@ai-ecoverse/slicc-bios 1.24.2 → 1.25.0

package/README.md

@@ -172,7 +172,7 @@ The Files panel lists `/opt/grammars/node_modules` but doesn't scan it.
 
 #### Optional packages
 
-Below the system rows, Install / Update offers **Optional packages** (spectrum ≥ 1.42.0): tools that seven doesn't preinstall, each at the version the homescoop coordinator certified. The catalog is [`src/packages/optional/`](src/packages/optional/): `package.json` pins each package exactly, `package-lock.json` (made with `npm install --package-lock-only --ignore-scripts`, never installed) holds its integrity, and `catalog.json` gives its id, label, description, commands, tarball size and `requires`. A test keeps the three in step. Today it offers git, the GitHub CLI, OpenSSH, `slicc` (see [Sevens this kernel follows](#network)), Python, the Python data tools (numpy, pandas and matplotlib), Node.js (slicc-jsh's `node` and `jsh`), `sliccy:browser` for `.jsh` scripts, Ruby, Perl, Biome, the PDF tools (poppler), qpdf, rsync, screen, SQLite, dig, websocat, ntfy, GnuPG, fnox and mcpcat (an MCP client).
+Below the system rows, Install / Update offers **Optional packages** (spectrum ≥ 1.42.0): tools that seven doesn't preinstall, each at the version the homescoop coordinator certified. The catalog is [`src/packages/optional/`](src/packages/optional/): `package.json` pins each package exactly, `package-lock.json` (made with `npm install --package-lock-only --ignore-scripts`, never installed) holds its integrity, and `catalog.json` gives its id, label, description, commands, tarball size and `requires`. A test keeps the three in step. Today it offers git, the GitHub CLI, OpenSSH, `slicc` (see [Sevens this kernel follows](#network)), Python, the Python data tools (numpy, pandas and matplotlib), Node.js (slicc-jsh's `node` and `jsh`), `sliccy:browser` for `.jsh` scripts, Ruby, Perl, Biome, the PDF tools (poppler), qpdf, rsync, screen, SQLite, dig, websocat, ntfy, GnuPG, fnox, mcpcat (an MCP client) and ImageMagick. ImageMagick is homescoop's HEIF build (`wasm-imagemagick-heif`, a superset of the plain build, which isn't offered), with `magick`, `convert`, `mogrify`, `identify` and `magick-open`, and it reads HEIC and AVIF. A failed write leaves an existing target as it was. Its known issues: writing over another user's 0666 file in a sticky directory such as `/tmp` fails with `Operation not permitted`, though writing your own files works ([homescoop#1258](https://github.com/ai-ecoverse/homescoop/issues/1258)); `.mpc` writes fail with `cache resources exhausted` ([homescoop#1208](https://github.com/ai-ecoverse/homescoop/issues/1208)); and the cert's coverage gaps, among them the no-encoder fallback and MPC's two-file write ([homescoop#1209](https://github.com/ai-ecoverse/homescoop/issues/1209)). sudo for `magick`, `convert` or `mogrify` is offered once, never always, since they write files. No two catalog entries provide the same command, so an install never shadows another entry's.
 
 - **Install** runs `pnpm add -g <package>@<version>` in the page's kernel, as a user would, under the Web Lock `slicc-optional`, so the commands work at once in every open shell. pnpm 12 gives each global add its own project under `$PNPM_HOME/global/v11/`; bios reads `PNPM_HOME` from the kernel's environment. Afterwards `os/packages.js` reads that project's `pnpm-lock.yaml`: every package in it, the one added and each dependency, must be a version in the catalog's lockfile or the base set's, with that integrity. homescoop pins `@ai-ecoverse/*` dependencies exactly (uv → Python, git → bash), so the catalog's lockfile names them all. Anything else, a dependency pnpm resolved to another version included, removes the package again and fails the row with *This version doesn't match the tested build*. An entry's `requires` (uv needs Python) are installed first. A package's kernel command always wins over the same package's Node `bin`. After each install and update, for every name that a package declares both in `slicc.commands` and in `bin`, bios removes the link that pnpm made in `$PNPM_HOME/bin`, but only when that link points into this package, so `mcpcat` runs `/usr/bin/mcpcat`, not a `#!/usr/bin/env node` script with no Node to run it. Another package's bins are never touched, and a package with only a `bin` keeps it. `/opt/user` (Your packages) isn't affected: its bins are not on `PATH`. A project entry also **updates** a required package that's older than the catalog's before it installs, since it runs on the catalog's version: the data tools override their own Python away, and their builds need the catalog's Python. A global add brings its own pinned dependencies, so it leaves an older required package as it is.
 - **State** comes from pnpm's global projects, not from a list of bios's own, so a package installed by hand shows as installed with its version. One older than the catalog's offers **Update**, which adds the catalog's version; one at or above it offers **Remove**. bios never downgrades.
@@ -487,6 +487,15 @@ Limits:
 
