@ai-ecoverse/slicc-bios 1.37.3 → 1.39.3

package/README.md

@@ -213,9 +213,9 @@ Below the system rows, Install / Update offers **Optional packages** (spectrum
   - Anything that isn't `@ai-ecoverse/*` and isn't in the base set is refused; homescoop packages have no third-party dependencies.
 - **Listing:** each entry's latest goes through the same rules (with its exact `dependencies`) when it's fetched. If latest fails, bios walks back through older versions (in range, not deprecated, at most five; a version whose doc is broken is skipped) and offers the newest that passes, with `newer: { version, reason }` naming latest's blocker. A pinned entry is never walked back. If none passes, the row is `withheld` with that reason, offers no Install or Update, and an installed copy keeps Remove.
 
-Today it offers git, the GitHub CLI, OpenSSH, `slicc` (see [Sevens this kernel follows](#network)), Python, the Python data tools (numpy, pandas and matplotlib), Node.js (slicc-jsh's `node` and `jsh`), `sliccy:browser` for `.jsh` scripts, Ruby, Perl, Biome, the PDF tools (poppler), qpdf, rsync, screen, SQLite, dig, websocat, ntfy, GnuPG, fnox, mcpcat (an MCP client), zip (Info-ZIP's `zip`, `unzip` and `zipinfo`), xxd (vim's hex dump, with `xxd -r`) and ImageMagick. zip's `unzip` refuses an entry whose name isn't UTF-8 (an old Latin-1 or CP437 archive without a Unicode path): it says `cannot create <name>` / `Illegal byte sequence`, extracts the other entries and exits 50, and `unzip -l` still lists the entry. It never extracts it under a changed name, and `unzip -p` still streams its bytes ([homescoop#1174](https://github.com/ai-ecoverse/homescoop/issues/1174)). ImageMagick is homescoop's HEIF build (`wasm-imagemagick-heif`, a superset of the plain build, which isn't offered), with `magick`, `convert`, `mogrify`, `identify` and `magick-open`, and it reads HEIC and AVIF. A failed write leaves an existing target as it was. Its known issues: writing over another user's 0666 file in a sticky directory such as `/tmp` fails with `Operation not permitted`, though writing your own files works ([homescoop#1258](https://github.com/ai-ecoverse/homescoop/issues/1258)); `.mpc` writes fail with `cache resources exhausted` ([homescoop#1208](https://github.com/ai-ecoverse/homescoop/issues/1208)); and the cert's coverage gaps, among them the no-encoder fallback and MPC's two-file write ([homescoop#1209](https://github.com/ai-ecoverse/homescoop/issues/1209)). sudo for `magick`, `convert` or `mogrify` is offered once, never always, since they write files. No two entries' npm `latest` provide the same command, so an install never shadows another entry's; `packages.test` checks that against npm's current `latest`.
+Today it offers git, the GitHub CLI, OpenSSH, `slicc` (see [Sevens this kernel follows](#network)), Python, the Python data tools (numpy, pandas and matplotlib), Node.js (slicc-jsh's `node` and `jsh`), `sliccy:browser` for `.jsh` scripts, Ruby, Perl, Biome, the PDF tools (poppler), qpdf, rsync, screen, SQLite, the BIND tools (`dig`, `host` and `nslookup`), websocat, ntfy, GnuPG, fnox, mcpcat (an MCP client), zip (Info-ZIP's `zip`, `unzip` and `zipinfo`), xxd (vim's hex dump, with `xxd -r`) and ImageMagick. zip's `unzip` refuses an entry whose name isn't UTF-8 (an old Latin-1 or CP437 archive without a Unicode path): it says `cannot create <name>` / `Illegal byte sequence`, extracts the other entries and exits 50, and `unzip -l` still lists the entry. It never extracts it under a changed name, and `unzip -p` still streams its bytes ([homescoop#1174](https://github.com/ai-ecoverse/homescoop/issues/1174)). ImageMagick is homescoop's HEIF build (`wasm-imagemagick-heif`, a superset of the plain build, which isn't offered), with `magick`, `convert`, `mogrify`, `identify` and `magick-open`, and it reads HEIC and AVIF. A failed write leaves an existing target as it was. Its known issues: writing over another user's 0666 file in a sticky directory such as `/tmp` fails with `Operation not permitted`, though writing your own files works ([homescoop#1258](https://github.com/ai-ecoverse/homescoop/issues/1258)); `.mpc` writes fail with `cache resources exhausted` ([homescoop#1208](https://github.com/ai-ecoverse/homescoop/issues/1208)); and the cert's coverage gaps, among them the no-encoder fallback and MPC's two-file write ([homescoop#1209](https://github.com/ai-ecoverse/homescoop/issues/1209)). sudo for `magick`, `convert` or `mogrify` is offered once, never always, since they write files. No two entries' npm `latest` provide the same command, so an install never shadows another entry's; `packages.test` checks that against npm's current `latest`.
 
