@ai-ecoverse/slicc-bios 1.26.0 → 1.27.0

package/README.md

@@ -172,7 +172,7 @@ The Files panel lists `/opt/grammars/node_modules` but doesn't scan it.
 
 #### Optional packages
 
-Below the system rows, Install / Update offers **Optional packages** (spectrum ≥ 1.42.0): tools that seven doesn't preinstall, each at the version the homescoop coordinator certified. The catalog is [`src/packages/optional/`](src/packages/optional/): `package.json` pins each package exactly, `package-lock.json` (made with `npm install --package-lock-only --ignore-scripts`, never installed) holds its integrity, and `catalog.json` gives its id, label, description, commands, tarball size and `requires`. A test keeps the three in step. Today it offers git, the GitHub CLI, OpenSSH, `slicc` (see [Sevens this kernel follows](#network)), Python, the Python data tools (numpy, pandas and matplotlib), Node.js (slicc-jsh's `node` and `jsh`), `sliccy:browser` for `.jsh` scripts, Ruby, Perl, Biome, the PDF tools (poppler), qpdf, rsync, screen, SQLite, dig, websocat, ntfy, GnuPG, fnox, mcpcat (an MCP client) and ImageMagick. ImageMagick is homescoop's HEIF build (`wasm-imagemagick-heif`, a superset of the plain build, which isn't offered), with `magick`, `convert`, `mogrify`, `identify` and `magick-open`, and it reads HEIC and AVIF. A failed write leaves an existing target as it was. Its known issues: writing over another user's 0666 file in a sticky directory such as `/tmp` fails with `Operation not permitted`, though writing your own files works ([homescoop#1258](https://github.com/ai-ecoverse/homescoop/issues/1258)); `.mpc` writes fail with `cache resources exhausted` ([homescoop#1208](https://github.com/ai-ecoverse/homescoop/issues/1208)); and the cert's coverage gaps, among them the no-encoder fallback and MPC's two-file write ([homescoop#1209](https://github.com/ai-ecoverse/homescoop/issues/1209)). sudo for `magick`, `convert` or `mogrify` is offered once, never always, since they write files. No two catalog entries provide the same command, so an install never shadows another entry's.
+Below the system rows, Install / Update offers **Optional packages** (spectrum ≥ 1.42.0): tools that seven doesn't preinstall, each at the version the homescoop coordinator certified. The catalog is [`src/packages/optional/`](src/packages/optional/): `package.json` pins each package exactly, `package-lock.json` (made with `npm install --package-lock-only --ignore-scripts`, never installed) holds its integrity, and `catalog.json` gives its id, label, description, commands, tarball size and `requires`. A test keeps the three in step. Today it offers git, the GitHub CLI, OpenSSH, `slicc` (see [Sevens this kernel follows](#network)), Python, the Python data tools (numpy, pandas and matplotlib), Node.js (slicc-jsh's `node` and `jsh`), `sliccy:browser` for `.jsh` scripts, Ruby, Perl, Biome, the PDF tools (poppler), qpdf, rsync, screen, SQLite, dig, websocat, ntfy, GnuPG, fnox, mcpcat (an MCP client), zip (Info-ZIP's `zip`, `unzip` and `zipinfo`), xxd (vim's hex dump, with `xxd -r`) and ImageMagick. zip's `unzip` refuses an entry whose name isn't UTF-8 (an old Latin-1 or CP437 archive without a Unicode path): it says `cannot create <name>` / `Illegal byte sequence`, extracts the other entries and exits 50, and `unzip -l` still lists the entry. It never extracts it under a changed name, and `unzip -p` still streams its bytes ([homescoop#1174](https://github.com/ai-ecoverse/homescoop/issues/1174)). ImageMagick is homescoop's HEIF build (`wasm-imagemagick-heif`, a superset of the plain build, which isn't offered), with `magick`, `convert`, `mogrify`, `identify` and `magick-open`, and it reads HEIC and AVIF. A failed write leaves an existing target as it was. Its known issues: writing over another user's 0666 file in a sticky directory such as `/tmp` fails with `Operation not permitted`, though writing your own files works ([homescoop#1258](https://github.com/ai-ecoverse/homescoop/issues/1258)); `.mpc` writes fail with `cache resources exhausted` ([homescoop#1208](https://github.com/ai-ecoverse/homescoop/issues/1208)); and the cert's coverage gaps, among them the no-encoder fallback and MPC's two-file write ([homescoop#1209](https://github.com/ai-ecoverse/homescoop/issues/1209)). sudo for `magick`, `convert` or `mogrify` is offered once, never always, since they write files. No two catalog entries provide the same command, so an install never shadows another entry's.
 
 - **Install** runs `pnpm add -g <package>@<version>` in the page's kernel, as a user would, under the Web Lock `slicc-optional`, so the commands work at once in every open shell. pnpm 12 gives each global add its own project under `$PNPM_HOME/global/v11/`; bios reads `PNPM_HOME` from the kernel's environment. Afterwards `os/packages.js` reads that project's `pnpm-lock.yaml`: every package in it, the one added and each dependency, must be a version in the catalog's lockfile or the base set's, with that integrity. homescoop pins `@ai-ecoverse/*` dependencies exactly (uv → Python, git → bash), so the catalog's lockfile names them all. Anything else, a dependency pnpm resolved to another version included, removes the package again and fails the row with *This version doesn't match the tested build*. An entry's `requires` (uv needs Python) are installed first. A package's kernel command always wins over the same package's Node `bin`. After each install and update, for every name that a package declares both in `slicc.commands` and in `bin`, bios removes the link that pnpm made in `$PNPM_HOME/bin`, but only when that link points into this package, so `mcpcat` runs `/usr/bin/mcpcat`, not a `#!/usr/bin/env node` script with no Node to run it. Another package's bins are never touched, and a package with only a `bin` keeps it. `/opt/user` (Your packages) isn't affected: its bins are not on `PATH`. A project entry also **updates** a required package that's older than the catalog's before it installs, since it runs on the catalog's version: the data tools override their own Python away, and their builds need the catalog's Python. A global add brings its own pinned dependencies, so it leaves an older required package as it is.
 - **Progress:** a row shows pnpm's package counts once pnpm counts more than one package. Before that, a single package, such as Python, still shows its download in bytes, from pnpm's `Downloading` lines (see [Agent](#agent)). Without either the bar is indeterminate.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.26.0",
+  "version": "1.27.0",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",

