@ai-ecoverse/slicc-bios 1.30.3 → 1.31.0

package/README.md

@@ -87,6 +87,7 @@ The kernel runs with users on (slicc-kernel ≥ 1.81.0): files have owners and m
 - **Protected code paths:** under `'enforce'`, the kernel gets `protect: { paths: ['/node_modules', '/opt/agent', '/opt/grammars', '/opt/tailscale', '/opt/slicc', '/os'], writers: ['bios-installer'] }` (slicc-kernel ≥ 1.81.0). No process changes them, root included (`EROFS`; a cone sees `EACCES` first), and nothing mounts at, under or above them.
   - **bios's installs** (pnpm into the base set, `/opt/*` and `/opt/slicc/<project>`, and the pass that makes them readable) run as `kernel.run(argv, { cwd, tag: 'bios-installer', env })`. The env is clean: `HOME=/opt/slicc/.installer`, its own config and cache, the system `PNPM_HOME` and `PATH`, and an empty `NODE_OPTIONS`.
   - **pnpm runs with** `--ignore-scripts --ignore-pnpmfile --config.userconfig=/dev/null --config.store-dir=/opt/slicc/.store --config.verify-store-integrity=true`. No locked package in the base set, `/opt/agent`, `/opt/grammars`, `/opt/tailscale` or the data tools has an install script.
+  - **pnpm's wasm trap is retried once** (homescoop#1127, slicc-kernel#1172; to be removed with #671): a pnpm run of any of bios's installs that exits 134 with `wasm trap in thread N: memory access out of bounds` (V8's stale per-thread memory length after another thread's `memory.grow`, which traps a bulk-memory copy or fill) runs once more, with the same argv, flags, integrity checks, cwd, env and locks. The trap comes while pnpm reads the store, before it writes anything. The retry is warned in the console, written into the install log, and appended with its outcome (`recovered`, `trapped again`, `failed otherwise`) to `/var/log/slicc/pnpm-traps.log`. A second trap fails the install loudly, naming the trap; any other failure is never retried. In CI, a test's trap warnings go to `artifacts/pnpm-traps/`, each shard prints how many it saw, and the run's summary files them as one flaky-test issue, so the rate stays measurable and a retried run isn't a clean pass.
   - **The base project** moves out of `/`: its `package.json`, `pnpm-lock.yaml` and `pnpm-workspace.yaml` are in `/opt/slicc/base`, written by the BIOS installer and the in-place update, and pnpm installs it with `--modules-dir=/node_modules` from there. So everything pnpm reads is inside a protected path, and a root process that writes `/package.json`, `/pnpm-lock.yaml`, `/.npmrc` or `/pnpm-workspace.yaml` changes nothing; bios removes those at every boot. A protected project without its own `pnpm-workspace.yaml` gets one, so pnpm's search for a workspace stops inside the tree. The service worker's resolver no longer reads a `package.json` at `/` for `browser` mappings.
   - **The user layers** for `/opt/agent` and `/opt/grammars` are off under `'enforce'`: users can't change those projects any more, and their state is in `/var/lib/slicc`, which the agent can write. They keep working under `'report'`. Your packages live in `/opt/user` instead, which isn't protected (see [Your packages](#your-packages)).
   - **Under `'report'`** nothing is protected, since protection has no report mode of its own. Installs already run as tagged writers from `/opt/slicc/base` with the clean config, and bios watches the six trees through the kernel (`fs.watch`, recursive). Each change made through the page's kernel outside bios's own installs goes to `denials.log` as `op: 'protect'`, `errno: 'EROFS'`: a write that `'enforce'` would refuse. The watch doesn't say which process wrote, so these lines have no user and no tag. Changes made outside the page's kernel (bios's install kernels, the page itself) aren't seen.
@@ -185,7 +186,7 @@ The Files panel lists `/opt/grammars/node_modules` but doesn't scan it.
 
