@ai-ecoverse/slicc-bios 1.17.3 → 1.17.5

package/README.md

@@ -74,7 +74,7 @@ The kernel runs with users on (slicc-kernel ≥ 1.81.0): files have owners and m
 - **Files from before users:** agents start on the new layout; nothing is moved. On the first boot with users on, bios runs `chmod -R go-rwx` as root, once, on what earlier versions left readable to everyone: `/home/.pi`, `/home/.slicc`, `/home/sprinkles`, `/home/.gelatiere`, `/home/.welcomed`, `/home/.welcome.json`, `/home/sessions`, `/home/.local` and `/scoops`. So no cone or scoop reads an old `mcp.json` with its tokens, and root still reads everything. The marker `var/lib/slicc/legacy-locked` keeps it from running again; cone and scoop homes and other files in `/home` aren't touched.
 - **The agent's `KernelSource`** (`os/users.js`) passes `connect({ user, agentId })`, `users` and `groups` to the kernel, only for agent users. It refuses root and any user but `cone`, `cone-<n>` and `scoop-<folder>`, requires the agentId to match the user exactly (`cone:cone`, `cone:cone-2`, `scoop:<folder>`), and allows groups only of cones and `sudo` only for cones. A cone is always added to `sudo`, even when the caller leaves it out, since sudo membership is what makes a cone (the vault's J2 rule). The tag is `{"kind":"agent","agentId":…}` as JSON, and the agent's root client carries `{"kind":"agent","agentId":"root"}`; a panel terminal's is `{"kind":"user","where":"terminal:<tab>"}`.
 - **Protected code paths:** under `'enforce'`, the kernel gets `protect: { paths: ['/node_modules', '/opt/agent', '/opt/grammars', '/opt/tailscale', '/opt/slicc', '/os'], writers: ['bios-installer'] }` (slicc-kernel ≥ 1.81.0). No process changes them, root included (`EROFS`; a cone sees `EACCES` first), and nothing mounts at, under or above them.
-  - **bios's installs** (pnpm into the base set, `/opt/*` and `/opt/slicc/<project>`, and the `chmod -R a+rX` pass) run as `kernel.run(argv, { cwd, tag: 'bios-installer', env })`. The env is clean: `HOME=/opt/slicc/.installer`, its own config and cache, the system `PNPM_HOME` and `PATH`, and an empty `NODE_OPTIONS`.
+  - **bios's installs** (pnpm into the base set, `/opt/*` and `/opt/slicc/<project>`, and the pass that makes them readable) run as `kernel.run(argv, { cwd, tag: 'bios-installer', env })`. The env is clean: `HOME=/opt/slicc/.installer`, its own config and cache, the system `PNPM_HOME` and `PATH`, and an empty `NODE_OPTIONS`.
   - **pnpm runs with** `--ignore-scripts --ignore-pnpmfile --config.userconfig=/dev/null --config.store-dir=/opt/slicc/.store --config.verify-store-integrity=true`. No locked package in the base set, `/opt/agent`, `/opt/grammars`, `/opt/tailscale` or the data tools has an install script.
   - **The base project** moves out of `/`: its `package.json`, `pnpm-lock.yaml` and `pnpm-workspace.yaml` are in `/opt/slicc/base`, written by the BIOS installer and the in-place update, and pnpm installs it with `--modules-dir=/node_modules` from there. So everything pnpm reads is inside a protected path, and a root process that writes `/package.json`, `/pnpm-lock.yaml`, `/.npmrc` or `/pnpm-workspace.yaml` changes nothing; bios removes those at every boot. A protected project without its own `pnpm-workspace.yaml` gets one, so pnpm's search for a workspace stops inside the tree. The service worker's resolver no longer reads a `package.json` at `/` for `browser` mappings.
   - **The user layers** for `/opt/agent` and `/opt/grammars` are off under `'enforce'`: users can't change those projects any more, and their state is in `/var/lib/slicc`, which the agent can write. They keep working under `'report'`. Your packages live in `/opt/user` instead, which isn't protected (see [Your packages](#your-packages)).
@@ -161,7 +161,7 @@ Spectrum bundles 16 syntax languages; the rest come from `@shikijs/langs` and `@
 1. **Until they're installed,** the UI loads grammars from jsDelivr.
 2. **After every update check,** `os/grammars.js` compares the deployed `packages/grammars/pnpm-lock.yaml` with `var/lib/slicc/grammars/pnpm-lock.yaml`. If they differ, it writes the manifest (merged with the user's layer, see [Your packages](#your-packages)) and lockfile to `/opt/grammars` and runs `pnpm install --frozen-lockfile --trust-lockfile` there, under its own Web Lock, `slicc-grammars`, so a long install never holds up the BIOS in another tab. Only once pnpm succeeds does it record the lockfile.
 