-- **Install** runs `pnpm add -g <package>@<version>` in the page's kernel, as a user would, under the Web Lock `slicc-optional`, so the commands work at once in every open shell. pnpm 12 gives each global add its own project under `$PNPM_HOME/global/v11/`; bios reads `PNPM_HOME` from the kernel's environment. Afterwards `os/packages.js` reads that project's `pnpm-lock.yaml`, and every package in it, the one added and each dependency, must pass [the gate](#optional-packages). A locked integrity that isn't the registry's for that version (drift) removes the package again and fails the row with *This version doesn't match the tested build*; any other refusal fails it with *Not offered: <reason>.* An Update that fails puts the version it had back (*… stays.*), and an install that fails removes the package, so nothing unchecked stays installed. A row with no version from npm installs nothing, and Install and Update ask npm for the offer again first, so they never act on the OPFS cache's version. An entry's `requires` (uv needs Python) are installed first. A package's kernel command always wins over the same package's Node `bin`. After each install and update, for every name that a package declares both in `slicc.commands` and in `bin`, bios removes the link that pnpm made in `$PNPM_HOME/bin`, but only when that link points into this package, so `mcpcat` runs `/usr/bin/mcpcat`, not a `#!/usr/bin/env node` script with no Node to run it. Another package's bins are never touched, and a package with only a `bin` keeps it. `/opt/user` (Your packages) isn't affected: its bins are not on `PATH`. A certified catalog package's agent skills reach every cone the same way. After the install or update, for each folder its `package.json` lists in `pi.skills`, bios links each skill in it into `/usr/share/skills/<name>`, through the kernel and as root, so no cone can change what the agent loads. The folder has to resolve inside the package; the skill's folder name has to match `^[a-z0-9][a-z0-9-]*$` and equal its `SKILL.md` `name`; and it mustn't collide with a built-in or with an entry it didn't make. The skill files are made readable by everyone (`a+rX`). bios records its links in `var/lib/slicc/optional/<id>/skills`, removes the ones an update drops, and removes all of them on Remove. A skipped skill is logged and never fails the install. The agent's rule stands: it doesn't scan root's global pnpm, so a user's `pnpm add -g` can't add skills. A project entry also **updates** a required package that's older than the catalog's before it installs, since it runs on the catalog's version: the data tools override their own Python away, and their builds need the catalog's Python. A global add brings its own pinned dependencies, so it leaves an older required package as it is.
+- **Install** runs `pnpm add -g <package>@<version>` in the page's kernel, as a user would, under the Web Lock `slicc-optional`, so the commands work at once in every open shell. pnpm 12 gives each global add its own project under `$PNPM_HOME/global/v11/`; bios reads `PNPM_HOME` from the kernel's environment. Afterwards `os/packages.js` reads that project's `pnpm-lock.yaml`, and every package in it, the one added and each dependency, must pass [the gate](#optional-packages). A locked integrity that isn't the registry's for that version (drift) removes the package again and fails the row with *This version doesn't match the tested build*; any other refusal fails it with *Not offered: <reason>.* An Update that fails puts the version it had back (*… stays.*), and an install that fails removes the package, so nothing unchecked stays installed. A row with no version from npm installs nothing, and Install and Update ask npm for the offer again first, so they never act on the OPFS cache's version. An entry's `requires` (uv needs Python) are installed first. A package's kernel command always wins over the same package's Node `bin`. After each install and update, for every name that a package declares both in `slicc.commands` and in `bin`, bios removes the link that pnpm made in `$PNPM_HOME/bin`, but only when that link points into this package, so `mcpcat` runs `/usr/bin/mcpcat`, not a `#!/usr/bin/env node` script with no Node to run it. Another package's bins are never touched, and a package with only a `bin` keeps it. A `pnpm add -g` typed in a shell gets the same pass: bios watches only the `bin` and `global` folders of root's `$PNPM_HOME` (`/usr/local/share/pnpm`) and of each user's `~/.local/share/pnpm`, and `/etc/passwd`, to add a user's when the user appears; about 50 ms after pnpm writes there, it runs that pass over the global's packages, as that user for a user's own global (bios#715). `/opt/user` (Your packages) isn't affected: its bins are not on `PATH`. A certified catalog package's agent skills reach every cone the same way. After the install or update, for each folder its `package.json` lists in `pi.skills`, bios links each skill in it into `/usr/share/skills/<name>`, through the kernel and as root, so no cone can change what the agent loads. The folder has to resolve inside the package; the skill's folder name has to match `^[a-z0-9][a-z0-9-]*$` and equal its `SKILL.md` `name`; and it mustn't collide with a built-in or with an entry it didn't make. The skill files are made readable by everyone (`a+rX`). bios records its links in `var/lib/slicc/optional/<id>/skills`, removes the ones an update drops, and removes all of them on Remove. A skipped skill is logged and never fails the install. The agent's rule stands: it doesn't scan root's global pnpm, so a user's `pnpm add -g` can't add skills. A project entry also **updates** a required package that's older than the catalog's before it installs, since it runs on the catalog's version: the data tools override their own Python away, and their builds need the catalog's Python. A global add brings its own pinned dependencies, so it leaves an older required package as it is.
 - **Progress:** a row shows pnpm's package counts once pnpm counts more than one package. Before that, a single package, such as Python, still shows its download in bytes, from pnpm's `Downloading` lines (see [Agent](#agent)). Without either the bar is indeterminate.
 - **State** comes from pnpm's global projects, not from a list of bios's own, so a package installed by hand shows as installed with its version. One older than npm's offered version offers **Update**, which adds that version; one at or above it offers **Remove**. bios never downgrades.
 - **A user's own installs:** bios also reads each user's own pnpm global (`/home/<user>/.local/share/pnpm/global/v11`, a `pnpm add -g` as `cone`), as root and read-only, straight from the files: it runs no pnpm as the user for that, and with kernel users off it reads none. Each row lists its installs (`installs`, slicc-spectrum#475): the panel's copy as `{ version, where: '/usr/local/share/pnpm', manager: 'panel' }` and each user's as `{ version, where: '/home/<user>/.local/share/pnpm', user, manager: 'pnpm' }`. The version and state follow the panel's copy, or else the user's newest. A row with any install never offers **Install**, and only a panel copy offers **Remove**; a row with only user installs offers **Update** when it's older than npm's offered version, and nothing otherwise. That **Update** runs `pnpm add -g` as each user whose copy is older, with their uid, gid, `HOME`, `PNPM_HOME` and `PATH` in their home, with `--ignore-scripts`, `--ignore-pnpmfile`, the store's integrity check and no release-age wait (the catalog's version is certified), never as root and never with the system's environment, so the files stay theirs and no system copy appears. Their lockfile then passes the same check as a panel install; if it doesn't, bios puts the user's version back and the row says so. bios never touches a user's own bins. A requirement counts only in its own scope: the panel's copy for a panel install or a project, so one only a user has is installed for the system first, and that user's own global, or the panel's, for that user's copy (*Needs …*). The Remove question counts every copy that needs it, a user's included, and the move from the old root global moves a system copy even when a user has the package. The panel's own Install, Update and Remove work on its copy as before, whatever a user has.
@@ -240,7 +240,7 @@ Optional packages never count in the header and never open the panel. The termin
 
 Since the kernel has users (slicc-kernel ≥ 1.44.0), root's global pnpm lives in `/usr/local/share/pnpm`, and the panel installs system-wide as root into whatever `PNPM_HOME` root's environment names. Packages installed before that are in the old `/home/.local/share/pnpm`, which the kernel no longer looks in. So on the first boot after the upgrade, bios reads the old global projects and installs every catalog package it finds there again, at its certified version, one after the other in the background. It then records what it found in `var/lib/slicc/optional/moved`, so this happens once. Other leftovers stay where they are; the planned one-time notice about fresh homes will list them.
 
-A package dropped from the catalog is listed in `src/packages/optional/retired.json` (today `wasi-hf`, and `wasm-tar`, which moved into the base set). If one is still installed, its row says it's no longer offered and offers only **Remove**; otherwise it doesn't show.
+A package dropped from the catalog is listed in `src/packages/optional/retired.json` (today `wasi-hf`, and `wasm-tar`, which moved into the base set). If one is still installed, its row says it's no longer offered and offers only **Remove**; otherwise it doesn't show. An entry can name retired packages in `replaces`: installing it removes those first, if present, so both don't link the same command. wasix-bind replaces `wasi-dig`: installing the BIND tools over an earlier `dig` ends with BIND's `dig`, `host` and `nslookup`. With no server argument they look names up through the kernel's DNS stub.
 ## Modules
 
