@ai-ecoverse/slicc-bios 1.26.0 → 1.27.1

package/README.md

@@ -172,7 +172,7 @@ The Files panel lists `/opt/grammars/node_modules` but doesn't scan it.
 
 #### Optional packages
 
-Below the system rows, Install / Update offers **Optional packages** (spectrum ≥ 1.42.0): tools that seven doesn't preinstall, each at the version the homescoop coordinator certified. The catalog is [`src/packages/optional/`](src/packages/optional/): `package.json` pins each package exactly, `package-lock.json` (made with `npm install --package-lock-only --ignore-scripts`, never installed) holds its integrity, and `catalog.json` gives its id, label, description, commands, tarball size and `requires`. A test keeps the three in step. Today it offers git, the GitHub CLI, OpenSSH, `slicc` (see [Sevens this kernel follows](#network)), Python, the Python data tools (numpy, pandas and matplotlib), Node.js (slicc-jsh's `node` and `jsh`), `sliccy:browser` for `.jsh` scripts, Ruby, Perl, Biome, the PDF tools (poppler), qpdf, rsync, screen, SQLite, dig, websocat, ntfy, GnuPG, fnox, mcpcat (an MCP client) and ImageMagick. ImageMagick is homescoop's HEIF build (`wasm-imagemagick-heif`, a superset of the plain build, which isn't offered), with `magick`, `convert`, `mogrify`, `identify` and `magick-open`, and it reads HEIC and AVIF. A failed write leaves an existing target as it was. Its known issues: writing over another user's 0666 file in a sticky directory such as `/tmp` fails with `Operation not permitted`, though writing your own files works ([homescoop#1258](https://github.com/ai-ecoverse/homescoop/issues/1258)); `.mpc` writes fail with `cache resources exhausted` ([homescoop#1208](https://github.com/ai-ecoverse/homescoop/issues/1208)); and the cert's coverage gaps, among them the no-encoder fallback and MPC's two-file write ([homescoop#1209](https://github.com/ai-ecoverse/homescoop/issues/1209)). sudo for `magick`, `convert` or `mogrify` is offered once, never always, since they write files. No two catalog entries provide the same command, so an install never shadows another entry's.
+Below the system rows, Install / Update offers **Optional packages** (spectrum ≥ 1.42.0): tools that seven doesn't preinstall, each at the version the homescoop coordinator certified. The catalog is [`src/packages/optional/`](src/packages/optional/): `package.json` pins each package exactly, `package-lock.json` (made with `npm install --package-lock-only --ignore-scripts`, never installed) holds its integrity, and `catalog.json` gives its id, label, description, commands, tarball size and `requires`. A test keeps the three in step. Today it offers git, the GitHub CLI, OpenSSH, `slicc` (see [Sevens this kernel follows](#network)), Python, the Python data tools (numpy, pandas and matplotlib), Node.js (slicc-jsh's `node` and `jsh`), `sliccy:browser` for `.jsh` scripts, Ruby, Perl, Biome, the PDF tools (poppler), qpdf, rsync, screen, SQLite, dig, websocat, ntfy, GnuPG, fnox, mcpcat (an MCP client), zip (Info-ZIP's `zip`, `unzip` and `zipinfo`), xxd (vim's hex dump, with `xxd -r`) and ImageMagick. zip's `unzip` refuses an entry whose name isn't UTF-8 (an old Latin-1 or CP437 archive without a Unicode path): it says `cannot create <name>` / `Illegal byte sequence`, extracts the other entries and exits 50, and `unzip -l` still lists the entry. It never extracts it under a changed name, and `unzip -p` still streams its bytes ([homescoop#1174](https://github.com/ai-ecoverse/homescoop/issues/1174)). ImageMagick is homescoop's HEIF build (`wasm-imagemagick-heif`, a superset of the plain build, which isn't offered), with `magick`, `convert`, `mogrify`, `identify` and `magick-open`, and it reads HEIC and AVIF. A failed write leaves an existing target as it was. Its known issues: writing over another user's 0666 file in a sticky directory such as `/tmp` fails with `Operation not permitted`, though writing your own files works ([homescoop#1258](https://github.com/ai-ecoverse/homescoop/issues/1258)); `.mpc` writes fail with `cache resources exhausted` ([homescoop#1208](https://github.com/ai-ecoverse/homescoop/issues/1208)); and the cert's coverage gaps, among them the no-encoder fallback and MPC's two-file write ([homescoop#1209](https://github.com/ai-ecoverse/homescoop/issues/1209)). sudo for `magick`, `convert` or `mogrify` is offered once, never always, since they write files. No two catalog entries provide the same command, so an install never shadows another entry's.
 
