longer lists are deleted along with their receipts and hashes. A package without recorded hashes is downloaded again, even with a receipt, so the first boot after integrity checks arrived downloads the base set once. Last, the installer copies the deployment's `package.json` and `pnpm-lock.yaml` to the OPFS root for pnpm, and the lockfile once more to `var/lib/slicc/pnpm-lock.yaml`, which records what is installed (see [Updates](#updates)).
 4. **Add UI page to OPFS** – the installer copies `src/seed/` to `os/` in OPFS and records each file's hash. This is a stand-in until the UI ships as a downloadable asset.
 5. **Intercept same-origin requests** – `sw.js`, a module service worker, answers in-scope requests from OPFS and passes everything else to the network (see [What the service worker serves](#what-the-service-worker-serves)). The code it serves from OPFS carries `Cross-Origin-Opener-Policy: same-origin`, `Cross-Origin-Embedder-Policy: require-corp` and `Cross-Origin-Resource-Policy: same-origin`, so the UI page and the workers it starts are cross-origin isolated. Scripts it serves get their bare imports resolved (see [Modules](#modules)).
 6. **Serve UI from OPFS** – navigate to `os/` (keeping the URL fragment) with a cross-document view transition. That page imports [`@ai-ecoverse/slicc-kernel`](https://github.com/ai-ecoverse/slicc-kernel) and [`@ai-ecoverse/slicc-spectrum`](https://github.com/ai-ecoverse/slicc-spectrum) by name from `node_modules/` in OPFS, starts the kernel on the OPFS root and boots SLICC's UI, `<slicc-app>`, on spectrum's kernel model. The agent comes later, from its own pnpm project (see [Agent](#agent)). Commands come from the installed packages: `bash`, coreutils, `grep`, `sed`, findutils, `gawk`, `diff` (with `cmp`, `sdiff` and `diff3`), `patch`, `rg` (ripgrep), `jq`, `less`, `tree`, `tar` with `gzip`, `xz` and `bzip2` (and their `gunzip`, `zcat`, `unxz`, `xzcat`, `lzma`, `bunzip2` and `bzcat` names), `curl`, `mount`, `umount`, `clear`, `tput`, `tset`, `reset`, `pnpm` with its `npm` and `npx` shims, and `playwright-cli` and `curlwright` from slicc-cdp. The shell starts in `/home` as **root** (slicc-kernel ≥ 1.44.0 has users: `/etc/passwd` and `/etc/group` list root, nobody, sudo, users and nogroup), so the prompt ends in `#`, `whoami` and `id` say root, `ls -l` and `ps` show user names, and root's `HOME` is `/root` (mode 0700) with `PNPM_HOME=/usr/local/share/pnpm`. bash, coreutils, procps and git are the homescoop H1 rebuilds that know about users; older builds claimed uid 1000. `tar` forks the compressors for `-z`, `-J` and `-j` through `/bin/sh`. Hard links in archives aren't recreated, and there's no `--zstd`. xz is single-threaded: `-T` is accepted but has no effect. The `zgrep`, `xzgrep` and `bzgrep`-style wrapper scripts aren't installed as commands. Whatever the shell writes stays in OPFS across reloads. The kernel terminates HTTPS with `wasm-tls-engine`, so `curl https://…` works over whichever transport is picked (see [Network](#network)). `wasm-git` is left out for its size (53 MB); it can come later through pnpm.
@@ -74,7 +74,7 @@ The kernel runs with users on (slicc-kernel ≥ 1.81.0): files have owners and m
 - **Files from before users:** agents start on the new layout; nothing is moved. On the first boot with users on, bios runs `chmod -R go-rwx` as root, once, on what earlier versions left readable to everyone: `/home/.pi`, `/home/.slicc`, `/home/sprinkles`, `/home/.gelatiere`, `/home/.welcomed`, `/home/.welcome.json`, `/home/sessions`, `/home/.local` and `/scoops`. So no cone or scoop reads an old `mcp.json` with its tokens, and root still reads everything. The marker `var/lib/slicc/legacy-locked` keeps it from running again; cone and scoop homes and other files in `/home` aren't touched.
 - **The agent's `KernelSource`** (`os/users.js`) passes `connect({ user, agentId })`, `users` and `groups` to the kernel, only for agent users. It refuses root and any user but `cone`, `cone-<n>` and `scoop-<folder>`, requires the agentId to match the user exactly (`cone:cone`, `cone:cone-2`, `scoop:<folder>`), and allows groups only of cones and `sudo` only for cones. A cone is always added to `sudo`, even when the caller leaves it out, since sudo membership is what makes a cone (the vault's J2 rule). The tag is `{"kind":"agent","agentId":…}` as JSON, and the agent's root client carries `{"kind":"agent","agentId":"root"}`; a panel terminal's is `{"kind":"user","where":"terminal:<tab>"}`.
 - **Protected code paths:** under `'enforce'`, the kernel gets `protect: { paths: ['/node_modules', '/opt/agent', '/opt/grammars', '/opt/tailscale', '/opt/slicc', '/os'], writers: ['bios-installer'] }` (slicc-kernel ≥ 1.81.0). No process changes them, root included (`EROFS`; a cone sees `EACCES` first), and nothing mounts at, under or above them.
-  - **bios's installs** (pnpm into the base set, `/opt/*` and `/opt/slicc/<project>`, and the `chmod -R a+rX` pass) run as `kernel.run(argv, { cwd, tag: 'bios-installer', env })`. The env is clean: `HOME=/opt/slicc/.installer`, its own config and cache, the system `PNPM_HOME` and `PATH`, and an empty `NODE_OPTIONS`.
+  - **bios's installs** (pnpm into the base set, `/opt/*` and `/opt/slicc/<project>`, and the pass that makes them readable) run as `kernel.run(argv, { cwd, tag: 'bios-installer', env })`. The env is clean: `HOME=/opt/slicc/.installer`, its own config and cache, the system `PNPM_HOME` and `PATH`, and an empty `NODE_OPTIONS`.
   - **pnpm runs with** `--ignore-scripts --ignore-pnpmfile --config.userconfig=/dev/null --config.store-dir=/opt/slicc/.store --config.verify-store-integrity=true`. No locked package in the base set, `/opt/agent`, `/opt/grammars`, `/opt/tailscale` or the data tools has an install script.
   - **The base project** moves out of `/`: its `package.json`, `pnpm-lock.yaml` and `pnpm-workspace.yaml` are in `/opt/slicc/base`, written by the BIOS installer and the in-place update, and pnpm installs it with `--modules-dir=/node_modules` from there. So everything pnpm reads is inside a protected path, and a root process that writes `/package.json`, `/pnpm-lock.yaml`, `/.npmrc` or `/pnpm-workspace.yaml` changes nothing; bios removes those at every boot. A protected project without its own `pnpm-workspace.yaml` gets one, so pnpm's search for a workspace stops inside the tree. The service worker's resolver no longer reads a `package.json` at `/` for `browser` mappings.
   - **The user layers** for `/opt/agent` and `/opt/grammars` are off under `'enforce'`: users can't change those projects any more, and their state is in `/var/lib/slicc`, which the agent can write. They keep working under `'report'`. Your packages live in `/opt/user` instead, which isn't protected (see [Your packages](#your-packages)).
@@ -161,7 +161,7 @@ Spectrum bundles 16 syntax languages; the rest come from `@shikijs/langs` and `@
 1. **Until they're installed,** the UI loads grammars from jsDelivr.
 2. **After every update check,** `os/grammars.js` compares the deployed `packages/grammars/pnpm-lock.yaml` with `var/lib/slicc/grammars/pnpm-lock.yaml`. If they differ, it writes the manifest (merged with the user's layer, see [Your packages](#your-packages)) and lockfile to `/opt/grammars` and runs `pnpm install --frozen-lockfile --trust-lockfile` there, under its own Web Lock, `slicc-grammars`, so a long install never holds up the BIOS in another tab. Only once pnpm succeeds does it record the lockfile.
 
