@ai-ecoverse/slicc-bios 1.2.1 → 1.3.1

package/README.md

@@ -6,7 +6,7 @@ The page shows six boot steps as they run:
 
 1. **Acquire OPFS** – open the origin private file system and ask for persistent storage.
 2. **Create installer worker** – start `installer.js`, a shared worker that does all of the BIOS's OPFS writes and is shared by every tab.
-3. **Install packages from npm into OPFS** – the installer reads [`src/packages/package-lock.json`](src/packages/package-lock.json), the lockfile the BIOS ships with. It skips packages that name an `os` or `cpu` (native binaries such as esbuild's, which can't run in a browser). For every other locked package it downloads the tarball from `registry.npmjs.org` and checks its `integrity`, then unpacks it with the built-in `DecompressionStream` and [`modern-tar`](https://github.com/ayuhito/modern-tar) into OPFS at its lockfile path (`node_modules/…`), dropping `.` segments from entry names and skipping any entry with `..`. While it unpacks, it hashes every file (SHA-256) and records the hashes in IndexedDB (see [Integrity](#integrity)). It also records a receipt in `var/lib/bios/`. A package whose recorded integrity matches the lockfile's and whose files are still there isn't downloaded again, so pinning a new version replaces just that package. Replacing a package keeps its nested `node_modules`, and packages the lockfile no longer lists are deleted along with their receipts and hashes. A package without recorded hashes is downloaded again, even with a receipt, so the first boot after integrity checks arrived downloads the base set once. Last, the installer copies the deployment's `package.json` and `pnpm-lock.yaml` to the OPFS root for pnpm, and the lockfile once more to `var/lib/slicc/pnpm-lock.yaml`, which records what is installed (see [Updates](#updates)).
+3. **Install packages from npm into OPFS** – the installer reads [`src/packages/package-lock.json`](src/packages/package-lock.json), the lockfile the BIOS ships with. It skips packages that name an `os` or `cpu` (native binaries such as esbuild's, which can't run in a browser). For every other locked package it downloads the tarball from `registry.npmjs.org` and checks its `integrity`, then unpacks it with the built-in `DecompressionStream` and [`modern-tar`](https://github.com/ayuhito/modern-tar) into OPFS at its lockfile path (`node_modules/…`), dropping `.` segments from entry names and skipping any entry with `..`. While it unpacks, it hashes every file (SHA-256) and records the hashes in IndexedDB (see [Integrity](#integrity)). It also keeps each file's mode from the tarball, owned by root: once a package's files are in, it hands their paths and modes to the kernel's `writeMetadata` (`@ai-ecoverse/slicc-kernel/meta`, read from the installed kernel), in one batch per run, so an executable outside `bin/`, such as pnpm's `shims/i`, stays executable when the kernel checks modes. The seed's files are recorded as root's `0644`. A kernel without `/meta` skips this. A package installed before the kernel had `/meta` gets its modes once, on the first run with it: the installer fetches its tarball again, checks its integrity, reads the modes from the headers without unpacking, and marks the receipt (`modes: true`). A package installed or replaced later is marked when it's stamped. It also records a receipt in `var/lib/bios/`. A package whose recorded integrity matches