 #### Your packages
@@ -372,7 +372,7 @@ seven can also join a tailnet, with a patched build of Tailscale's wasm client (
   - **Half-open links:** a link that hasn't said HELLO within 30 s of its offer (a follower that gave up on a bootstrap, say) is closed, and its peer connection with it. A device's row follows its link that said HELLO, never a newer half-open one; with only a half-open link left, a known device shows as away. Until a link says HELLO its row shows only that it's connecting, under its bootstrap id: no *Asks to follow*, no Allow and no switches, because its device isn't known yet. So Allow, which keeps the grant with the device's certificate, always finds the device it was clicked for. Unlinking a device drops every link it has and tells the ones that said HELLO.
   - **Names:** each link gets an address from `198.18.57.0/24` (the first is `.11`) and the name `<host>.slicc.internal`, from the CLI's hostname, made DNS-safe and unique (`lars-mbp-2`). A link keeps its name when it reconnects, also after a reload and in any order, while the name is free: the page remembers each CLI process's name (by device certificate and process id) in `localStorage` (`slicc-os.link-labels`). A CLI that restarts is a new process, so it may come back as `lars-mbp-2` while its old link is still closing; once that link is gone, the new one takes the name back (and its SSH host key is written under it). Port 22 there is the CLI's built-in SSH server, and any other port is the CLI machine's loopback, under the CLI's policy.
   - **Into the page (`kernel-in`):** the page's HELLO offers `kernel-in`, so a local CLI serves `http://<port>.kernel.localhost` on its own loopback (port 80, or `--kernel-port`) and carries each connection into the page as `OPEN { kind: 'kernel', port }`. The page answers with `kernel.dial({ port })` and pipes both ways with half-close under the same credit window. It refuses port 9222, the CDP facade, with `EACCES`, and anything but a port 1–65535 with `EINVAL`. A port nothing listens on gets `ECONNREFUSED` (the CLI answers 502). Every other node-opened kind is `EOPNOTSUPP`, and an OPEN without a JSON `kind` is `EPROTO`. This replaces slicc-node's kernel tunnel for a linked CLI.
-  - **Browsers (`cdp`):** a CLI with `cdp` lists its browsers in HELLO, and later in `OPEN { kind: 'browsers' }` updates (the page offers cap `browsers`, answers OPENED and END, and replaces the list). Each browser is a runtime of the 9222 facade named `<device>/<browser>`, so `playwright-cli --runtime lars-mbp/chrome …`, or `/json/list?runtime=lars-mbp/chrome`, drives it. Each facade connection opens its own `OPEN { kind: 'cdp', browser }` stream, framed as a `u32` length plus one JSON message (at most 64 MiB, otherwise the stream is reset with `EMSGSIZE`). Without a runtime, the facade still prefers slicc-extension, then slicc-node, then a linked browser that hosts this seven (`seven: true`), then the first linked one. The Network panel lists each device's browsers with their runtimes (`devices[].browsers`), and browser automation reads `via: 'link'` when linked browsers are what it drives.
+  - **Browsers (`cdp`):** a CLI with `cdp` lists its browsers in HELLO, and later in `OPEN { kind: 'browsers' }` updates (the page offers cap `browsers`, answers OPENED and END, and replaces the list). Each browser is a runtime of the 9222 facade named `<device>/<browser>`, so `playwright-cli --runtime lars-mbp/chrome …`, or `/json/list?runtime=lars-mbp/chrome`, drives it. Each facade connection opens its own `OPEN { kind: 'cdp', browser }` stream, framed as a `u32` length plus one JSON message (at most 64 MiB, otherwise the stream is reset with `EMSGSIZE`). Without a runtime, the facade still prefers slicc-extension, then slicc-node, then a linked browser that hosts this seven (`seven: true`), then the first linked one. The Network panel lists each device's browsers with their runtimes (`devices[].browsers`), and browser automation reads `via: 'link'` when linked browsers are what it drives. Seven shares the browsers only of a slicc CLI at **1.47.0 or later** (it relies on slicc-cli #325, #331 and #335), read from its HELLO's `version`: `dev` passes, and otherwise only the numeric `major.minor.patch` counts, so a `-suffix` is ignored (a Go pseudo-version such as `1.47.1-0.2026…-abc123` passes). A HELLO without `version`, or with one that doesn't parse, counts as older. An older CLI that offers `cdp` lists no browsers, on its device row or on the facade, its `OPEN { kind: 'browsers' }` updates are ignored and a `cdp` open to it is refused with `EACCES`; its row says "Update slicc to 1.47.0 or later to share this computer's browsers." Everything else it offers (`net`, `http`, `ssh`, `ws`, `udp`, its folders and `kernel-in`) stays.
   - **Sync:** the Network panel's Sync section (spectrum's `model.tray`) shows this tray as `os/tray.js` sees it:
     - **Name and role:** seven's name, `leader` while it leads the tray (`none` when disconnected), and `hosted`.
     - **Connection:** Live, Connecting, Reconnecting, Error or Offline.
@@ -394,7 +394,7 @@ seven can also join a tailnet, with a patched build of Tailscale's wasm client (
     - A device that reconnects replaces only its own process's link, so `slicc <join> prompt` doesn't drop that machine's `follow`. Control-only links (`caps: []`) get no `.slicc.internal` name and no exit.
   - **Folders (`fs`):** a CLI started with `--mount <path>[:<name>][:ro]` lists its folders in HELLO, and later in `OPEN { kind: 'mounts' }` updates; the page offers cap `mounts`. Each is a `hostfs` source named `<device>/<name>`, so `mount -t hostfs lars-mbp/proj /mnt/proj` mounts it, and nothing is mounted unless someone asks. A bare source with no `<device>/`, as slicc-node named its folders (`mount -t hostfs project /mnt/p`, or one remembered from then), is the folder of that name on the CLI linked on this computer, when exactly one local CLI shares one. The device's row in Linked devices lists its folders (`folders`, with a Read-only badge; spectrum ≥ 1.58.0): **Mount** (`mountFolder(source)`) mounts one at `/mnt/<device>/<name>` (a folder named `.` or `..` is never listed), and **Eject** (`ejectFolder(source)`) unmounts it. The Files panel's Mounted strip shows each `hostfs` mount's source (`mountInfo()`), so `/mnt/proj · lars-mbp/proj` reads as another computer's folder. A mounted linked folder stays with the CLI process it was first granted from (`slicc-os.link-sources`), even if that process comes back under another name. If that process isn't linked, the folder goes to whichever process has the name now, but only when no other process with the same host name shares a folder of that name; otherwise it waits. So a remembered `lars-mbp/proj` never lands on another process's `proj`. A remembered linked folder that is mounted again before its CLI is back stays `nomedium`, and fills in when the CLI links. The kernel's `hostfs` hook answers such a source with a `MessagePort` (slicc-kernel ≥ 1.54.9), and the page serves it with `serveHostfsPort` over `OPEN { kind: 'fs', mount, op, … }` streams: `list` collects its NDJSON, a read over 64 KiB and every write get their own channel, and `watch` streams the CLI's change events. A read-only kernel mount, or a read-only export, sends `readonly: true` on every OPEN. A link that drops makes the mount `nomedium` until the CLI is back; files that were open reopen by path and continue if the host didn't change them.