package/src/packages/certs.json

@@ -772,5 +772,13 @@
   "@ai-ecoverse/wasm-imagemagick-heif@7.1.2-34-9.1": {
     "integrity": "sha512-0z9FTPGFcO/8cFvCHkBI8kBQLvtjts3WFrhVzI5FQSVeRyZwMCKJZWHmAgiGUiS5q/UbsJF2AI9ocwGgIaJXjw==",
     "sha256": "f8e80e2aa2486a1658e0cdc6eb9c6b675b5615f3ce87b7e609d3e33f66752da5"
+  },
+  "@ai-ecoverse/wasm-xxd@9.2.1192-3": {
+    "integrity": "sha512-CJKX6isuCrz3ZFoKLGQqeqj20aiWNSR8BsbgWtRTmCP4bvlZefmvz8vGIsD4rOdZybdfgIfhPnEEnBdsqiNn4g==",
+    "sha256": "c52394bde7c6d7c531e4d531faf8bcd1911ae1c2ff3b50688ee02ba562c386cd"
+  },
+  "@ai-ecoverse/wasm-zip@3.0.0-7": {
+    "integrity": "sha512-q92s+O0EaT+uGHZZ2ZCffoYfb7ZzlRHd3K+wvXDh2l0V+uBJUZE7VeC+5AZQ5KZ2v80w5h7jZbOiw34EWKW4Dw==",
+    "sha256": "07cf0bd10794be1e5076ab495ff7011484385a1997c6b88fb250581dc48bfc95"
   }
 }

package/src/packages/optional/catalog.json

@@ -169,5 +169,19 @@
     "description": "Convert, resize and inspect images (magick, convert, mogrify, identify), including HEIC/AVIF.",
     "commands": ["magick", "convert", "mogrify", "identify", "magick-open"],
     "size": 11420934
+  },
+  "@ai-ecoverse/wasm-zip": {
+    "id": "zip",
+    "label": "zip",
+    "description": "Create and extract .zip archives (zip, unzip, zipinfo).",
+    "commands": ["zip", "unzip", "zipinfo"],
+    "size": 869325
+  },
+  "@ai-ecoverse/wasm-xxd": {
+    "id": "xxd",
+    "label": "xxd",
+    "description": "Hex dump and reverse (xxd, from vim).",
+    "commands": ["xxd"],
+    "size": 124869
   }
 }

package/src/packages/optional/package-lock.json

@@ -28,7 +28,9 @@
         "@ai-ecoverse/wasm-qpdf": "12.4.2-4",
         "@ai-ecoverse/wasm-rsync": "3.5.1-5",
         "@ai-ecoverse/wasm-screen": "5.0.1-13",
-        "@ai-ecoverse/wasm-sqlite3": "3.54.0-6"
+        "@ai-ecoverse/wasm-sqlite3": "3.54.0-6",
+        "@ai-ecoverse/wasm-xxd": "9.2.1192-3",
+        "@ai-ecoverse/wasm-zip": "3.0.0-7"
       }
     },
     "node_modules/@ai-ecoverse/mcpcat": {
@@ -254,6 +256,18 @@
       "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-sqlite3/-/wasm-sqlite3-3.54.0-6.tgz",
       "integrity": "sha512-R68+igrJTaNAheMY317wTWVlRTWQQIA6WnkFgwc2XKdwDnh23tALEoRSURKXki2VacPknGt3YplY/rl/cCwsaw==",
       "license": "blessing"
+    },
+    "node_modules/@ai-ecoverse/wasm-xxd": {
+      "version": "9.2.1192-3",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-xxd/-/wasm-xxd-9.2.1192-3.tgz",
+      "integrity": "sha512-CJKX6isuCrz3ZFoKLGQqeqj20aiWNSR8BsbgWtRTmCP4bvlZefmvz8vGIsD4rOdZybdfgIfhPnEEnBdsqiNn4g==",
+      "license": "Vim"
+    },
+    "node_modules/@ai-ecoverse/wasm-zip": {
+      "version": "3.0.0-7",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-zip/-/wasm-zip-3.0.0-7.tgz",
+      "integrity": "sha512-q92s+O0EaT+uGHZZ2ZCffoYfb7ZzlRHd3K+wvXDh2l0V+uBJUZE7VeC+5AZQ5KZ2v80w5h7jZbOiw34EWKW4Dw==",
+      "license": "Info-ZIP"
     }
   }
 }

package/src/packages/optional/package.json

@@ -25,6 +25,8 @@
     "@ai-ecoverse/wasm-qpdf": "12.4.2-4",
     "@ai-ecoverse/wasm-rsync": "3.5.1-5",
     "@ai-ecoverse/wasm-screen": "5.0.1-13",
-    "@ai-ecoverse/wasm-sqlite3": "3.54.0-6"
+    "@ai-ecoverse/wasm-sqlite3": "3.54.0-6",
+    "@ai-ecoverse/wasm-xxd": "9.2.1192-3",
+    "@ai-ecoverse/wasm-zip": "3.0.0-7"
   }
 }