the lockfile's and whose files are still there isn't downloaded again, so pinning a new version replaces just that package. Replacing a package keeps its nested `node_modules`, and packages the lockfile no longer lists are deleted along with their receipts and hashes. A package without recorded hashes is downloaded again, even with a receipt, so the first boot after integrity checks arrived downloads the base set once. Last, the installer copies the deployment's `package.json` and `pnpm-lock.yaml` to the OPFS root for pnpm, and the lockfile once more to `var/lib/slicc/pnpm-lock.yaml`, which records what is installed (see [Updates](#updates)).
 4. **Add UI page to OPFS** – the installer copies `src/seed/` to `os/` in OPFS and records each file's hash. This is a stand-in until the UI ships as a downloadable asset.
 5. **Intercept same-origin requests** – `sw.js`, a module service worker, answers in-scope requests from OPFS and passes everything else to the network (see [What the service worker serves](#what-the-service-worker-serves)). The code it serves from OPFS carries `Cross-Origin-Opener-Policy: same-origin`, `Cross-Origin-Embedder-Policy: require-corp` and `Cross-Origin-Resource-Policy: same-origin`, so the UI page and the workers it starts are cross-origin isolated. Scripts it serves get their bare imports resolved (see [Modules](#modules)).
 6. **Serve UI from OPFS** – navigate to `os/` (keeping the URL fragment) with a cross-document view transition. That page imports [`@ai-ecoverse/slicc-kernel`](https://github.com/ai-ecoverse/slicc-kernel) and [`@ai-ecoverse/slicc-spectrum`](https://github.com/ai-ecoverse/slicc-spectrum) by name from `node_modules/` in OPFS, starts the kernel on the OPFS root and boots SLICC's UI, `<slicc-app>`, on spectrum's kernel model. The agent comes later, from its own pnpm project (see [Agent](#agent)). Commands come from the installed packages: `bash`, coreutils, `grep`, `sed`, findutils, `gawk`, `diff` (with `cmp`, `sdiff` and `diff3`), `patch`, `rg` (ripgrep), `jq`, `less`, `tree`, `tar` with `gzip`, `xz` and `bzip2` (and their `gunzip`, `zcat`, `unxz`, `xzcat`, `lzma`, `bunzip2` and `bzcat` names), `curl`, `mount`, `umount`, `clear`, `tput`, `tset`, `reset`, `pnpm` with its `npm` and `npx` shims, and `playwright-cli` and `curlwright` from slicc-cdp. The shell starts in `/home` as **root** (slicc-kernel ≥ 1.44.0 has users: `/etc/passwd` and `/etc/group` list root, nobody, sudo, users and nogroup), so the prompt ends in `#`, `whoami` and `id` say root, `ls -l` and `ps` show user names, and root's `HOME` is `/root` (mode 0700) with `PNPM_HOME=/usr/local/share/pnpm`. bash, coreutils, procps and git are the homescoop H1 rebuilds that know about users; older builds claimed uid 1000. `tar` forks the compressors for `-z`, `-J` and `-j` through `/bin/sh`. Hard links in archives aren't recreated, and there's no `--zstd`. xz is single-threaded: `-T` is accepted but has no effect. The `zgrep`, `xzgrep` and `bzgrep`-style wrapper scripts aren't installed as commands. Whatever the shell writes stays in OPFS across reloads. The kernel terminates HTTPS with `wasm-tls-engine`, so `curl https://…` works over whichever transport is picked (see [Network](#network)). `wasm-git` is left out for its size (53 MB); it can come later through pnpm.
@@ -64,6 +64,27 @@ A kernel process can still write to `/os/` and `/node_modules/` (any process whi
 