   - **SSH host key:** the CLI's HELLO carries its host key, and the page writes `<host>.slicc.internal,<address> <key>` into the system-wide `/etc/ssh/ssh_known_hosts`, replacing older entries for that name or address, so `ssh` never trusts a key on first sight, whichever user runs it. Seven manages these keys, not the user, and OpenSSH looks up a user's own file under the passwd home, which isn't always `$HOME`.
-  - **Tests:** `test/integration/remote.test.mjs` runs the real `slicc watch`, `slicc prompt` and `slicc abort` with `--signal stdio` against seven's real agent and a fake Bedrock. It also leads a fake tray hub and sends a `webhook.event`, which reaches the agent as a webhook lick (without its `authorization` header) and starts a run. `test/integration/tray.test.mjs` leads a fake tray hub and links a follower in the page through it, then rotates and unlinks. `test/integration/link.test.mjs` links a fake node in the page over a real `RTCPeerConnection`, and, with `SLICC_CLI` set, the real `slicc attach --signal stdio`, relaying its NDJSON through the CDP binding: raw TCP and the http kind; kernel `ssh` with strict host-key checking against `--runner sh -c`, after `pnpm add -g @ai-ecoverse/wasix-openssh`; and, with the link as the exit, a name from the CLI's `--hosts` file, then refused under `--deny`; and `<port>.kernel.localhost` through the CLI's listener into a kernel server (`httptest`), with 502 for a closed port and the facade refused; a folder shared with `--mount`, mounted as `ref-node/proj`, read, written, seen changing on the host, and refused for writes when mounted `ro`; a second headless Chromium shared with `--cdp-extra`, listed and driven by `playwright-cli --runtime ref-node/<id>`; and a program WebSocket from kernel `bash` through the proxy to a `ws` echo server on the CLI's loopback: text, binary, the subprotocol, a close from each end, and `EACCES` under `--deny`; kernel `websocat`, installed from the catalog, to a `ws` echo on the CLI's loopback and, without `-k`, to `wss://echo.sliccy.ai/` (SLICC's echo, behind Cloudflare's certificate), so its own TLS checks the chain over raw TCP through the link, then failing at once under Directly and with no exit; and a kernel `python3` UDP socket (after `pnpm add -g @ai-ecoverse/wasix-python`) to a UDP echo server on the CLI's loopback, unconnected and connected, and `EACCES` on a connected socket under `--deny`, as with the fake node's own refusal. CI runs the CLI from npm, the pinned `@ai-ecoverse/slicc` devDependency.
+  - **Tests:** `test/integration/remote.test.mjs` runs the real `slicc watch`, `slicc prompt` and `slicc abort` with `--signal stdio` against seven's real agent and a fake Bedrock. It also leads a fake tray hub and sends a `webhook.event`, which reaches the agent as a webhook lick (without its `authorization` header) and starts a run. `test/integration/tray.test.mjs` leads a fake tray hub and links a follower in the page through it, then rotates and unlinks. `test/integration/link.test.mjs` links a fake node in the page over a real `RTCPeerConnection` (one that offers `cdp` as version `1.46.9` or without a version shares no browsers while its net and folders still work; `1.47.0`, `dev` and a pseudo-version above share them), and, with `SLICC_CLI` set, the real `slicc attach --signal stdio`, relaying its NDJSON through the CDP binding: raw TCP and the http kind; kernel `ssh` with strict host-key checking against `--runner sh -c`, after `pnpm add -g @ai-ecoverse/wasix-openssh`; and, with the link as the exit, a name from the CLI's `--hosts` file, then refused under `--deny`; and `<port>.kernel.localhost` through the CLI's listener into a kernel server (`httptest`), with 502 for a closed port and the facade refused; a folder shared with `--mount`, mounted as `ref-node/proj`, read, written, seen changing on the host, and refused for writes when mounted `ro`; a second headless Chromium shared with `--cdp-extra`, listed and driven by `playwright-cli --runtime ref-node/<id>`; and a program WebSocket from kernel `bash` through the proxy to a `ws` echo server on the CLI's loopback: text, binary, the subprotocol, a close from each end, and `EACCES` under `--deny`; kernel `websocat`, installed from the catalog, to a `ws` echo on the CLI's loopback and, without `-k`, to `wss://echo.sliccy.ai/` (SLICC's echo, behind Cloudflare's certificate), so its own TLS checks the chain over raw TCP through the link, then failing at once under Directly and with no exit; and a kernel `python3` UDP socket (after `pnpm add -g @ai-ecoverse/wasix-python`) to a UDP echo server on the CLI's loopback, unconnected and connected, and `EACCES` on a connected socket under `--deny`, as with the fake node's own refusal. CI runs the CLI from npm, the pinned `@ai-ecoverse/slicc` devDependency.
   - **As the exit:** a CLI linked on this computer (`npx sliccy@next`) is the exit by itself until the user chooses one, so the kernel's HTTP and raw TCP get past CORS at once, as slicc-node's proxy did; a Tailscale exit node that is on comes first. A remote device that offers to be a default exit carries other traffic only once it's chosen. The Network panel's **Internet traffic** picker (`setExit`) is one choice across Directly, Tailscale exit nodes and linked devices: choosing a device turns off Tailscale's exit node, and choosing Tailscale clears the device. The choice of a device is kept in `localStorage` (`slicc-os.exit`), and while that device isn't connected, after a reload or while it reconnects, internet traffic **waits**: raw connections get `ENETUNREACH` and HTTP fails, rather than going out directly. Choosing Directly sends it directly again and is kept (`direct`), so a local CLI doesn't take it over, while a Tailscale exit node turned on later still does; unlinking the chosen exit device goes back to the automatic choice.
   - **What the agent sees:** the transport's `traits` name the default exit while there is one, so the agent can say how its fetches go. `traits.exit` is `{ kind, caps }`:
     - **`kind`:** `local` (a CLI on this computer), `remote` (a chosen linked device) or `tailnet` (a Tailscale exit node);
@@ -556,7 +556,7 @@ It runs twice: in `ci / test` for quick feedback, and as cert-review's code chec
 