 [`src/packages/certs.json`](src/packages/certs.json) lists every certified version of the gated packages: slicc-kernel, slicc-cdp, mcpcat, and the `wasi-*`, `wasix-*`, `wasm-*` and `py-*` packages. Each entry has its npm integrity, and its tarball sha256 where the cert gave one. `test/integration/pins.test.mjs` fails when any lockfile seven ships (the base set, `/opt/agent`, the optional catalog with its nested dependencies, and Tailscale) pins a gated package that isn't listed there with the same integrity. It also fails when a pinned package's `engines.slicc-kernel` or kernel peer range isn't met by the pinned kernel. An uncertified bump, from Renovate or anyone, turns CI red. When homescoop (or the CDP coordinator, for slicc-cdp) certifies a version, add it here in the same PR that pins it.
 
+### Renovate keeps the pins current
+
+[`renovate.json`](renovate.json) bumps every `@ai-ecoverse/*` pin in the base set (`src/packages/package.json`), the optional catalog (`src/packages/optional/package.json`) and `/opt/agent` (`src/packages/agent/package.json`), with their npm and pnpm lockfiles.
+
+- **PRs:** homescoop's packages (`wasi-*`, `wasix-*`, `wasm-*`, `py-*`, `wasi-pnpm` included) come as one PR a day, between 00:00 and 06:00 UTC. The kernel (its base-set and `/opt/agent` pins together), slicc-cdp, slicc-agent, slicc-spectrum and slicc-jsh each get their own PR, and so does every other package. The grammars and Tailscale projects stay on the dependency dashboard.
+- **Automerge only when certified:** Renovate turns on auto-merge, so a PR goes through the merge queue once `ci / test` is green. On a Renovate PR, `ci / test` ends with [`scripts/ci/certified.mjs`](scripts/ci/certified.mjs). It fails unless, for each `@ai-ecoverse` pin the PR changes in those three files, the latest cert review comment that names it (posted by `github-actions[bot]`, with `sha check ok`) has its `certified` line. Its verdict line is `cert-gate: CERTIFIED …`, `cert-gate: FAIL …` or `cert-gate: PASS <why it doesn't apply>`. So the first CI run of such a PR is red.
+- **Then cert review** (the `workflow_run` after CI) writes its verdict. After a certified verdict, its `cert / queue` job runs [`scripts/cert/apply.mjs`](scripts/cert/apply.mjs) from the base, which runs no code from the PR. That script runs the sha check again and adds each certified `certs.json:` line for a gated package that the PR's lockfiles pin with that integrity. The job commits the lines to the Renovate branch as `github-actions[bot]`, whose email is in `gitIgnoredAuthors`, so Renovate keeps rebasing the branch. Then it dispatches CI on it (`workflow_dispatch` with `pr`), since a push with `GITHUB_TOKEN` starts no workflow. That run's `ci / test` counts for the PR's head, and the queue takes it from there.
+- **Known breaks** are `packageRules` with `allowedVersions`, each with its reason and issue in `description`: wasm-bash stays below 5.3.0-20 until a kernel with slicc-kernel#1146 is pinned, and wasi-pnpm skips the deprecated 12.9.1-11 and 12.9.1-12 (homescoop#1128). `test/integration/renovate.test.mjs` checks the config, the gate and the queue in plain node.
+
 ### Canary
 
