@ai-ecoverse/slicc-bios 1.30.4 → 1.31.0

package/README.md

@@ -186,7 +186,7 @@ The Files panel lists `/opt/grammars/node_modules` but doesn't scan it.
 
 Below the system rows, Install / Update offers **Optional packages** (spectrum ≥ 1.42.0): tools that seven doesn't preinstall, each at the version the homescoop coordinator certified. The catalog is [`src/packages/optional/`](src/packages/optional/): `package.json` pins each package exactly, `package-lock.json` (made with `npm install --package-lock-only --ignore-scripts`, never installed) holds its integrity, and `catalog.json` gives its id, label, description, commands, tarball size and `requires`. A test keeps the three in step. Today it offers git, the GitHub CLI, OpenSSH, `slicc` (see [Sevens this kernel follows](#network)), Python, the Python data tools (numpy, pandas and matplotlib), Node.js (slicc-jsh's `node` and `jsh`), `sliccy:browser` for `.jsh` scripts, Ruby, Perl, Biome, the PDF tools (poppler), qpdf, rsync, screen, SQLite, dig, websocat, ntfy, GnuPG, fnox, mcpcat (an MCP client), zip (Info-ZIP's `zip`, `unzip` and `zipinfo`), xxd (vim's hex dump, with `xxd -r`) and ImageMagick. zip's `unzip` refuses an entry whose name isn't UTF-8 (an old Latin-1 or CP437 archive without a Unicode path): it says `cannot create <name>` / `Illegal byte sequence`, extracts the other entries and exits 50, and `unzip -l` still lists the entry. It never extracts it under a changed name, and `unzip -p` still streams its bytes ([homescoop#1174](https://github.com/ai-ecoverse/homescoop/issues/1174)). ImageMagick is homescoop's HEIF build (`wasm-imagemagick-heif`, a superset of the plain build, which isn't offered), with `magick`, `convert`, `mogrify`, `identify` and `magick-open`, and it reads HEIC and AVIF. A failed write leaves an existing target as it was. Its known issues: writing over another user's 0666 file in a sticky directory such as `/tmp` fails with `Operation not permitted`, though writing your own files works ([homescoop#1258](https://github.com/ai-ecoverse/homescoop/issues/1258)); `.mpc` writes fail with `cache resources exhausted` ([homescoop#1208](https://github.com/ai-ecoverse/homescoop/issues/1208)); and the cert's coverage gaps, among them the no-encoder fallback and MPC's two-file write ([homescoop#1209](https://github.com/ai-ecoverse/homescoop/issues/1209)). sudo for `magick`, `convert` or `mogrify` is offered once, never always, since they write files. No two catalog entries provide the same command, so an install never shadows another entry's.
 
-- **Install** runs `pnpm add -g <package>@<version>` in the page's kernel, as a user would, under the Web Lock `slicc-optional`, so the commands work at once in every open shell. pnpm 12 gives each global add its own project under `$PNPM_HOME/global/v11/`; bios reads `PNPM_HOME` from the kernel's environment. Afterwards `os/packages.js` reads that project's `pnpm-lock.yaml`: every package in it, the one added and each dependency, must be a version in the catalog's lockfile or the base set's, with that integrity. homescoop pins `@ai-ecoverse/*` dependencies exactly (uv → Python, git → bash), so the catalog's lockfile names them all. Anything else, a dependency pnpm resolved to another version included, removes the package again and fails the row with *This version doesn't match the tested build*. An entry's `requires` (uv needs Python) are installed first. A package's kernel command always wins over the same package's Node `bin`. After each install and update, for every name that a package declares both in `slicc.commands` and in `bin`, bios removes the link that pnpm made in `$PNPM_HOME/bin`, but only when that link points into this package, so `mcpcat` runs `/usr/bin/mcpcat`, not a `#!/usr/bin/env node` script with no Node to run it. Another package's bins are never touched, and a package with only a `bin` keeps it. `/opt/user` (Your packages) isn't affected: its bins are not on `PATH`. A project entry also **updates** a required package that's older than the catalog's before it installs, since it runs on the catalog's version: the data tools override their own Python away, and their builds need the catalog's Python. A global add brings its own pinned dependencies, so it leaves an older required package as it is.
+- **Install** runs `pnpm add -g <package>@<version>` in the page's kernel, as a user would, under the Web Lock `slicc-optional`, so the commands work at once in every open shell. pnpm 12 gives each global add its own project under `$PNPM_HOME/global/v11/`; bios reads `PNPM_HOME` from the kernel's environment. Afterwards `os/packages.js` reads that project's `pnpm-lock.yaml`: every package in it, the one added and each dependency, must be a version in the catalog's lockfile or the base set's, with that integrity. homescoop pins `@ai-ecoverse/*` dependencies exactly (uv → Python, git → bash), so the catalog's lockfile names them all. Anything else, a dependency pnpm resolved to another version included, removes the package again and fails the row with *This version doesn't match the tested build*. An entry's `requires` (uv needs Python) are installed first. A package's kernel command always wins over the same package's Node `bin`. After each install and update, for every name that a package declares both in `slicc.commands` and in `bin`, bios removes the link that pnpm made in `$PNPM_HOME/bin`, but only when that link points into this package, so `mcpcat` runs `/usr/bin/mcpcat`, not a `#!/usr/bin/env node` script with no Node to run it. Another package's bins are never touched, and a package with only a `bin` keeps it. `/opt/user` (Your packages) isn't affected: its bins are not on `PATH`. A certified catalog package's agent skills reach every cone the same way. After the install or update, for each folder its `package.json` lists in `pi.skills`, bios links each skill in it into `/usr/share/skills/<name>`, through the kernel and as root, so no cone can change what the agent loads. The folder has to resolve inside the package; the skill's folder name has to match `^[a-z0-9][a-z0-9-]*$` and equal its `SKILL.md` `name`; and it mustn't collide with a built-in or with an entry it didn't make. The skill files are made readable by everyone (`a+rX`). bios records its links in `var/lib/slicc/optional/<id>/skills`, removes the ones an update drops, and removes all of them on Remove. A skipped skill is logged and never fails the install. The agent's rule stands: it doesn't scan root's global pnpm, so a user's `pnpm add -g` can't add skills. A project entry also **updates** a required package that's older than the catalog's before it installs, since it runs on the catalog's version: the data tools override their own Python away, and their builds need the catalog's Python. A global add brings its own pinned dependencies, so it leaves an older required package as it is.
 - **Progress:** a row shows pnpm's package counts once pnpm counts more than one package. Before that, a single package, such as Python, still shows its download in bytes, from pnpm's `Downloading` lines (see [Agent](#agent)). Without either the bar is indeterminate.
 - **State** comes from pnpm's global projects, not from a list of bios's own, so a package installed by hand shows as installed with its version. One older than the catalog's offers **Update**, which adds the catalog's version; one at or above it offers **Remove**. bios never downgrades.
 - **Remove** runs `pnpm remove -g <package>`. It asks first only when another installed entry needs it (*Remove Node.js (jsh)? Browser for jsh scripts needs it and stops working until Node.js (jsh) is back.*, accent); otherwise it doesn't ask, since pnpm's global projects hold no user data and the package can be installed again. A cancelled confirm changes nothing.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.30.4",
+  "version": "1.31.0",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",