 [`.github/workflows/canary.yml`](.github/workflows/canary.yml) answers "is bios main green with these candidate versions?" before anyone asks for a pin. It never pushes, pins or opens a PR: it reports.
 
-- **Triggers:** `workflow_dispatch` and `workflow_call` with `overrides`, a JSON list of `name@version` (`["@ai-ecoverse/slicc-kernel@1.81.0"]`), and optionally `runner`, `shards` (names from [`scripts/canary/shards.json`](scripts/canary/shards.json); `follow-chat`, `remote-pydata`, `users-agent-ui`, `packages-update-cdp`, `guard`, `guard-set-extension-prompt`, `guard-set-extension-lagging`, `guard-set-proxy-prompt`, `guard-set-proxy-lagging`, `k4-link`, `user-packages-keys-favicon` and `rest` by default; a shard's `env` in that file, such as `GUARD_VARIANTS`, is set for its tests, or `sweep` for just the base-set sweep and the certs check), `expect` and `bios-ref` (any branch or sha of slicc-bios: the shard jobs check it out and lay this ref's `scripts/canary`, and `sweep.test.mjs` if it has none, over it; a ref whose `pins.test.mjs` has no canary mode gets the candidates in its working copy of `certs.json` instead, and the report still lists them as candidates). A proof in `proofs.json` can name its own `ref` the same way. An hourly `schedule` checks npm's `latest` of every kernel, jsh, cdp, agent, `wasm-*`, `wasi-*`, `wasix-*` and `py-*` package that a `src/packages/**/package.json` pins, and runs once with every newer one as the overrides, only when that list differs from the last scheduled canary's (its inputs are kept in the Actions cache). A `pull_request` trigger, filtered to the canary's own files, runs the proof in [`scripts/canary/proofs.json`](scripts/canary/proofs.json) from one plan job, cancelling a superseded run: kernel 1.78.0 on the `sweep` shard must regress grep, sed, jq, xz, findutils, diffutils and patch with exit 70 (kernel #483). A second proof packs `@ai-ecoverse/slicc-cdp@1.26.2` with `npm pack`, uploads it from the plan job, and runs it as a candidate artifact on `packages-update-cdp` and `guard` with `repeat: 3`.
+- **Triggers:** `workflow_dispatch` and `workflow_call` with `overrides`, a JSON list of `name@version` (`["@ai-ecoverse/slicc-kernel@1.81.0"]`), and optionally `runner`, `shards` (names from [`scripts/canary/shards.json`](scripts/canary/shards.json); `follow-chat`, `remote-pydata`, `users-agent-ui`, `packages-update-cdp`, `guard`, `guard-set-extension-prompt`, `guard-set-extension-lagging`, `guard-set-proxy-prompt`, `guard-set-proxy-lagging`, `k4-link`, `user-packages-keys-favicon` and `rest` by default; a shard's `env` in that file, such as `GUARD_VARIANTS`, is set for its tests, or `sweep` for just the base-set sweep and the certs check), `expect` and `bios-ref` (any branch or sha of slicc-bios: the shard jobs check it out and lay this ref's `scripts/canary`, and `sweep.test.mjs` if it has none, over it; a ref whose `pins.test.mjs` has no canary mode gets the candidates in its working copy of `certs.json` instead, and the report still lists them as candidates). A proof in `proofs.json` can name its own `ref` the same way. An hourly `schedule` checks npm's `latest` of every kernel, jsh, cdp, agent, `wasm-*`, `wasi-*`, `wasix-*` and `py-*` package that a `src/packages/**/package.json` pins, and runs once with every newer one as the overrides, only when that list differs from the last scheduled canary's (its inputs are kept in the Actions cache). The same key covers what the optional catalog offers (each entry's npm `latest`, or the highest version in its `range`), so a new catalog release alone runs the catalog's shards (`packages-update-cdp`, `remote-pydata` and `rest`) against main's pins, since the catalog's tests take the version npm offers. A scheduled canary that ends red has the separate [`canary-issue.yml`](.github/workflows/canary-issue.yml) (on `workflow_run`, the only workflow here with `issues: write`, so callers of the reusable canary grant nothing more) file one open `known-issue` titled *canary: the scheduled canary is red*, or comment on it while it's open, with the verdict, the run and the catalog's offers ([`issue.mjs`](scripts/canary/issue.mjs)). homescoop's live certification-exceptions.json is the immediate fix: it denies a bad release at once. A `pull_request` trigger, filtered to the canary's own files, runs the proof in [`scripts/canary/proofs.json`](scripts/canary/proofs.json) from one plan job, cancelling a superseded run: kernel 1.78.0 on the `sweep` shard must regress grep, sed, jq, xz, findutils, diffutils and patch with exit 70 (kernel #483). A second proof packs `@ai-ecoverse/slicc-cdp@1.26.2` with `npm pack`, uploads it from the plan job, and runs it as a candidate artifact on `packages-update-cdp` and `guard` with `repeat: 3`.
 - **A candidate from another repo's run:** `candidate-package` (the package it replaces, `@ai-ecoverse/slicc-cdp`), `candidate-artifact` (an artifact holding one `npm pack` tarball of it), `candidate-run` (the run that uploaded it), `candidate-sha256` (the tarball's) and optionally `candidate-repo` (the caller's repository by default). Each shard job downloads the artifact with `github.token`, which under `workflow_call` is the caller's, so the caller's job needs `actions: read`. [`override-pins.mjs`](scripts/canary/override-pins.mjs) checks the tarball's sha256 before it reads anything and refuses a mismatch, then checks the tarball is that package with an exact version. It seeds the harness download cache with the bytes at the npm URL of that version, and rewrites the pins and locks through a local registry that serves npm's packuments with that version added, so an unpublished `x.y.z-pr.N.M` locks like a published one (npm's lock gets the registry URL back). The tests get the same packument (#599): each test process of a candidate run imports [`packuments.mjs`](scripts/canary/packuments.mjs), which checks the seeded tarball against `pins.json`'s sha256 and integrity again (refusing a mismatch, so no test runs) and, whenever the harness fetches that package's packument from npm, adds the version with the manifest from the tarball's own `package.json`, `dist.tarball` at the seeded npm URL and `dist.integrity` the tarball's sha512. The `dist-tags` stay npm's, so the candidate never becomes `latest`, and every other request passes through unchanged. Seven's in-kernel pnpm, installing the optional catalog's `slicc` say, then resolves the candidate like a published version. Everything else stays a registry version. The report lists it as `candidate (artifact <run>/<name>, sha256 …)`.
 - **Binding the candidate to its upload:** a call that names a candidate also passes `candidate-artifact-id` and `candidate-artifact-digest`, the `artifact-id` and `artifact-digest` outputs of the step that uploaded it (the digest is the zip's SHA-256, not the tarball's `candidate-sha256`; a `sha256:` prefix is allowed). `candidate-binding` is `strict` by default, and the plan refuses a candidate without both values. Only an explicit `candidate-binding: legacy` takes a candidate by name, as before; runs that name no candidate, such as the schedule and the PR proofs, don't set it. Before anything from the tested ref runs, [`scripts/canary/bind.mjs`](scripts/canary/bind.mjs) reads `GET /repos/{repo}/actions/artifacts/{id}` and `GET /repos/{repo}` and refuses the artifact unless its id, name, `workflow_run.id`, `workflow_run.repository_id` and digest are the bound ones and it hasn't expired. The shard then downloads it by `artifact-ids` with `digest-mismatch: error`, and the tarball's sha256 check stays. The PR proof's tarball is bound the same way, to the plan job's upload step.
 - **The canary's own scripts:** every checkout of its tools (the plan and report jobs, and the `scripts/canary` laid over the tested ref) is `job.workflow_sha`, the commit of the `canary.yml` that defines the job. Under `workflow_call` that is the called workflow's commit, not the caller's (`github.workflow_sha`), so a caller pinned to `canary.yml@<sha>` runs that commit's scripts, whatever `main` holds. The plan job prints `canary tools: PASS|FAIL` and fails unless it checked out that commit. `bios-ref` only picks the tested tree, and an empty one is that same commit.
@@ -615,7 +615,7 @@ On a pull request, the plan first reads the files the pull request changes (`git
 
 [`scripts/ci/scopes.json`](scripts/ci/scopes.json) maps each package name or pattern to its rows (`full` for the harness, Playwright and the installer's tar, `vendors` for the slicc CLI). The plan prints its mode and why in the job summary, and `ci / test` passes only when the jobs that mode skips were skipped and every other job passed: `ci: PASS docs plan, 0 shards, skipped integration and vendors`. The merge queue always runs everything, so `main` is never less tested.
 