-   It runs in the page's own kernel, like the agent and Tailscale installs and the `chmod -R a+rX` pass, never in a second kernel on the same OPFS root. A second kernel on one root makes both pay for keeping their files in step (slicc-kernel ≥ 1.119.0 made a cold agent install about 3× slower that way). Every bios pnpm run, these installs and the optional packages' `pnpm add -g` and `remove -g`, also takes the Web Lock `slicc-pnpm-store`, so only one pnpm uses the store at a time, in this tab or another.
+   It runs in the page's own kernel, like the agent and Tailscale installs and the pass that makes them readable, never in a second kernel on the same OPFS root. A second kernel on one root makes both pay for keeping their files in step (slicc-kernel ≥ 1.119.0 made a cold agent install about 3× slower that way). Every bios pnpm run, these installs and the optional packages' `pnpm add -g` and `remove -g`, also takes the Web Lock `slicc-pnpm-store`, so only one pnpm uses the store at a time, in this tab or another.
 3. **Once they're installed,** `grammarBase` points at `/opt/grammars/node_modules/@shikijs/`. On later loads the page sets it as soon as the recorded lockfile is there, before any network check, so highlighting works offline. If pnpm fails, the page stays on jsDelivr, the **Syntax grammars** row shows the error with **Retry**, and the next check tries again.
 