 Below the system rows, Install / Update offers **Optional packages** (spectrum ≥ 1.42.0): tools that seven doesn't preinstall, each at the version the homescoop coordinator certified. The catalog is [`src/packages/optional/`](src/packages/optional/): `package.json` pins each package exactly, `package-lock.json` (made with `npm install --package-lock-only --ignore-scripts`, never installed) holds its integrity, and `catalog.json` gives its id, label, description, commands, tarball size and `requires`. A test keeps the three in step. Today it offers git, the GitHub CLI, OpenSSH, `slicc` (see [Sevens this kernel follows](#network)), Python, the Python data tools (numpy, pandas and matplotlib), Node.js (slicc-jsh's `node` and `jsh`), `sliccy:browser` for `.jsh` scripts, Ruby, Perl, Biome, the PDF tools (poppler), qpdf, rsync, screen, SQLite, dig, websocat, ntfy, GnuPG, fnox, mcpcat (an MCP client), zip (Info-ZIP's `zip`, `unzip` and `zipinfo`), xxd (vim's hex dump, with `xxd -r`) and ImageMagick. zip's `unzip` refuses an entry whose name isn't UTF-8 (an old Latin-1 or CP437 archive without a Unicode path): it says `cannot create <name>` / `Illegal byte sequence`, extracts the other entries and exits 50, and `unzip -l` still lists the entry. It never extracts it under a changed name, and `unzip -p` still streams its bytes ([homescoop#1174](https://github.com/ai-ecoverse/homescoop/issues/1174)). ImageMagick is homescoop's HEIF build (`wasm-imagemagick-heif`, a superset of the plain build, which isn't offered), with `magick`, `convert`, `mogrify`, `identify` and `magick-open`, and it reads HEIC and AVIF. A failed write leaves an existing target as it was. Its known issues: writing over another user's 0666 file in a sticky directory such as `/tmp` fails with `Operation not permitted`, though writing your own files works ([homescoop#1258](https://github.com/ai-ecoverse/homescoop/issues/1258)); `.mpc` writes fail with `cache resources exhausted` ([homescoop#1208](https://github.com/ai-ecoverse/homescoop/issues/1208)); and the cert's coverage gaps, among them the no-encoder fallback and MPC's two-file write ([homescoop#1209](https://github.com/ai-ecoverse/homescoop/issues/1209)). sudo for `magick`, `convert` or `mogrify` is offered once, never always, since they write files. No two catalog entries provide the same command, so an install never shadows another entry's.
 
-- **Install** runs `pnpm add -g <package>@<version>` in the page's kernel, as a user would, under the Web Lock `slicc-optional`, so the commands work at once in every open shell. pnpm 12 gives each global add its own project under `$PNPM_HOME/global/v11/`; bios reads `PNPM_HOME` from the kernel's environment. Afterwards `os/packages.js` reads that project's `pnpm-lock.yaml`: every package in it, the one added and each dependency, must be a version in the catalog's lockfile or the base set's, with that integrity. homescoop pins `@ai-ecoverse/*` dependencies exactly (uv → Python, git → bash), so the catalog's lockfile names them all. Anything else, a dependency pnpm resolved to another version included, removes the package again and fails the row with *This version doesn't match the tested build*. An entry's `requires` (uv needs Python) are installed first. A package's kernel command always wins over the same package's Node `bin`. After each install and update, for every name that a package declares both in `slicc.commands` and in `bin`, bios removes the link that pnpm made in `$PNPM_HOME/bin`, but only when that link points into this package, so `mcpcat` runs `/usr/bin/mcpcat`, not a `#!/usr/bin/env node` script with no Node to run it. Another package's bins are never touched, and a package with only a `bin` keeps it. `/opt/user` (Your packages) isn't affected: its bins are not on `PATH`. A project entry also **updates** a required package that's older than the catalog's before it installs, since it runs on the catalog's version: the data tools override their own Python away, and their builds need the catalog's Python. A global add brings its own pinned dependencies, so it leaves an older required package as it is.
+- **Install** runs `pnpm add -g <package>@<version>` in the page's kernel, as a user would, under the Web Lock `slicc-optional`, so the commands work at once in every open shell. pnpm 12 gives each global add its own project under `$PNPM_HOME/global/v11/`; bios reads `PNPM_HOME` from the kernel's environment. Afterwards `os/packages.js` reads that project's `pnpm-lock.yaml`: every package in it, the one added and each dependency, must be a version in the catalog's lockfile or the base set's, with that integrity. homescoop pins `@ai-ecoverse/*` dependencies exactly (uv → Python, git → bash), so the catalog's lockfile names them all. Anything else, a dependency pnpm resolved to another version included, removes the package again and fails the row with *This version doesn't match the tested build*. An entry's `requires` (uv needs Python) are installed first. A package's kernel command always wins over the same package's Node `bin`. After each install and update, for every name that a package declares both in `slicc.commands` and in `bin`, bios removes the link that pnpm made in `$PNPM_HOME/bin`, but only when that link points into this package, so `mcpcat` runs `/usr/bin/mcpcat`, not a `#!/usr/bin/env node` script with no Node to run it. Another package's bins are never touched, and a package with only a `bin` keeps it. `/opt/user` (Your packages) isn't affected: its bins are not on `PATH`. A certified catalog package's agent skills reach every cone the same way. After the install or update, for each folder its `package.json` lists in `pi.skills`, bios links each skill in it into `/usr/share/skills/<name>`, through the kernel and as root, so no cone can change what the agent loads. The folder has to resolve inside the package; the skill's folder name has to match `^[a-z0-9][a-z0-9-]*$` and equal its `SKILL.md` `name`; and it mustn't collide with a built-in or with an entry it didn't make. The skill files are made readable by everyone (`a+rX`). bios records its links in `var/lib/slicc/optional/<id>/skills`, removes the ones an update drops, and removes all of them on Remove. A skipped skill is logged and never fails the install. The agent's rule stands: it doesn't scan root's global pnpm, so a user's `pnpm add -g` can't add skills. A project entry also **updates** a required package that's older than the catalog's before it installs, since it runs on the catalog's version: the data tools override their own Python away, and their builds need the catalog's Python. A global add brings its own pinned dependencies, so it leaves an older required package as it is.
 - **Progress:** a row shows pnpm's package counts once pnpm counts more than one package. Before that, a single package, such as Python, still shows its download in bytes, from pnpm's `Downloading` lines (see [Agent](#agent)). Without either the bar is indeterminate.
 - **State** comes from pnpm's global projects, not from a list of bios's own, so a package installed by hand shows as installed with its version. One older than the catalog's offers **Update**, which adds the catalog's version; one at or above it offers **Remove**. bios never downgrades.
 - **Remove** runs `pnpm remove -g <package>`. It asks first only when another installed entry needs it (*Remove Node.js (jsh)? Browser for jsh scripts needs it and stops working until Node.js (jsh) is back.*, accent); otherwise it doesn't ask, since pnpm's global projects hold no user data and the package can be installed again. A cancelled confirm changes nothing.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.30.3",
+  "version": "1.31.0",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",