-A shard also deletes the harness's stall traces (`stall-<n>-trace.json`, often 70–110 MB each) of tests that passed in every attempt, never skipped (in `artifacts/` and, after a retry, in the first attempt's copy too), and lists each one with its size under `trimmed` in its record and in the log. Screenshots, logs, coverage and every file of a test that failed, flipped or timed out in any attempt stay, as does everything from a file that crashed without reporting, and every artifact of a file in any of cert review's classes (`CLASSES` in [`scripts/cert/evidence.mjs`](scripts/cert/evidence.mjs)), or in no list yet, even when it passed. That keeps the `integration-<shard>` artifacts small enough for cert review's evidence.
+A shard also deletes the harness's stall traces (`stall-<n>-trace.json`, often 70–110 MB each) of tests that passed in every attempt, never skipped (in `artifacts/` and, after a retry, in the first attempt's copy too), and lists each one with its size under `trimmed` in its record and in the log. Screenshots, logs, coverage and every file of a test that failed, flipped or timed out in any attempt stay, as does everything from a file that crashed without reporting, and every artifact of a file in any of cert review's classes (`CLASSES` in [`scripts/cert/evidence.mjs`](scripts/cert/evidence.mjs)), or in no list yet, even when it passed. That keeps the `integration-<shard>` artifacts small enough for cert review's evidence. Every stall trace it keeps is then gzipped in place (`stall-<n>-trace.json.gz`) and listed under `compressed` with both sizes, which makes the evidence about ten times smaller.
 
 Every shard runs the files with a failing test once more and passes when they pass (`retry`, skipped when it wouldn't fit the shard's 62 minutes), and a shard that still fails cancels the others (`fail-fast`). Both were tested first. From 2026-10-17 to 2026-10-18 a two-by-two experiment by pull request number found that 0 of 28 merge queue runs with retry failed, against 15 of 42 without it. From 2026-10-18 to 2026-10-20 the number's parity picked fail-fast or not, with retry on both sides: over 525 runs, failing runs finished after a median of 29 minutes with fail-fast against 47 without (the first shard went red after about 26 minutes in both), passing runs took the same time (46 and 45 minutes), and the 65 pull requests merged since leaned the same way (mean CI wait 1.8 h against 2.4 h, time to merge 4.0 h against 4.9 h, not yet significant). A run's arm is now always `fail-fast+retry`. The plan, with the arm, the seed and each shard's items, is in the job summary and the `experiment-plan` artifact; each shard's record (`artifacts/experiment/<shard>.json`: its groups, the first run and any retry with their exit codes, counts and failed files) is in its `integration-<shard>` artifact, with each item's time and every test that failed and then passed on the retry. `ci / test` joins them into `summary.json` (the `experiment-summary` artifact), and for each test that flipped it files an issue labeled `flaky-test`, or comments on the open one for that test, with the run, the arm, the shard and the first run's error ([`scripts/ci/summary.mjs`](scripts/ci/summary.mjs)); this step never fails the check, and a fork's read-only token files nothing. `node scripts/ci/durations.mjs` refreshes `durations.json` with the median times of the last 40 runs' summaries.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.37.3",
+  "version": "1.39.3",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",
@@ -35,6 +35,7 @@
     "node": ">=26"
   },
   "scripts": {
+    "prepare": "slicc-install-hooks",
     "start": "node test/integration/chrome.mjs",
     "pretest": "playwright-core install --no-shell chromium",
     "test": "node --test --test-concurrency=1 --test-timeout=900000 --test-global-setup=test/integration/global.mjs ${SLICC_TESTS:-test/integration/*.test.mjs}",
@@ -44,10 +45,10 @@
     "format": "biome check --write ."
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc": "1.47.0",
-    "@ai-ecoverse/slicc-browsers": "1.10.3",
+    "@ai-ecoverse/slicc": "1.47.1",
+    "@ai-ecoverse/slicc-browsers": "1.13.5",
     "@ai-ecoverse/slicc-node": "2.5.1",
-    "@ai-ecoverse/slicc-shared-web": "1.24.2",
+    "@ai-ecoverse/slicc-shared-web": "1.30.2",
     "@ai-ecoverse/slicc-spectrum": "1.104.1",
     "@ai-ecoverse/slicc-vault": "1.15.1",
     "@biomejs/biome": "2.5.15",
@@ -56,10 +57,10 @@
     "lefthook": "2.2.1",
     "modern-tar": "0.8.5",
     "monocart-coverage-reports": "2.13.2",
-    "playwright-core": "1.64.0",
+    "playwright-core": "1.64.1",
     "semantic-release": "25.0.9",
     "semver": "7.8.5",
-    "wrangler": "4.150.0",
+    "wrangler": "4.151.0",
     "ws": "8.22.0"
   }
 }

package/src/packages/agent/package.json

@@ -4,6 +4,6 @@
   "description": "SLICC's agent, which the UI installs with pnpm in the background into /opt/agent in OPFS",
   "dependencies": {
     "@ai-ecoverse/slicc-agent": "6.18.3",
-    "@ai-ecoverse/slicc-kernel": "1.138.0"
+    "@ai-ecoverse/slicc-kernel": "1.143.4"
   }
 }

package/src/packages/agent/pnpm-lock.yaml

@@ -15,10 +15,10 @@ importers:
     dependencies:
       '@ai-ecoverse/slicc-agent':
         specifier: 6.18.3
-        version: 6.18.3(@ai-ecoverse/slicc-kernel@1.138.0)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
+        version: 6.18.3(@ai-ecoverse/slicc-kernel@1.143.4)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
       '@ai-ecoverse/slicc-kernel':
-        specifier: 1.138.0
-        version: 1.138.0
+        specifier: 1.143.4
+        version: 1.143.4
 
 packages:
 
@@ -36,9 +36,9 @@ packages:
     resolution: {integrity: sha512-WVaDUiZbd5nwG03+2WoQ8YA8ATC2mkx1DRCWpLuMFBNnyN0cd5IRoGF6KYNjMkXvBQCvZZxP+gwffrpmHYJ/cQ==}
     engines: {node: '>=24'}
 
-  '@ai-ecoverse/slicc-kernel@1.138.0':
-    resolution: {integrity: sha512-p5cdX1mB6xed1NcRGe0Uifm3NVx8d3YXzA2kLYH2d7HtcSwjvmOU566SUaUKBtbgwXHRAC5gAfW1QoD6/fAiOQ==}
-    engines: {node: '>=24'}
+  '@ai-ecoverse/slicc-kernel@1.143.4':
+    resolution: {integrity: sha512-wCO7MMHEooH/bZVxuRQFLiSMXE7MnFYnMTWZSgmm5J6S69v4yLT8T4SCLJ2LDkkM75fyizH3y5uhAeQA6VOCxQ==}
+    engines: {node: '>=26'}
 