 Each screen class has its own layout, kept in `localStorage` (`slicc-os.layout.<screen>`). On desktop and tablet chat and the terminal share the middle, the agents and files are on the left, and file tabs open between them. On a phone it's chat and the terminal, with chat, the agents and files in the bottom rail. Every panel keeps its rail icon while it's open; while it's visible the icon shows selected (`.selected`, `data-visible`, labelled "{Title}, shown", spectrum ≥ 1.53.0), and a click brings it to the front. The header's tray connection (`#chip`) opens Network at its **Sync** section: the tray's state, the float's name, the join link with **Copy**, the followers, and **Disconnect** (after a confirm) or **Reconnect**. The agent's tray port is a placeholder today (offline, no join link), so the section reads offline; seven's own tray leader shows under Linked devices (see [Network](#network)). Memory opens from the View menu. Changes, the browser and the monitor come back as their backends land. Adobe Clean comes from `/fonts/`, which the sliccy-ai worker serves on every host.
 
+### Kernel users
+
+The kernel runs with users on (slicc-kernel ≥ 1.81.0): files have owners and modes, agents run as their own users, and `sudo` asks the human.
+
+- **The mode:** production seven (`seven.sliccy.ai`) always runs `'enforce'` (`PRODUCTION_USERS` in `os/users.js`). A URL or `localStorage` asking for another mode is ignored there, with a console warning, so nobody can switch seven off from a link. On previews, localhost and in tests the default is `'enforce'` too, and `#users=off`, `#users=report` or `#users=enforce` picks another, remembered in `localStorage['slicc-os.users']`. `'report'` checks every file call and logs what `'enforce'` would refuse, and refuses nothing. `sudo` asks only under `'enforce'`. bios passes the mode to every kernel it creates, `'off'` included, since kernels from K4b on default to `'enforce'`. `<html data-users>` says which mode is on.
+- **Who is who:** the human's panel terminals are root (`/root`, mode 0700). With users on, bios adds the first cone, `cone`, at every boot: in `sudo`, home `0710`, umask `077`. The agent adds further cones and scoops through its `KernelSource`. The file tree skips `~/.local/share/pnpm` and `~/.cache` of every home in `/etc/passwd`.
+- **Folders** bios mounts (picked in the Files panel, remembered, or linked) belong to the first cone, so the agent can write them, and to root while users are off.
+- **Files from before users:** agents start on the new layout; nothing is moved. On the first boot with users on, bios runs `chmod -R go-rwx` as root, once, on what earlier versions left readable to everyone: `/home/.pi`, `/home/.slicc`, `/home/sprinkles`, `/home/.gelatiere`, `/home/.welcomed`, `/home/.welcome.json`, `/home/sessions`, `/home/.local` and `/scoops`. So no cone or scoop reads an old `mcp.json` with its tokens, and root still reads everything. The marker `var/lib/slicc/legacy-locked` keeps it from running again; cone and scoop homes and other files in `/home` aren't touched.
+- **The agent's `KernelSource`** (`os/users.js`) passes `connect({ user, agentId })`, `users` and `groups` to the kernel, only for agent users. It refuses root and any user but `cone`, `cone-<n>` and `scoop-<folder>`, requires the agentId to match the user exactly (`cone:cone`, `cone:cone-2`, `scoop:<folder>`), and allows groups only of cones and `sudo` only for cones. A cone is always added to `sudo`, even when the caller leaves it out, since sudo membership is what makes a cone (the vault's J2 rule). The tag is `{"kind":"agent","agentId":…}` as JSON, and the agent's root client carries `{"kind":"agent","agentId":"root"}`; a panel terminal's is `{"kind":"user","where":"terminal:<tab>"}`.
+- **Protected code paths:** under `'enforce'`, the kernel gets `protect: { paths: ['/node_modules', '/opt/agent', '/opt/grammars', '/opt/tailscale', '/opt/slicc', '/os'], writers: ['bios-installer'] }` (slicc-kernel ≥ 1.81.0), the install kernels too. No process changes them, root included (`EROFS`; a cone sees `EACCES` first), and nothing mounts at, under or above them.
+  - **bios's installs** (pnpm into the base set, `/opt/*` and `/opt/slicc/<project>`, and the `chmod -R a+rX` pass) run as `kernel.run(argv, { cwd, tag: 'bios-installer', env })`. The env is clean: `HOME=/opt/slicc/.installer`, its own config and cache, the system `PNPM_HOME` and `PATH`, and an empty `NODE_OPTIONS`.
+  - **pnpm runs with** `--ignore-scripts --ignore-pnpmfile --config.userconfig=/dev/null --config.store-dir=/opt/slicc/.store --config.verify-store-integrity=true`. No locked package in the base set, `/opt/agent`, `/opt/grammars`, `/opt/tailscale` or the data tools has an install script.