 - **Install** runs `pnpm add -g <package>@<version>` in the page's kernel, as a user would, under the Web Lock `slicc-optional`, so the commands work at once in every open shell. pnpm 12 gives each global add its own project under `$PNPM_HOME/global/v11/`; bios reads `PNPM_HOME` from the kernel's environment. Afterwards `os/packages.js` reads that project's `pnpm-lock.yaml`: every package in it, the one added and each dependency, must be a version in the catalog's lockfile or the base set's, with that integrity. homescoop pins `@ai-ecoverse/*` dependencies exactly (uv → Python, git → bash), so the catalog's lockfile names them all. Anything else, a dependency pnpm resolved to another version included, removes the package again and fails the row with *This version doesn't match the tested build*. An entry's `requires` (uv needs Python) are installed first. A package's kernel command always wins over the same package's Node `bin`. After each install and update, for every name that a package declares both in `slicc.commands` and in `bin`, bios removes the link that pnpm made in `$PNPM_HOME/bin`, but only when that link points into this package, so `mcpcat` runs `/usr/bin/mcpcat`, not a `#!/usr/bin/env node` script with no Node to run it. Another package's bins are never touched, and a package with only a `bin` keeps it. `/opt/user` (Your packages) isn't affected: its bins are not on `PATH`. A project entry also **updates** a required package that's older than the catalog's before it installs, since it runs on the catalog's version: the data tools override their own Python away, and their builds need the catalog's Python. A global add brings its own pinned dependencies, so it leaves an older required package as it is.
 - **Progress:** a row shows pnpm's package counts once pnpm counts more than one package. Before that, a single package, such as Python, still shows its download in bytes, from pnpm's `Downloading` lines (see [Agent](#agent)). Without either the bar is indeterminate.
@@ -493,7 +493,7 @@ Limits:
 [`renovate.json`](renovate.json) bumps every `@ai-ecoverse/*` pin in the base set (`src/packages/package.json`), the optional catalog (`src/packages/optional/package.json`) and `/opt/agent` (`src/packages/agent/package.json`), with their npm and pnpm lockfiles.
 
 - **PRs:** homescoop's packages (`wasi-*`, `wasix-*`, `wasm-*`, `py-*`, `wasi-pnpm` included) come as one PR a day, between 00:00 and 06:00 UTC. The kernel (its base-set and `/opt/agent` pins together), slicc-cdp, slicc-agent, slicc-spectrum and slicc-jsh each get their own PR, and so does every other package. The grammars and Tailscale projects stay on the dependency dashboard.
-- **Automerge only when certified:** Renovate turns on auto-merge, so a PR goes through the merge queue once `ci / test` is green. On a Renovate PR, `ci / test` ends with [`scripts/ci/certified.mjs`](scripts/ci/certified.mjs). It fails unless, for each `@ai-ecoverse` pin the PR changes in those three files, the latest cert review comment that names it (posted by `github-actions[bot]`, with `sha check ok`) has its `certified` line. Its verdict line is `cert-gate: CERTIFIED …`, `cert-gate: FAIL …` or `cert-gate: PASS <why it doesn't apply>`. So the first CI run of such a PR is red.
+- **Automerge only when certified:** Renovate turns on auto-merge, so a PR goes through the merge queue once `ci / test` is green. `ci / test` ends with [`scripts/ci/certified.mjs`](scripts/ci/certified.mjs), on every PR. On a Renovate PR it checks each `@ai-ecoverse` pin the PR changes in those three files. On any other PR it checks each gated pin (`scripts/cert/apply.mjs`'s `GATED`: slicc-kernel, slicc-cdp, slicc-clipboard, slicc-jsh, mcpcat, `wasi-*`, `wasix-*`, `wasm-*`, `py-*`) the PR changes in those files, `src/packages/tailscale/package.json` or `src/packages/grammars/package.json`, so a hand-made pin needs the `cert-review` label. Cert review never runs fork code, so a fork's gated pin change has to come from a branch of this repository, and the gate says so. The gate fails unless, for each such pin, the latest cert review comment that names it (posted by `github-actions[bot]`, with `sha check ok`) has its `certified` line. Its verdict line is `cert-gate: CERTIFIED …`, `cert-gate: FAIL …` or `cert-gate: PASS <why it doesn't apply>`. So the first CI run of such a PR is red.
 - **Then cert review** (the `workflow_run` after CI) writes its verdict. After a certified verdict, its `cert / queue` job runs [`scripts/cert/apply.mjs`](scripts/cert/apply.mjs) from the base, which runs no code from the PR. That script runs the sha check again and adds each certified `certs.json:` line for a gated package that the PR's lockfiles pin with that integrity. The job commits the lines to the Renovate branch as `github-actions[bot]`, whose email is in `gitIgnoredAuthors`, so Renovate keeps rebasing the branch. Then it dispatches CI on it (`workflow_dispatch` with `pr`), since a push with `GITHUB_TOKEN` starts no workflow. That run's `ci / test` counts for the PR's head, and the queue takes it from there.
 - **Known breaks** are `packageRules` with `allowedVersions`, each with its reason and issue in `description`: wasm-bash stays below 5.3.0-20 until a kernel with slicc-kernel#1146 is pinned, and wasi-pnpm skips the deprecated 12.9.1-11 and 12.9.1-12 (homescoop#1128). `test/integration/renovate.test.mjs` checks the config, the gate and the queue in plain node.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.26.0",
+  "version": "1.27.1",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",