   '@ai-ecoverse/slicc-vault@1.15.1':
     resolution: {integrity: sha512-qr1Pmw7lodtjiQgWkKgGcfbG63H61eHba4XBKXPlGYrRkYJ0vLTts1x82wYS6H6V4FaqAtLfdunwNvT0riz2CQ==}
@@ -346,10 +346,10 @@ packages:
 
 snapshots:
 
-  '@ai-ecoverse/slicc-agent@6.18.3(@ai-ecoverse/slicc-kernel@1.138.0)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
+  '@ai-ecoverse/slicc-agent@6.18.3(@ai-ecoverse/slicc-kernel@1.143.4)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
     dependencies:
       '@ai-ecoverse/slicc-browsers': 1.9.2
-      '@ai-ecoverse/slicc-kernel': 1.138.0
+      '@ai-ecoverse/slicc-kernel': 1.143.4
       '@ai-ecoverse/slicc-vault': 1.15.1
       '@aws-sdk/middleware-websocket': 3.972.54
       '@earendil-works/chord': 1.3.0
@@ -372,7 +372,7 @@ snapshots:
 
   '@ai-ecoverse/slicc-browsers@1.9.2': {}
 
-  '@ai-ecoverse/slicc-kernel@1.138.0': {}
+  '@ai-ecoverse/slicc-kernel@1.143.4': {}
 
   '@ai-ecoverse/slicc-vault@1.15.1': {}
 

package/src/packages/optional/catalog.json

@@ -101,9 +101,10 @@
     "id": "screen",
     "label": "screen"
   },
-  "@ai-ecoverse/wasi-dig": {
-    "id": "dig",
-    "label": "dig"
+  "@ai-ecoverse/wasix-bind": {
+    "id": "bind",
+    "label": "BIND tools (dig, host, nslookup)",
+    "replaces": ["@ai-ecoverse/wasi-dig"]
   },
   "@ai-ecoverse/wasix-websocat": {
     "id": "websocat",

package/src/packages/optional/package-lock.json

@@ -6,16 +6,16 @@
     "": {
       "name": "slicc-bios-optional",
       "dependencies": {
-        "@ai-ecoverse/mcpcat": "0.17.7",
-        "@ai-ecoverse/slicc-jsh": "0.45.4",
-        "@ai-ecoverse/sliccy-browser": "0.1.29",
+        "@ai-ecoverse/mcpcat": "0.18.2",
+        "@ai-ecoverse/slicc-jsh": "0.52.5",
+        "@ai-ecoverse/sliccy-browser": "0.1.34",
         "@ai-ecoverse/wasi-slicc": "1.47.0"
       }
     },
     "node_modules/@ai-ecoverse/mcpcat": {
-      "version": "0.17.7",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/mcpcat/-/mcpcat-0.17.7.tgz",
-      "integrity": "sha512-BunOzrFplONryNwPgLu36vSYQ/K+KqZiuMndFxtjJEj7yJJeqbjyDNYdX0DhQROeezDJ7qbzMMno7P3k0lXGUA==",
+      "version": "0.18.2",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/mcpcat/-/mcpcat-0.18.2.tgz",
+      "integrity": "sha512-dYRA4KhV22qVb+SEZJm8xKVQxJqqhg8W3763GT/u1TUnKY4J8ai1j9I6qoqGn8t2bqGnyf/HhuViGuUQrmepGw==",
       "license": "Apache-2.0",
       "bin": {
         "mcpcat": "dist/host/mcpcat.mjs"
@@ -26,9 +26,9 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-cdp": {
-      "version": "1.30.10",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-cdp/-/slicc-cdp-1.30.10.tgz",
-      "integrity": "sha512-VakByvxkHaUtVRPQaB3o9UOS587H5XewCUDJen/jCmgH0nMxZT1EXPZ/fLyZhgAPtfO28+qaIvnbCisTviPE4g==",
+      "version": "1.30.18",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-cdp/-/slicc-cdp-1.30.18.tgz",
+      "integrity": "sha512-8aty5CgO3hPiZ0H8ikx60j1QzTWJmr6MGRKAFy9DMDrU/nwqPnifx1UXLX6AW6GdvDsZdRR9NpAV2A4hWfj4ZA==",
       "license": "Apache-2.0",
       "workspaces": [
         "packages/sliccy-browser"
@@ -41,9 +41,9 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-jsh": {
-      "version": "0.45.4",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-jsh/-/slicc-jsh-0.45.4.tgz",
-      "integrity": "sha512-fSHMCOodMnPiSh+XfhiaXVVSVSRAg8at7vmdXFPtaXO3pzJ2A2WArSpaD3jlJife4zB2wZJHeR8buZOGqXyc3A==",
+      "version": "0.52.5",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-jsh/-/slicc-jsh-0.52.5.tgz",
+      "integrity": "sha512-v4S3zHWNCBuWejF8wNlxUwGppCqlYNc+PQpPm9T0LSMOmDTzW/sU3RdIDKSn2wqM1oHNha38CZbnjEHYS+01Gw==",
       "license": "Apache-2.0",
       "bin": {
         "jsh": "dist/host/jsh.mjs"
@@ -54,12 +54,12 @@
       }
     },
     "node_modules/@ai-ecoverse/sliccy-browser": {
-      "version": "0.1.29",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/sliccy-browser/-/sliccy-browser-0.1.29.tgz",
-      "integrity": "sha512-alXLJppvnsDqJXyGyo805OyLT3BVBRj+SuwUyEz8akPsilZghKnsYJJm+wrIyKxCXMuDUyaFz5ZMuZWIbmIgOw==",
+      "version": "0.1.34",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/sliccy-browser/-/sliccy-browser-0.1.34.tgz",
+      "integrity": "sha512-epSMU6SkUwuhCA6Ods927VtpxbrmsaajJj5o/UZhc6MG0dxj84GpNfExHDGsNvFh+jsM8gwLFFnqsgM4IRCX9w==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@ai-ecoverse/slicc-cdp": "1.30.10"
+        "@ai-ecoverse/slicc-cdp": "1.30.18"
       },
       "engines": {
         "node": ">=24"

package/src/packages/optional/package.json

@@ -3,9 +3,9 @@
   "private": true,
   "description": "The optional packages that seven pins because their publisher isn't homescoop's ladder: slicc-jsh, mcpcat, wasi-slicc (slicc-cli) and sliccy-browser (slicc-cdp). Release-state and cert review certify these pins; every other catalog entry is npm's latest behind the runtime gate. Never installed as a project: the panel runs pnpm add -g for each one.",
   "dependencies": {
-    "@ai-ecoverse/mcpcat": "0.17.7",
-    "@ai-ecoverse/slicc-jsh": "0.45.4",
-    "@ai-ecoverse/sliccy-browser": "0.1.29",
+    "@ai-ecoverse/mcpcat": "0.18.2",
+    "@ai-ecoverse/slicc-jsh": "0.52.5",
+    "@ai-ecoverse/sliccy-browser": "0.1.34",
     "@ai-ecoverse/wasi-slicc": "1.47.0"
   }
 }