+  - **The base project** moves out of `/`: its `package.json`, `pnpm-lock.yaml` and `pnpm-workspace.yaml` are in `/opt/slicc/base`, written by the BIOS installer and the in-place update, and pnpm installs it with `--modules-dir=/node_modules` from there. So everything pnpm reads is inside a protected path, and a root process that writes `/package.json`, `/pnpm-lock.yaml`, `/.npmrc` or `/pnpm-workspace.yaml` changes nothing; bios removes those at every boot. A protected project without its own `pnpm-workspace.yaml` gets one, so pnpm's search for a workspace stops inside the tree. The service worker's resolver no longer reads a `package.json` at `/` for `browser` mappings.
+  - **The user layer** (Your packages) for `/opt/*` is off under `'enforce'`: users can't change those projects any more, and its state is in `/var/lib/slicc`, which the agent can write. It keeps working under `'report'`.
+  - **Under `'report'`** nothing is protected, since protection has no report mode of its own. Installs already run as tagged writers from `/opt/slicc/base` with the clean config, and bios watches the six trees through the kernel (`fs.watch`, recursive). Each change made through the page's kernel outside bios's own installs goes to `denials.log` as `op: 'protect'`, `errno: 'EROFS'`: a write that `'enforce'` would refuse. The watch doesn't say which process wrote, so these lines have no user and no tag. Changes made outside the page's kernel (bios's install kernels, the page itself) aren't seen.
+  - **Global packages** (`pnpm add -g` into `/usr/local/share/pnpm`) aren't protected and run untagged.
+  - **A remembered mount** (`slicc-os.mounts`) at, under or above a protected path is dropped at boot under `'enforce'`, with a notice, *A remembered folder wasn’t mounted*.
+- **Sudo approvals:** the kernel's `approve` hook feeds `model.approvals`, spectrum's sudo dialog. It shows the resolved path and arguments, shell-quoted, the directory, the requester mapped from the tag, the target and *Always allow*. Every tab shows the request (`BroadcastChannel('slicc-approvals')`), and the first decision wins; the other tabs see *Answered in another tab*. *Always allow* is offered only for a command bios trusts to run the same way every time: the kernel's resolved path, whose real path and every directory above it are root's and not group- or other-writable (checked by a root `stat` when the request comes), that isn't a shell, interpreter or wrapper (`bash`, `python*`, `node`, `env`, `xargs`, `sudo`, `timeout`, `find -exec` and the like), doesn't write named files (`tee`, `cp`, `mv`, `chmod`, `dd`, `sed -i`, `tar -x`, `git`, `pnpm` and the like), whose operands are all absolute, inside none of `/tmp`, `/var/tmp`, `/home`, `/mnt`, `/scoops` and `/dev/shm`, and not user-writable (a file that isn't root's or is group- or other-writable, a directory above that is, or a missing path whose parent is), with no shell metacharacter in any argument, and which may not change the secret rules. Everything else gets *Allow once* only. A request that may change the secret rules never offers *Always allow* either. bios decides that at least as broadly as spectrum's dialog: it runs the dialog's own classifier (`os/rules.js`, a port of spectrum 1.62's until spectrum exports it), its own path check (`/etc/fnox`, `/etc/slicc/secrets-policy.toml`, and for a command that isn't read-only `/`, `/etc`, `/etc/slicc`, a name with `fnox` or `secrets-policy`, a glob or `..`), and treats any `$`, backtick, quote or backslash in an argument, and any quoting or `cd` inside a `-c` script, as a possible change. For such a request bios sends `always: false`, and answers an `always` for it, from any tab, as `once`, so no `NOPASSWD` line is written for it.
+- **Denials:** denials under `'report'` and `'enforce'` go to `/var/log/slicc/denials.log`, one JSON line per distinct `(uid, tag, op, path, errno)` with its `count`, `first` and last `time`, plus `user`, `tag` (the process's tag, `null` for an untagged one) and `mode`. They're written within a quarter of a second, at every 100 distinct denials, and when the page is hidden (`visibilitychange`). When the page goes away (`pagehide`), the ones not yet written are kept in `localStorage` (`slicc.denials.spool.*`), and the next page writes them once its kernel is up. The log rotates to `denials.log.1` at 1 MiB. `slicc-denials` (in `/usr/local/bin`) sums up the log and its `.1`: the total and time span, then counts by tag kind (`agent`, `user`, `untagged`), op, errno and path prefix; `--json` prints the same as one object.
+- **Not a boundary:** the kernel's loopback (`<port>.kernel.localhost`) isn't one between users (N2). A server any user starts is reachable by every process and by seven's pages.
+
 ### Folder mounts
 