-   It runs in the page's own kernel, like the agent and Tailscale installs and the `chmod -R a+rX` pass, never in a second kernel on the same OPFS root. A second kernel on one root makes both pay for keeping their files in step (slicc-kernel ≥ 1.119.0 made a cold agent install about 3× slower that way). Every bios pnpm run, these installs and the optional packages' `pnpm add -g` and `remove -g`, also takes the Web Lock `slicc-pnpm-store`, so only one pnpm uses the store at a time, in this tab or another.
+   It runs in the page's own kernel, like the agent and Tailscale installs and the pass that makes them readable, never in a second kernel on the same OPFS root. A second kernel on one root makes both pay for keeping their files in step (slicc-kernel ≥ 1.119.0 made a cold agent install about 3× slower that way). Every bios pnpm run, these installs and the optional packages' `pnpm add -g` and `remove -g`, also takes the Web Lock `slicc-pnpm-store`, so only one pnpm uses the store at a time, in this tab or another.
 3. **Once they're installed,** `grammarBase` points at `/opt/grammars/node_modules/@shikijs/`. On later loads the page sets it as soon as the recorded lockfile is there, before any network check, so highlighting works offline. If pnpm fails, the page stays on jsDelivr, the **Syntax grammars** row shows the error with **Retry**, and the next check tries again.
 