 The Files panel lists `/opt/grammars/node_modules` but doesn't scan it.
@@ -177,7 +177,7 @@ Below the system rows, Install / Update offers **Optional packages** (spectrum
 - **Install** runs `pnpm add -g <package>@<version>` in the page's kernel, as a user would, under the Web Lock `slicc-optional`, so the commands work at once in every open shell. pnpm 12 gives each global add its own project under `$PNPM_HOME/global/v11/`; bios reads `PNPM_HOME` from the kernel's environment. Afterwards `os/packages.js` reads that project's `pnpm-lock.yaml`: every package in it, the one added and each dependency, must be a version in the catalog's lockfile or the base set's, with that integrity. homescoop pins `@ai-ecoverse/*` dependencies exactly (uv → Python, git → bash), so the catalog's lockfile names them all. Anything else, a dependency pnpm resolved to another version included, removes the package again and fails the row with *This version doesn't match the tested build*. An entry's `requires` (uv needs Python) are installed first.
 - **State** comes from pnpm's global projects, not from a list of bios's own, so a package installed by hand shows as installed with its version. One older than the catalog's offers **Update**, which adds the catalog's version; one at or above it offers **Remove**. bios never downgrades.
 - **Remove** runs `pnpm remove -g <package>`. It asks first only when another installed entry needs it (*Remove Node.js (jsh)? Browser for jsh scripts needs it and stops working until Node.js (jsh) is back.*, accent); otherwise it doesn't ask, since pnpm's global projects hold no user data and the package can be installed again. A cancelled confirm changes nothing.
-- **Readable by everyone:** after every pnpm install of `/opt/agent`, `/opt/grammars` and an optional project in `/opt/slicc`, bios runs `chmod -R a+rX` on that tree, as root. pnpm writes some files `0600`, such as `node_modules/.pnpm-workspace-state-v1.json`, and with kernel users every user must be able to read seven's installed packages. An install from before this runs the same `chmod` once at its next check, marked by `var/lib/slicc/<project>/readable`.
+- **Readable by everyone:** after every pnpm install of `/opt/agent`, `/opt/grammars` and an optional project in `/opt/slicc`, bios makes that tree readable by everyone, as root: one `find` selects the files without `a+r`, the executables without `a+x` and the directories without `a+x`, and runs `chmod a+rX` on only those, so a tree of 15,000 entries with one `0600` file pays for one walk and one `chmod`, not 15,000. pnpm writes some files `0600`, such as `node_modules/.pnpm-workspace-state-v1.json`, and with kernel users every user must be able to read seven's installed packages. An install from before this runs the same pass once at its next check, marked by `var/lib/slicc/<project>/readable`.
 - **Failures** lead with one sentence and keep pnpm's output, starting with the package and version, under *Install log*, with **Retry**.
 - **Withdrawn and kept as exceptions** (homescoop#858/#859, #864): uv, esbuild, tsc and buf are withdrawn until attested rebuilds. They're retired rows (*No longer offered*, with Remove for an earlier install), and their certs lines are gone. Instead, use `pip` for uv's work for now (uv returns as `@ai-ecoverse/wasi-uv`, Astral's uv, once that's certified), and install esbuild and typescript straight from npm with `pnpm add -g`; buf has no stand-in. **git** and **gh** stay as recorded supply-chain exceptions until their attested rebuilds: their `certs.json` entries carry an `exception` field, which `pins.test.mjs` lists, and any other uncertified pin still fails it.
 - **Python data tools are withdrawn** until numpy and pandas come from verified CI builds (homescoop#826, #730): py-numpy 2.3.2-4 to -10 and py-pandas 2.3.2-5 to -11 came from un-attested local builds, so their certs lines are gone and the catalog has no `pydata` row or project. `retired.json` lists it as a retired `kind: "project"` entry, so an earlier install shows as installed with only **Remove**, which deletes the project, its `.pth` and its receipt. Plain Python stays. The project support below is unchanged for when it returns.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.17.2",
+  "version": "1.17.4",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",

package/src/packages/certs.json

@@ -272,6 +272,10 @@
     "integrity": "sha512-OQLqanDwhIkr6NkwrdB5UonOqvDj4NZP/PPsxQI9z1OckX5drZXFj65un2IBOtRCjgxwR9o+mQCt8mw4qC9Y7g==",
     "sha256": "579501f6f766a5cecbc75749ac4e81084d07d138b78f801c35bd752c88ab9101"
   },
+  "@ai-ecoverse/wasi-pnpm@12.9.1-10": {
+    "integrity": "sha512-9uTIklwdhPpn2lfpbUO4iNb+a9teRX1smXbf/0yr9ag41/IRLb7LD8Y9ywhm5aJq0pMHysbvp4WCYL+Di2Seqg==",
+    "sha256": "9a7c5564972dc84df75dd71b95039b2d945aa2c2f66c2db95d94c7037c329657"
+  },
   "@ai-ecoverse/wasi-ripgrep@15.2.0-3": {
     "integrity": "sha512-UYnMCCev7OQYAOGJ+sO/wbmZGg5mOlsaa8zJPtsrere2mrKHczvwMYmLnGeC1cqV3XW/AwRlMNk0j+S3pYUZ2A==",
     "sha256": "d7db54ccdade9379aff3fa90fd8b07bb48990d96097fde39691b0fa17bffe2fe"