package/src/packages/certs.json

@@ -772,5 +772,13 @@
   "@ai-ecoverse/wasm-imagemagick-heif@7.1.2-34-9.1": {
     "integrity": "sha512-0z9FTPGFcO/8cFvCHkBI8kBQLvtjts3WFrhVzI5FQSVeRyZwMCKJZWHmAgiGUiS5q/UbsJF2AI9ocwGgIaJXjw==",
     "sha256": "f8e80e2aa2486a1658e0cdc6eb9c6b675b5615f3ce87b7e609d3e33f66752da5"
+  },
+  "@ai-ecoverse/wasm-xxd@9.2.1192-3": {
+    "integrity": "sha512-CJKX6isuCrz3ZFoKLGQqeqj20aiWNSR8BsbgWtRTmCP4bvlZefmvz8vGIsD4rOdZybdfgIfhPnEEnBdsqiNn4g==",
+    "sha256": "c52394bde7c6d7c531e4d531faf8bcd1911ae1c2ff3b50688ee02ba562c386cd"
+  },
+  "@ai-ecoverse/wasm-zip@3.0.0-7": {
+    "integrity": "sha512-q92s+O0EaT+uGHZZ2ZCffoYfb7ZzlRHd3K+wvXDh2l0V+uBJUZE7VeC+5AZQ5KZ2v80w5h7jZbOiw34EWKW4Dw==",
+    "sha256": "07cf0bd10794be1e5076ab495ff7011484385a1997c6b88fb250581dc48bfc95"
   }
 }

package/src/packages/optional/catalog.json

@@ -169,5 +169,19 @@
     "description": "Convert, resize and inspect images (magick, convert, mogrify, identify), including HEIC/AVIF.",
     "commands": ["magick", "convert", "mogrify", "identify", "magick-open"],
     "size": 11420934
+  },
+  "@ai-ecoverse/wasm-zip": {
+    "id": "zip",
+    "label": "zip",
+    "description": "Create and extract .zip archives (zip, unzip, zipinfo).",
+    "commands": ["zip", "unzip", "zipinfo"],
+    "size": 869325
+  },
+  "@ai-ecoverse/wasm-xxd": {
+    "id": "xxd",
+    "label": "xxd",
+    "description": "Hex dump and reverse (xxd, from vim).",
+    "commands": ["xxd"],
+    "size": 124869
   }
 }

package/src/packages/optional/package-lock.json

@@ -28,7 +28,9 @@
         "@ai-ecoverse/wasm-qpdf": "12.4.2-4",
         "@ai-ecoverse/wasm-rsync": "3.5.1-5",
         "@ai-ecoverse/wasm-screen": "5.0.1-13",
-        "@ai-ecoverse/wasm-sqlite3": "3.54.0-6"
+        "@ai-ecoverse/wasm-sqlite3": "3.54.0-6",
+        "@ai-ecoverse/wasm-xxd": "9.2.1192-3",
+        "@ai-ecoverse/wasm-zip": "3.0.0-7"
       }
     },
     "node_modules/@ai-ecoverse/mcpcat": {
@@ -254,6 +256,18 @@
       "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-sqlite3/-/wasm-sqlite3-3.54.0-6.tgz",
       "integrity": "sha512-R68+igrJTaNAheMY317wTWVlRTWQQIA6WnkFgwc2XKdwDnh23tALEoRSURKXki2VacPknGt3YplY/rl/cCwsaw==",
       "license": "blessing"
+    },
+    "node_modules/@ai-ecoverse/wasm-xxd": {
+      "version": "9.2.1192-3",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-xxd/-/wasm-xxd-9.2.1192-3.tgz",
+      "integrity": "sha512-CJKX6isuCrz3ZFoKLGQqeqj20aiWNSR8BsbgWtRTmCP4bvlZefmvz8vGIsD4rOdZybdfgIfhPnEEnBdsqiNn4g==",
+      "license": "Vim"
+    },
+    "node_modules/@ai-ecoverse/wasm-zip": {
+      "version": "3.0.0-7",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasm-zip/-/wasm-zip-3.0.0-7.tgz",
+      "integrity": "sha512-q92s+O0EaT+uGHZZ2ZCffoYfb7ZzlRHd3K+wvXDh2l0V+uBJUZE7VeC+5AZQ5KZ2v80w5h7jZbOiw34EWKW4Dw==",
+      "license": "Info-ZIP"
     }
   }
 }

package/src/packages/optional/package.json

@@ -25,6 +25,8 @@
     "@ai-ecoverse/wasm-qpdf": "12.4.2-4",
     "@ai-ecoverse/wasm-rsync": "3.5.1-5",
     "@ai-ecoverse/wasm-screen": "5.0.1-13",
-    "@ai-ecoverse/wasm-sqlite3": "3.54.0-6"
+    "@ai-ecoverse/wasm-sqlite3": "3.54.0-6",
+    "@ai-ecoverse/wasm-xxd": "9.2.1192-3",
+    "@ai-ecoverse/wasm-zip": "3.0.0-7"
   }
 }