 The Files panel lists `/opt/grammars/node_modules` but doesn't scan it.
@@ -177,7 +177,7 @@ Below the system rows, Install / Update offers **Optional packages** (spectrum
 - **Install** runs `pnpm add -g <package>@<version>` in the page's kernel, as a user would, under the Web Lock `slicc-optional`, so the commands work at once in every open shell. pnpm 12 gives each global add its own project under `$PNPM_HOME/global/v11/`; bios reads `PNPM_HOME` from the kernel's environment. Afterwards `os/packages.js` reads that project's `pnpm-lock.yaml`: every package in it, the one added and each dependency, must be a version in the catalog's lockfile or the base set's, with that integrity. homescoop pins `@ai-ecoverse/*` dependencies exactly (uv → Python, git → bash), so the catalog's lockfile names them all. Anything else, a dependency pnpm resolved to another version included, removes the package again and fails the row with *This version doesn't match the tested build*. An entry's `requires` (uv needs Python) are installed first.
 - **State** comes from pnpm's global projects, not from a list of bios's own, so a package installed by hand shows as installed with its version. One older than the catalog's offers **Update**, which adds the catalog's version; one at or above it offers **Remove**. bios never downgrades.
 - **Remove** runs `pnpm remove -g <package>`. It asks first only when another installed entry needs it (*Remove Node.js (jsh)? Browser for jsh scripts needs it and stops working until Node.js (jsh) is back.*, accent); otherwise it doesn't ask, since pnpm's global projects hold no user data and the package can be installed again. A cancelled confirm changes nothing.
-- **Readable by everyone:** after every pnpm install of `/opt/agent`, `/opt/grammars` and an optional project in `/opt/slicc`, bios runs `chmod -R a+rX` on that tree, as root. pnpm writes some files `0600`, such as `node_modules/.pnpm-workspace-state-v1.json`, and with kernel users every user must be able to read seven's installed packages. An install from before this runs the same `chmod` once at its next check, marked by `var/lib/slicc/<project>/readable`.
+- **Readable by everyone:** after every pnpm install of `/opt/agent`, `/opt/grammars` and an optional project in `/opt/slicc`, bios makes that tree readable by everyone, as root: one `find` selects the files without `a+r`, the executables without `a+x` and the directories without `a+x`, and runs `chmod a+rX` on only those, so a tree of 15,000 entries with one `0600` file pays for one walk and one `chmod`, not 15,000. pnpm writes some files `0600`, such as `node_modules/.pnpm-workspace-state-v1.json`, and with kernel users every user must be able to read seven's installed packages. An install from before this runs the same pass once at its next check, marked by `var/lib/slicc/<project>/readable`.
 - **Failures** lead with one sentence and keep pnpm's output, starting with the package and version, under *Install log*, with **Retry**.
 - **Withdrawn and kept as exceptions** (homescoop#858/#859, #864): uv, esbuild, tsc and buf are withdrawn until attested rebuilds. They're retired rows (*No longer offered*, with Remove for an earlier install), and their certs lines are gone. Instead, use `pip` for uv's work for now (uv returns as `@ai-ecoverse/wasi-uv`, Astral's uv, once that's certified), and install esbuild and typescript straight from npm with `pnpm add -g`; buf has no stand-in. **git** and **gh** stay as recorded supply-chain exceptions until their attested rebuilds: their `certs.json` entries carry an `exception` field, which `pins.test.mjs` lists, and any other uncertified pin still fails it.
 - **Python data tools are withdrawn** until numpy and pandas come from verified CI builds (homescoop#826, #730): py-numpy 2.3.2-4 to -10 and py-pandas 2.3.2-5 to -11 came from un-attested local builds, so their certs lines are gone and the catalog has no `pydata` row or project. `retired.json` lists it as a retired `kind: "project"` entry, so an earlier install shows as installed with only **Remove**, which deletes the project, its `.pth` and its receipt. Plain Python stays. The project support below is unchanged for when it returns.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.17.3",
+  "version": "1.17.5",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",
@@ -45,7 +45,7 @@
     "@ai-ecoverse/slicc": "1.44.5",
     "@ai-ecoverse/slicc-browsers": "1.8.4",
     "@ai-ecoverse/slicc-node": "2.5.1",
-    "@ai-ecoverse/slicc-shared-web": "1.23.3",
+    "@ai-ecoverse/slicc-shared-web": "1.24.0",
     "@ai-ecoverse/slicc-spectrum": "1.86.4",
     "@ai-ecoverse/slicc-vault": "1.9.2",
     "@biomejs/biome": "2.5.15",

package/src/packages/certs.json

@@ -95,6 +95,10 @@
     "integrity": "sha512-u/uqQOoXYeFG408UDpFwz4mvUY1ZY0DfFLHJ0SekBSLiI+U6xZusnOCL+rBYGxlA4Wlh5GcyI3pAawSwChtGBA==",
     "sha256": "5590b782ef16297828a55083e79333a73733a96c0447f59174fb798ce5e8bfb7"
   },
+  "@ai-ecoverse/slicc-cdp@1.29.2": {
+    "integrity": "sha512-DxDk2UjUhhsXWCn0NNdw4CZpl6OtaTiVwkrLvdJl3UAC7m1aEn9OZevDkmDYcGd7bGwuw2yj20jMqPjpcoKqWA==",
+    "sha256": "2a210d015b974e9889cfd2e2b0388db37f4dc178fcc541414ec47c4e13add13e"
+  },
   "@ai-ecoverse/slicc-clipboard@1.0.2": {
     "integrity": "sha512-p7b1h85qkiU0LKjNLCLiU7GVXjGigkyR2+VUCInM1cZo2yjLFxr7tGAOO09e6OG9nB7XKiQn3W88wb3s0gxy+g==",
     "sha256": "1bd73c6ae4c5c0dc149ba6a301e7615a78bf4b97ff88c5b0f6eb7d8e270588aa"