 A local folder can be mounted into seven as on Linux ([#73](https://github.com/ai-ecoverse/slicc-bios/issues/73)). `os/mounts.js` gives slicc-kernel the hooks it needs:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.2.1",
+  "version": "1.3.1",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",

package/src/packages/agent/package.json

@@ -4,6 +4,6 @@
   "description": "SLICC's agent, which the UI installs with pnpm in the background into /opt/agent in OPFS",
   "dependencies": {
     "@ai-ecoverse/slicc-agent": "3.50.2",
-    "@ai-ecoverse/slicc-kernel": "1.81.0"
+    "@ai-ecoverse/slicc-kernel": "1.90.0"
   }
 }

package/src/packages/agent/pnpm-lock.yaml

@@ -14,10 +14,10 @@ importers:
     dependencies:
       '@ai-ecoverse/slicc-agent':
         specifier: 3.50.2
-        version: 3.50.2(@ai-ecoverse/slicc-kernel@1.81.0)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
+        version: 3.50.2(@ai-ecoverse/slicc-kernel@1.90.0)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
       '@ai-ecoverse/slicc-kernel':
-        specifier: 1.81.0
-        version: 1.81.0
+        specifier: 1.90.0
+        version: 1.90.0
 
 packages:
 
@@ -35,8 +35,8 @@ packages:
     resolution: {integrity: sha512-H+K/cAMqVCPHKycoM68ZW/jDaOBcmqbMR4mVeBKP/L2Tb5U4dX15vcJ/EmFyBvA2XwYDM40KToJSWMUgK/Q/dg==}
     engines: {node: '>=24'}
 
-  '@ai-ecoverse/slicc-kernel@1.81.0':
-    resolution: {integrity: sha512-hc1KHvrTaSS7nHS2D+0yX0oTs5Tx5gs0yQJOExK0nWSqjO8Dkefp5P013ucYkTeBXR3o9M3xVyayCU/4LbySjQ==}
+  '@ai-ecoverse/slicc-kernel@1.90.0':
+    resolution: {integrity: sha512-s0NTSl62qVEd4p4r6wpAcyKbBPCdFjBmE4ouHF7QuZjXs95p8oT27+Br1aJqJs31ytp+rrNsork1sYknHwftoQ==}
     engines: {node: '>=24'}
 
   '@anthropic-ai/sdk@0.129.0':
@@ -327,10 +327,10 @@ packages:
 
 snapshots:
 
-  '@ai-ecoverse/slicc-agent@3.50.2(@ai-ecoverse/slicc-kernel@1.81.0)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
+  '@ai-ecoverse/slicc-agent@3.50.2(@ai-ecoverse/slicc-kernel@1.90.0)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
     dependencies:
       '@ai-ecoverse/slicc-browsers': 1.5.0
-      '@ai-ecoverse/slicc-kernel': 1.81.0
+      '@ai-ecoverse/slicc-kernel': 1.90.0
       '@earendil-works/chord': 1.0.4
       '@earendil-works/pi-ai': 1.0.4(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
       '@earendil-works/pi-client': 1.0.4
@@ -352,7 +352,7 @@ snapshots:
 
   '@ai-ecoverse/slicc-browsers@1.5.0': {}
 
-  '@ai-ecoverse/slicc-kernel@1.81.0': {}
+  '@ai-ecoverse/slicc-kernel@1.90.0': {}
 
   '@anthropic-ai/sdk@0.129.0':
     dependencies:

package/src/packages/certs.json

@@ -187,6 +187,10 @@
     "integrity": "sha512-RtQDIkwIybl0Wnwt+qXjjmFM65Y+yTaBGlFw3E9W3cjxlJ/9g3A55KUfGPal0blySolcUN9f647hL+28QEhS5Q==",
     "sha256": "ee8aa10105f50d7ab38010d276f34311a3daeefad1f27646f473a233c0d0cf77"
   },
+  "@ai-ecoverse/slicc-jsh@0.25.0": {
+    "integrity": "sha512-mHIWDkF/E1hfVDMn6ZcfhWH+oH7voR5FpNMXp4w8t5LaAAsMfjBtnGVrarqJT7GM74IIko6HiXcZffKRKqUuBw==",
+    "sha256": "d47f0d2c6db3f81d8bc9e09b58ed69ac1ee9a19847956d243919c6a56679d377"
+  },
   "@ai-ecoverse/slicc-kernel@1.53.3": {
     "integrity": "sha512-bGAzgiz/V3cAtKumrK6Fu1raUdIA4Jkcm5ni3deNlfoATDZX+fY7khICHrxknpFT4knJS2AhhmUzAIR1IGFAjw==",
     "sha256": "2ef150188e4b6f983b7d3af3db4ac63c884471642f11e828ca4d05396c74d3c5"
@@ -231,6 +235,14 @@
     "integrity": "sha512-hc1KHvrTaSS7nHS2D+0yX0oTs5Tx5gs0yQJOExK0nWSqjO8Dkefp5P013ucYkTeBXR3o9M3xVyayCU/4LbySjQ==",
     "sha256": "5d46797a1c82efb72861ca670209a2b813225bcfbf07a83037ea66ab80ce0b93"
   },
+  "@ai-ecoverse/slicc-kernel@1.86.0": {
+    "integrity": "sha512-CTwPwXjD31pLXm297tR4UsteH+9p4oiPFVYghgQ1gaJsOCnpvDzN8f6Nf8TY/3X4ExKeti6UaHL/TK09qALDeg==",
+    "sha256": "dfff59a48ccb2ed73bef4780ce3dc2d399f03fabdc2ce6f04b83ebcb86f52eb6"
+  },
+  "@ai-ecoverse/slicc-kernel@1.90.0": {
+    "integrity": "sha512-s0NTSl62qVEd4p4r6wpAcyKbBPCdFjBmE4ouHF7QuZjXs95p8oT27+Br1aJqJs31ytp+rrNsork1sYknHwftoQ==",
+    "sha256": "a0536d4078f985ef07728c2b4fb993c012ab1afdecb60e6e352b474e150a944f"
+  },
   "@ai-ecoverse/wasi-biome@2.5.15-2": {
     "integrity": "sha512-5oIfngw8Ln2/ddCJ0wtqMoSnW+UO2zuih0+x1CNDbwKkB18TxuWoI60QFQySjd69N6eP+blL/stz/AZyoYpeuw==",
     "sha256": "25599e4317ec2e7ca9a447ff99ac01f271358cd06bd2d727e6b28b10c05bf44a"