package/src/packages/certs.json

@@ -825,6 +825,10 @@
     "integrity": "sha512-Sah/qC/1x31WKsVK+tyHYSdV8StFLpZEmuNyWqu2inbK19IL7ZyZyOb+85CGVAG1+ZRdXfE1y0eUAQuu0jnm3w==",
     "sha256": "d492f978d7f0925378369feaddb2925f9220169b965c3a7b0a2854acd6668bc3"
   },
+  "@ai-ecoverse/mcpcat@0.17.0": {
+    "integrity": "sha512-LmiT/Ecom6SiUl9sR+4WVg6CYS+CpunXlL0Qvf1r01fuT06J08K5G3e6dO9wQXRYz4ST9Vp4firKIQM230GCiw==",
+    "sha256": "0fc7cb4c0d62631aaa63a2ab3b2f1d64c5e5a3f039faa110be2b21bc8e62cdde"
+  },
   "@ai-ecoverse/wasm-imagemagick-heif@7.1.2-34-9.1": {
     "integrity": "sha512-0z9FTPGFcO/8cFvCHkBI8kBQLvtjts3WFrhVzI5FQSVeRyZwMCKJZWHmAgiGUiS5q/UbsJF2AI9ocwGgIaJXjw==",
     "sha256": "f8e80e2aa2486a1658e0cdc6eb9c6b675b5615f3ce87b7e609d3e33f66752da5"

package/src/packages/optional/catalog.json

@@ -154,7 +154,7 @@
     "label": "mcpcat (MCP client)",
     "description": "Calls MCP servers from the terminal: lists and calls their tools, resources and prompts, over HTTP or a stdio command. In a header, -H 'Authorization: Bearer ${NAME}' (single quotes) sends the vault's placeholder, which the vault fills in where a secret rule allows that host; mcpcat never prints the value.",
     "commands": ["mcpcat"],
-    "size": 589050
+    "size": 595379
   },
   "@ai-ecoverse/wasm-imagemagick-heif": {
     "id": "imagemagick",

package/src/packages/optional/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "slicc-bios-optional",
       "dependencies": {
-        "@ai-ecoverse/mcpcat": "0.16.3",
+        "@ai-ecoverse/mcpcat": "0.17.0",
         "@ai-ecoverse/slicc-jsh": "0.45.4",
         "@ai-ecoverse/sliccy-browser": "0.1.22",
         "@ai-ecoverse/wasi-biome": "2.5.15-4",
@@ -33,9 +33,9 @@
       }
     },
     "node_modules/@ai-ecoverse/mcpcat": {
-      "version": "0.16.3",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/mcpcat/-/mcpcat-0.16.3.tgz",
-      "integrity": "sha512-Sah/qC/1x31WKsVK+tyHYSdV8StFLpZEmuNyWqu2inbK19IL7ZyZyOb+85CGVAG1+ZRdXfE1y0eUAQuu0jnm3w==",
+      "version": "0.17.0",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/mcpcat/-/mcpcat-0.17.0.tgz",
+      "integrity": "sha512-LmiT/Ecom6SiUl9sR+4WVg6CYS+CpunXlL0Qvf1r01fuT06J08K5G3e6dO9wQXRYz4ST9Vp4firKIQM230GCiw==",
       "license": "Apache-2.0",
       "bin": {
         "mcpcat": "dist/host/mcpcat.mjs"

package/src/packages/optional/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "description": "The certified versions of the optional packages that seven's Install / Update panel offers. Never installed as a project: the panel runs pnpm add -g for each one.",
   "dependencies": {
-    "@ai-ecoverse/mcpcat": "0.16.3",
+    "@ai-ecoverse/mcpcat": "0.17.0",
     "@ai-ecoverse/slicc-jsh": "0.45.4",
     "@ai-ecoverse/sliccy-browser": "0.1.22",
     "@ai-ecoverse/wasi-biome": "2.5.15-4",