package/src/packages/package-lock.json

@@ -7,7 +7,7 @@
       "name": "slicc-bios-packages",
       "dependencies": {
         "@ai-ecoverse/slicc-browsers": "1.8.4",
-        "@ai-ecoverse/slicc-cdp": "1.27.2",
+        "@ai-ecoverse/slicc-cdp": "1.29.2",
         "@ai-ecoverse/slicc-clipboard": "1.0.2",
         "@ai-ecoverse/slicc-kernel": "1.124.2",
         "@ai-ecoverse/slicc-spectrum": "1.86.4",
@@ -46,9 +46,9 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-cdp": {
-      "version": "1.27.2",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-cdp/-/slicc-cdp-1.27.2.tgz",
-      "integrity": "sha512-u/uqQOoXYeFG408UDpFwz4mvUY1ZY0DfFLHJ0SekBSLiI+U6xZusnOCL+rBYGxlA4Wlh5GcyI3pAawSwChtGBA==",
+      "version": "1.29.2",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-cdp/-/slicc-cdp-1.29.2.tgz",
+      "integrity": "sha512-DxDk2UjUhhsXWCn0NNdw4CZpl6OtaTiVwkrLvdJl3UAC7m1aEn9OZevDkmDYcGd7bGwuw2yj20jMqPjpcoKqWA==",
       "license": "Apache-2.0",
       "workspaces": [
         "packages/sliccy-browser"

package/src/packages/package.json

@@ -4,7 +4,7 @@
   "description": "Packages the BIOS installs from npm into OPFS, pinned by package-lock.json and pnpm-lock.yaml",
   "dependencies": {
     "@ai-ecoverse/slicc-browsers": "1.8.4",
-    "@ai-ecoverse/slicc-cdp": "1.27.2",
+    "@ai-ecoverse/slicc-cdp": "1.29.2",
     "@ai-ecoverse/slicc-clipboard": "1.0.2",
     "@ai-ecoverse/slicc-kernel": "1.124.2",
     "@ai-ecoverse/slicc-spectrum": "1.86.4",

package/src/packages/pnpm-lock.yaml

@@ -12,8 +12,8 @@ importers:
         specifier: 1.8.4
         version: 1.8.4
       '@ai-ecoverse/slicc-cdp':
-        specifier: 1.27.2
-        version: 1.27.2
+        specifier: 1.29.2
+        version: 1.29.2
       '@ai-ecoverse/slicc-clipboard':
         specifier: 1.0.2
         version: 1.0.2
@@ -99,8 +99,8 @@ packages:
     resolution: {integrity: sha512-SQGv6pPAsMvnhNI2L7ShDukO2hD61ZZotsTq0PmBVyoglwThB3loSFdUtjUqGI3z6Ds83nZ6UBOSoJVPmqF4Uw==}
     engines: {node: '>=24'}
 
-  '@ai-ecoverse/slicc-cdp@1.27.2':
-    resolution: {integrity: sha512-u/uqQOoXYeFG408UDpFwz4mvUY1ZY0DfFLHJ0SekBSLiI+U6xZusnOCL+rBYGxlA4Wlh5GcyI3pAawSwChtGBA==}
+  '@ai-ecoverse/slicc-cdp@1.29.2':
+    resolution: {integrity: sha512-DxDk2UjUhhsXWCn0NNdw4CZpl6OtaTiVwkrLvdJl3UAC7m1aEn9OZevDkmDYcGd7bGwuw2yj20jMqPjpcoKqWA==}
     engines: {node: '>=24'}
     hasBin: true
 
@@ -202,7 +202,7 @@ snapshots:
 
   '@ai-ecoverse/slicc-browsers@1.8.4': {}
 
-  '@ai-ecoverse/slicc-cdp@1.27.2': {}
+  '@ai-ecoverse/slicc-cdp@1.29.2': {}
 
   '@ai-ecoverse/slicc-clipboard@1.0.2': {}