package/src/packages/optional/catalog.json

@@ -47,9 +47,9 @@
   "@ai-ecoverse/slicc-jsh": {
     "id": "node",
     "label": "Node.js (jsh)",
-    "description": "Node.js 22-compatible node and jsh commands: fs, streams, http, fetch, WebSocket, zlib, crypto and child_process, the sync calls (spawnSync, execSync, execFileSync) and detached spawns included, without fork, tls, worker or asymmetric crypto yet. fetch() reaches servers inside seven (localhost, <port>.kernel.localhost), though a response that never ends, such as SSE, hangs it. node with no arguments opens the REPL.",
+    "description": "Node.js 22-compatible node and jsh commands: fs (chmod included), streams, http, fetch, WebSocket, zlib, crypto and child_process, the sync calls (spawnSync, execSync, execFileSync) and detached spawns included, without fork, tls, worker or asymmetric crypto yet. fetch() reaches servers inside seven (localhost, <port>.kernel.localhost) and streams their responses. A loopback http.Agent with a finite maxSockets can hang after that many requests. node with no arguments opens the REPL.",
     "commands": ["node", "jsh"],
-    "size": 1023257
+    "size": 1073736
   },
   "@ai-ecoverse/wasix-ruby": {
     "id": "ruby",

package/src/packages/optional/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "slicc-bios-optional",
       "dependencies": {
-        "@ai-ecoverse/slicc-jsh": "0.19.0",
+        "@ai-ecoverse/slicc-jsh": "0.25.0",
         "@ai-ecoverse/wasi-biome": "2.5.15-2",
         "@ai-ecoverse/wasi-buf": "1.73.0-2",
         "@ai-ecoverse/wasi-dig": "0.1.0-1",
@@ -28,9 +28,9 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-jsh": {
-      "version": "0.19.0",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-jsh/-/slicc-jsh-0.19.0.tgz",
-      "integrity": "sha512-RtQDIkwIybl0Wnwt+qXjjmFM65Y+yTaBGlFw3E9W3cjxlJ/9g3A55KUfGPal0blySolcUN9f647hL+28QEhS5Q==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-jsh/-/slicc-jsh-0.25.0.tgz",
+      "integrity": "sha512-mHIWDkF/E1hfVDMn6ZcfhWH+oH7voR5FpNMXp4w8t5LaAAsMfjBtnGVrarqJT7GM74IIko6HiXcZffKRKqUuBw==",
       "license": "Apache-2.0",
       "bin": {
         "jsh": "dist/host/jsh.mjs"

package/src/packages/optional/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "description": "The certified versions of the optional packages that seven's Install / Update panel offers. Never installed as a project: the panel runs pnpm add -g for each one.",
   "dependencies": {
-    "@ai-ecoverse/slicc-jsh": "0.19.0",
+    "@ai-ecoverse/slicc-jsh": "0.25.0",
     "@ai-ecoverse/wasi-biome": "2.5.15-2",
     "@ai-ecoverse/wasi-buf": "1.73.0-2",
     "@ai-ecoverse/wasi-dig": "0.1.0-1",