package/src/packages/package-lock.json

@@ -6,10 +6,10 @@
     "": {
       "name": "slicc-bios-packages",
       "dependencies": {
-        "@ai-ecoverse/slicc-browsers": "1.10.3",
+        "@ai-ecoverse/slicc-browsers": "1.13.5",
         "@ai-ecoverse/slicc-cdp": "1.30.18",
         "@ai-ecoverse/slicc-clipboard": "1.0.2",
-        "@ai-ecoverse/slicc-kernel": "1.138.0",
+        "@ai-ecoverse/slicc-kernel": "1.143.4",
         "@ai-ecoverse/slicc-spectrum": "1.104.1",
         "@ai-ecoverse/wasi-fnox": "1.39.0-6",
         "@ai-ecoverse/wasi-pnpm": "12.9.1-19",
@@ -38,9 +38,9 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-browsers": {
-      "version": "1.10.3",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-browsers/-/slicc-browsers-1.10.3.tgz",
-      "integrity": "sha512-xUKkpE0oqtUGjObJSzrk7ny2rU8ZStoUp4Uxw2SPM6f7uw+M7X8MV0NuSyqkWYTzZJ6JPWyVJx0QvynSBXHPOw==",
+      "version": "1.13.5",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-browsers/-/slicc-browsers-1.13.5.tgz",
+      "integrity": "sha512-g1sNUBWX53Rkc26GtYJ2muKQ79nyQ+dK+AJExNBcYqI5JfTF6Ra2q5LSrlFDPFZqKDqDc7q2LIXrFg5ebwvWQg==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=24"
@@ -72,12 +72,12 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-kernel": {
-      "version": "1.138.0",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-kernel/-/slicc-kernel-1.138.0.tgz",
-      "integrity": "sha512-p5cdX1mB6xed1NcRGe0Uifm3NVx8d3YXzA2kLYH2d7HtcSwjvmOU566SUaUKBtbgwXHRAC5gAfW1QoD6/fAiOQ==",
+      "version": "1.143.4",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-kernel/-/slicc-kernel-1.143.4.tgz",
+      "integrity": "sha512-wCO7MMHEooH/bZVxuRQFLiSMXE7MnFYnMTWZSgmm5J6S69v4yLT8T4SCLJ2LDkkM75fyizH3y5uhAeQA6VOCxQ==",
       "license": "Apache-2.0",
       "engines": {
-        "node": ">=24"
+        "node": ">=26"
       }
     },
     "node_modules/@ai-ecoverse/slicc-spectrum": {

package/src/packages/package.json

@@ -3,10 +3,10 @@
   "private": true,
   "description": "Packages the BIOS installs from npm into OPFS, pinned by package-lock.json and pnpm-lock.yaml",
   "dependencies": {
-    "@ai-ecoverse/slicc-browsers": "1.10.3",
+    "@ai-ecoverse/slicc-browsers": "1.13.5",
     "@ai-ecoverse/slicc-cdp": "1.30.18",
     "@ai-ecoverse/slicc-clipboard": "1.0.2",
-    "@ai-ecoverse/slicc-kernel": "1.138.0",
+    "@ai-ecoverse/slicc-kernel": "1.143.4",
     "@ai-ecoverse/slicc-spectrum": "1.104.1",
     "@ai-ecoverse/wasi-fnox": "1.39.0-6",
     "@ai-ecoverse/wasi-pnpm": "12.9.1-19",

package/src/packages/pnpm-lock.yaml

@@ -9,8 +9,8 @@ importers:
   .:
     dependencies:
       '@ai-ecoverse/slicc-browsers':
-        specifier: 1.10.3
-        version: 1.10.3
+        specifier: 1.13.5
+        version: 1.13.5
       '@ai-ecoverse/slicc-cdp':
         specifier: 1.30.18
         version: 1.30.18
@@ -18,8 +18,8 @@ importers:
         specifier: 1.0.2
         version: 1.0.2
       '@ai-ecoverse/slicc-kernel':
-        specifier: 1.138.0
-        version: 1.138.0
+        specifier: 1.143.4
+        version: 1.143.4
       '@ai-ecoverse/slicc-spectrum':
         specifier: 1.104.1
         version: 1.104.1
@@ -98,8 +98,8 @@ importers:
 
 packages:
 
-  '@ai-ecoverse/slicc-browsers@1.10.3':
-    resolution: {integrity: sha512-xUKkpE0oqtUGjObJSzrk7ny2rU8ZStoUp4Uxw2SPM6f7uw+M7X8MV0NuSyqkWYTzZJ6JPWyVJx0QvynSBXHPOw==}
+  '@ai-ecoverse/slicc-browsers@1.13.5':
+    resolution: {integrity: sha512-g1sNUBWX53Rkc26GtYJ2muKQ79nyQ+dK+AJExNBcYqI5JfTF6Ra2q5LSrlFDPFZqKDqDc7q2LIXrFg5ebwvWQg==}
     engines: {node: '>=24'}
 
   '@ai-ecoverse/slicc-cdp@1.30.18':
@@ -111,9 +111,9 @@ packages:
     resolution: {integrity: sha512-p7b1h85qkiU0LKjNLCLiU7GVXjGigkyR2+VUCInM1cZo2yjLFxr7tGAOO09e6OG9nB7XKiQn3W88wb3s0gxy+g==}
     engines: {node: '>=24', slicc-kernel: '>=1.75.0'}
 
-  '@ai-ecoverse/slicc-kernel@1.138.0':
-    resolution: {integrity: sha512-p5cdX1mB6xed1NcRGe0Uifm3NVx8d3YXzA2kLYH2d7HtcSwjvmOU566SUaUKBtbgwXHRAC5gAfW1QoD6/fAiOQ==}
-    engines: {node: '>=24'}
+  '@ai-ecoverse/slicc-kernel@1.143.4':
+    resolution: {integrity: sha512-wCO7MMHEooH/bZVxuRQFLiSMXE7MnFYnMTWZSgmm5J6S69v4yLT8T4SCLJ2LDkkM75fyizH3y5uhAeQA6VOCxQ==}
+    engines: {node: '>=26'}
 
   '@ai-ecoverse/slicc-spectrum@1.104.1':
     resolution: {integrity: sha512-/NNo3NmWc8l4+fcVKlynOKzRFbi2N/1H1w8Hkn4N8B51UgjvAW+Y3oykgp0kePQPb11zjithkKmZjC22CdXMkw==}
@@ -207,13 +207,13 @@ packages:
 
 snapshots:
 
-  '@ai-ecoverse/slicc-browsers@1.10.3': {}
+  '@ai-ecoverse/slicc-browsers@1.13.5': {}
 
   '@ai-ecoverse/slicc-cdp@1.30.18': {}
 
   '@ai-ecoverse/slicc-clipboard@1.0.2': {}
 
-  '@ai-ecoverse/slicc-kernel@1.138.0': {}
+  '@ai-ecoverse/slicc-kernel@1.143.4': {}
 
   '@ai-ecoverse/slicc-spectrum@1.104.1': {}