 [`.github/workflows/canary.yml`](.github/workflows/canary.yml) answers "is bios main green with these candidate versions?" before anyone asks for a pin. It never pushes, pins or opens a PR: it reports.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.24.2",
+  "version": "1.25.0",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",

package/src/packages/certs.json

@@ -768,5 +768,9 @@
   "@ai-ecoverse/mcpcat@0.16.3": {
     "integrity": "sha512-Sah/qC/1x31WKsVK+tyHYSdV8StFLpZEmuNyWqu2inbK19IL7ZyZyOb+85CGVAG1+ZRdXfE1y0eUAQuu0jnm3w==",
     "sha256": "d492f978d7f0925378369feaddb2925f9220169b965c3a7b0a2854acd6668bc3"
+  },
+  "@ai-ecoverse/wasm-imagemagick-heif@7.1.2-34-9.1": {
+    "integrity": "sha512-0z9FTPGFcO/8cFvCHkBI8kBQLvtjts3WFrhVzI5FQSVeRyZwMCKJZWHmAgiGUiS5q/UbsJF2AI9ocwGgIaJXjw==",
+    "sha256": "f8e80e2aa2486a1658e0cdc6eb9c6b675b5615f3ce87b7e609d3e33f66752da5"
   }
 }

package/src/packages/optional/catalog.json

@@ -162,5 +162,12 @@
     "description": "Calls MCP servers from the terminal: lists and calls their tools, resources and prompts, over HTTP or a stdio command. In a header, -H 'Authorization: Bearer ${NAME}' (single quotes) sends the vault's placeholder, which the vault fills in where a secret rule allows that host; mcpcat never prints the value.",
     "commands": ["mcpcat"],
     "size": 589050
+  },
+  "@ai-ecoverse/wasm-imagemagick-heif": {
+    "id": "imagemagick",
+    "label": "ImageMagick",
+    "description": "Convert, resize and inspect images (magick, convert, mogrify, identify), including HEIC/AVIF.",
+    "commands": ["magick", "convert", "mogrify", "identify", "magick-open"],
+    "size": 11420934
   }
 }

package/src/packages/optional/package-lock.json

@@ -22,6 +22,7 @@
         "@ai-ecoverse/wasix-ruby": "3.4.11-20",
         "@ai-ecoverse/wasix-websocat": "4.0.0-alpha3-5",
         "@ai-ecoverse/wasm-git": "2.55.0-17",
+        "@ai-ecoverse/wasm-imagemagick-heif": "7.1.2-34-9.1",
         "@ai-ecoverse/wasm-libheif": "1.23.6-6",
         "@ai-ecoverse/wasm-poppler": "26.10.0-5",
         "@ai-ecoverse/wasm-qpdf": "12.4.2-4",
@@ -206,6 +207,15 @@
         "slicc-kernel": ">=1.47.1"
       }
     },
+    "node_modules/@ai-ecoverse/wasm-imagemagick-heif": {
+      "version": "7.1.2-34-9.1",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-imagemagick-heif/-/wasm-imagemagick-heif-7.1.2-34-9.1.tgz",
+      "integrity": "sha512-0z9FTPGFcO/8cFvCHkBI8kBQLvtjts3WFrhVzI5FQSVeRyZwMCKJZWHmAgiGUiS5q/UbsJF2AI9ocwGgIaJXjw==",
+      "license": "ImageMagick AND LGPL-3.0-or-later AND BSD-2-Clause",
+      "engines": {
+        "slicc-kernel": ">=1.78.0"
+      }
+    },
     "node_modules/@ai-ecoverse/wasm-libheif": {
       "version": "1.23.6-6",
       "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-libheif/-/wasm-libheif-1.23.6-6.tgz",

package/src/packages/optional/package.json

@@ -19,6 +19,7 @@
     "@ai-ecoverse/wasix-ruby": "3.4.11-20",
     "@ai-ecoverse/wasix-websocat": "4.0.0-alpha3-5",
     "@ai-ecoverse/wasm-git": "2.55.0-17",
+    "@ai-ecoverse/wasm-imagemagick-heif": "7.1.2-34-9.1",
     "@ai-ecoverse/wasm-libheif": "1.23.6-6",
     "@ai-ecoverse/wasm-poppler": "26.10.0-5",
     "@ai-ecoverse/wasm-qpdf": "12.4.2-4",