package/src/packages/certs.json

@@ -825,6 +825,10 @@
     "integrity": "sha512-Sah/qC/1x31WKsVK+tyHYSdV8StFLpZEmuNyWqu2inbK19IL7ZyZyOb+85CGVAG1+ZRdXfE1y0eUAQuu0jnm3w==",
     "sha256": "d492f978d7f0925378369feaddb2925f9220169b965c3a7b0a2854acd6668bc3"
   },
+  "@ai-ecoverse/mcpcat@0.17.0": {
+    "integrity": "sha512-LmiT/Ecom6SiUl9sR+4WVg6CYS+CpunXlL0Qvf1r01fuT06J08K5G3e6dO9wQXRYz4ST9Vp4firKIQM230GCiw==",
+    "sha256": "0fc7cb4c0d62631aaa63a2ab3b2f1d64c5e5a3f039faa110be2b21bc8e62cdde"
+  },
   "@ai-ecoverse/wasm-imagemagick-heif@7.1.2-34-9.1": {
     "integrity": "sha512-0z9FTPGFcO/8cFvCHkBI8kBQLvtjts3WFrhVzI5FQSVeRyZwMCKJZWHmAgiGUiS5q/UbsJF2AI9ocwGgIaJXjw==",
     "sha256": "f8e80e2aa2486a1658e0cdc6eb9c6b675b5615f3ce87b7e609d3e33f66752da5"

package/src/packages/optional/catalog.json

@@ -154,7 +154,7 @@
     "label": "mcpcat (MCP client)",
     "description": "Calls MCP servers from the terminal: lists and calls their tools, resources and prompts, over HTTP or a stdio command. In a header, -H 'Authorization: Bearer ${NAME}' (single quotes) sends the vault's placeholder, which the vault fills in where a secret rule allows that host; mcpcat never prints the value.",
     "commands": ["mcpcat"],
-    "size": 589050
+    "size": 595379
   },
   "@ai-ecoverse/wasm-imagemagick-heif": {
     "id": "imagemagick",

package/src/packages/optional/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "slicc-bios-optional",
       "dependencies": {
-        "@ai-ecoverse/mcpcat": "0.16.3",
+        "@ai-ecoverse/mcpcat": "0.17.0",
         "@ai-ecoverse/slicc-jsh": "0.45.4",
         "@ai-ecoverse/sliccy-browser": "0.1.22",
         "@ai-ecoverse/wasi-biome": "2.5.15-4",
@@ -33,9 +33,9 @@
       }
     },
     "node_modules/@ai-ecoverse/mcpcat": {
-      "version": "0.16.3",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/mcpcat/-/mcpcat-0.16.3.tgz",
-      "integrity": "sha512-Sah/qC/1x31WKsVK+tyHYSdV8StFLpZEmuNyWqu2inbK19IL7ZyZyOb+85CGVAG1+ZRdXfE1y0eUAQuu0jnm3w==",
+      "version": "0.17.0",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/mcpcat/-/mcpcat-0.17.0.tgz",
+      "integrity": "sha512-LmiT/Ecom6SiUl9sR+4WVg6CYS+CpunXlL0Qvf1r01fuT06J08K5G3e6dO9wQXRYz4ST9Vp4firKIQM230GCiw==",
       "license": "Apache-2.0",
       "bin": {
         "mcpcat": "dist/host/mcpcat.mjs"

package/src/packages/optional/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "description": "The certified versions of the optional packages that seven's Install / Update panel offers. Never installed as a project: the panel runs pnpm add -g for each one.",
   "dependencies": {
-    "@ai-ecoverse/mcpcat": "0.16.3",
+    "@ai-ecoverse/mcpcat": "0.17.0",
     "@ai-ecoverse/slicc-jsh": "0.45.4",
     "@ai-ecoverse/sliccy-browser": "0.1.22",
     "@ai-ecoverse/wasi-biome": "2.5.15-4",