package/src/packages/package-lock.json

@@ -9,7 +9,7 @@
         "@ai-ecoverse/slicc-browsers": "1.7.1",
         "@ai-ecoverse/slicc-cdp": "1.11.2",
         "@ai-ecoverse/slicc-clipboard": "1.0.2",
-        "@ai-ecoverse/slicc-kernel": "1.81.0",
+        "@ai-ecoverse/slicc-kernel": "1.90.0",
         "@ai-ecoverse/slicc-spectrum": "1.68.0",
         "@ai-ecoverse/wasi-pnpm": "12.9.1-8",
         "@ai-ecoverse/wasi-ripgrep": "15.2.0-3",
@@ -68,9 +68,9 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-kernel": {
-      "version": "1.81.0",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-kernel/-/slicc-kernel-1.81.0.tgz",
-      "integrity": "sha512-hc1KHvrTaSS7nHS2D+0yX0oTs5Tx5gs0yQJOExK0nWSqjO8Dkefp5P013ucYkTeBXR3o9M3xVyayCU/4LbySjQ==",
+      "version": "1.90.0",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-kernel/-/slicc-kernel-1.90.0.tgz",
+      "integrity": "sha512-s0NTSl62qVEd4p4r6wpAcyKbBPCdFjBmE4ouHF7QuZjXs95p8oT27+Br1aJqJs31ytp+rrNsork1sYknHwftoQ==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=24"

package/src/packages/package.json

@@ -6,7 +6,7 @@
     "@ai-ecoverse/slicc-browsers": "1.7.1",
     "@ai-ecoverse/slicc-cdp": "1.11.2",
     "@ai-ecoverse/slicc-clipboard": "1.0.2",
-    "@ai-ecoverse/slicc-kernel": "1.81.0",
+    "@ai-ecoverse/slicc-kernel": "1.90.0",
     "@ai-ecoverse/slicc-spectrum": "1.68.0",
     "@ai-ecoverse/wasi-pnpm": "12.9.1-8",
     "@ai-ecoverse/wasi-ripgrep": "15.2.0-3",

package/src/packages/pnpm-lock.yaml

@@ -18,8 +18,8 @@ importers:
         specifier: 1.0.2
         version: 1.0.2
       '@ai-ecoverse/slicc-kernel':
-        specifier: 1.81.0
-        version: 1.81.0
+        specifier: 1.90.0
+        version: 1.90.0
       '@ai-ecoverse/slicc-spectrum':
         specifier: 1.68.0
         version: 1.68.0
@@ -107,8 +107,8 @@ packages:
     resolution: {integrity: sha512-p7b1h85qkiU0LKjNLCLiU7GVXjGigkyR2+VUCInM1cZo2yjLFxr7tGAOO09e6OG9nB7XKiQn3W88wb3s0gxy+g==}
     engines: {node: '>=24', slicc-kernel: '>=1.75.0'}
 
-  '@ai-ecoverse/slicc-kernel@1.81.0':
-    resolution: {integrity: sha512-hc1KHvrTaSS7nHS2D+0yX0oTs5Tx5gs0yQJOExK0nWSqjO8Dkefp5P013ucYkTeBXR3o9M3xVyayCU/4LbySjQ==}
+  '@ai-ecoverse/slicc-kernel@1.90.0':
+    resolution: {integrity: sha512-s0NTSl62qVEd4p4r6wpAcyKbBPCdFjBmE4ouHF7QuZjXs95p8oT27+Br1aJqJs31ytp+rrNsork1sYknHwftoQ==}
     engines: {node: '>=24'}
 
   '@ai-ecoverse/slicc-spectrum@1.68.0':
@@ -205,7 +205,7 @@ snapshots:
 
   '@ai-ecoverse/slicc-clipboard@1.0.2': {}
 
-  '@ai-ecoverse/slicc-kernel@1.81.0': {}
+  '@ai-ecoverse/slicc-kernel@1.90.0': {}
 
   '@ai-ecoverse/slicc-spectrum@1.68.0': {}