package/src/packages/package-lock.json

@@ -11,7 +11,7 @@
         "@ai-ecoverse/slicc-clipboard": "1.0.2",
         "@ai-ecoverse/slicc-kernel": "1.124.2",
         "@ai-ecoverse/slicc-spectrum": "1.86.4",
-        "@ai-ecoverse/wasi-pnpm": "12.9.1-9",
+        "@ai-ecoverse/wasi-pnpm": "12.9.1-10",
         "@ai-ecoverse/wasi-ripgrep": "15.2.0-3",
         "@ai-ecoverse/wasm-bash": "5.3.0-18",
         "@ai-ecoverse/wasm-bzip2": "1.0.8-2",
@@ -101,9 +101,9 @@
       }
     },
     "node_modules/@ai-ecoverse/wasi-pnpm": {
-      "version": "12.9.1-9",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasi-pnpm/-/wasi-pnpm-12.9.1-9.tgz",
-      "integrity": "sha512-OQLqanDwhIkr6NkwrdB5UonOqvDj4NZP/PPsxQI9z1OckX5drZXFj65un2IBOtRCjgxwR9o+mQCt8mw4qC9Y7g==",
+      "version": "12.9.1-10",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasi-pnpm/-/wasi-pnpm-12.9.1-10.tgz",
+      "integrity": "sha512-9uTIklwdhPpn2lfpbUO4iNb+a9teRX1smXbf/0yr9ag41/IRLb7LD8Y9ywhm5aJq0pMHysbvp4WCYL+Di2Seqg==",
       "license": "MIT",
       "engines": {
         "slicc-kernel": ">=1.7.2"

package/src/packages/package.json

@@ -8,7 +8,7 @@
     "@ai-ecoverse/slicc-clipboard": "1.0.2",
     "@ai-ecoverse/slicc-kernel": "1.124.2",
     "@ai-ecoverse/slicc-spectrum": "1.86.4",
-    "@ai-ecoverse/wasi-pnpm": "12.9.1-9",
+    "@ai-ecoverse/wasi-pnpm": "12.9.1-10",
     "@ai-ecoverse/wasi-ripgrep": "15.2.0-3",
     "@ai-ecoverse/wasm-bash": "5.3.0-18",
     "@ai-ecoverse/wasm-bzip2": "1.0.8-2",

package/src/packages/pnpm-lock.yaml

@@ -24,8 +24,8 @@ importers:
         specifier: 1.86.4
         version: 1.86.4
       '@ai-ecoverse/wasi-pnpm':
-        specifier: 12.9.1-9
-        version: 12.9.1-9
+        specifier: 12.9.1-10
+        version: 12.9.1-10
       '@ai-ecoverse/wasi-ripgrep':
         specifier: 15.2.0-3
         version: 15.2.0-3
@@ -124,8 +124,8 @@ packages:
       '@shikijs/themes':
         optional: true
 
-  '@ai-ecoverse/wasi-pnpm@12.9.1-9':
-    resolution: {integrity: sha512-OQLqanDwhIkr6NkwrdB5UonOqvDj4NZP/PPsxQI9z1OckX5drZXFj65un2IBOtRCjgxwR9o+mQCt8mw4qC9Y7g==}
+  '@ai-ecoverse/wasi-pnpm@12.9.1-10':
+    resolution: {integrity: sha512-9uTIklwdhPpn2lfpbUO4iNb+a9teRX1smXbf/0yr9ag41/IRLb7LD8Y9ywhm5aJq0pMHysbvp4WCYL+Di2Seqg==}
     engines: {slicc-kernel: '>=1.7.2'}
 
   '@ai-ecoverse/wasi-ripgrep@15.2.0-3':
@@ -210,7 +210,7 @@ snapshots:
 
   '@ai-ecoverse/slicc-spectrum@1.86.4': {}
 
-  '@ai-ecoverse/wasi-pnpm@12.9.1-9': {}
+  '@ai-ecoverse/wasi-pnpm@12.9.1-10': {}
 
   '@ai-ecoverse/wasi-ripgrep@15.2.0-3': {}