@ai-ecoverse/slicc-bios 1.42.5 → 1.42.7

package/README.md

@@ -9,7 +9,7 @@ The page shows six boot steps as they run:
 3. **Install packages from npm into OPFS** – the installer reads [`src/packages/package-lock.json`](src/packages/package-lock.json), the lockfile the BIOS ships with. It skips packages that name an `os` or `cpu` (native binaries such as esbuild's, which can't run in a browser). For every other locked package it downloads the tarball from `registry.npmjs.org` and checks its `integrity`, then unpacks it with the built-in `DecompressionStream` and [`modern-tar`](https://github.com/ayuhito/modern-tar) into OPFS at its lockfile path (`node_modules/…`), dropping `.` segments from entry names and skipping any entry with `..`. A package that is already there is rewritten in place, never emptied first: every file is overwritten whole (an OPFS write commits on close), the entry points come last: a command's wasm (and its variants), then its glue or script with `bin`, `main` and `exports` targets, then `package.json`, and only then do the files the new version no longer has go, so a running kernel or another tab never finds the package missing. While it unpacks, it hashes every file (SHA-256) and records the hashes in IndexedDB (see [Integrity](#integrity)). It also keeps each file's mode from the tarball, owned by root: once a package's files are in, it hands their paths and modes to the kernel's `writeMetadata` (`@ai-ecoverse/slicc-kernel/meta`, read from the installed kernel), in one batch per run, so an executable outside `bin/`, such as pnpm's `shims/i`, stays executable when the kernel checks modes. The seed's files are recorded as root's `0644`. A kernel without `/meta` skips this. A package installed before the kernel had `/meta` gets its modes once, on the first run with it: the installer fetches its tarball again, checks its integrity, reads the modes from the headers without unpacking, and marks the receipt (`modes: true`). A package installed or replaced later is marked when it's stamped. It also records a receipt in `var/lib/bios/`. A package whose recorded integrity matches the lockfile's and whose files are still there isn't downloaded again, so pinning a new version replaces just that package. Replacing a package keeps its nested `node_modules`, and packages the lockfile no longer lists are deleted along with their receipts and hashes. A package without recorded hashes is downloaded again, even with a receipt, so the first boot after integrity checks arrived downloads the base set once. Last, the installer copies the deployment's `package.json` and `pnpm-lock.yaml` to the OPFS root for pnpm, and the lockfile once more to `var/lib/slicc/pnpm-lock.yaml`, which records what is installed (see [Updates](#updates)).
 4. **Add UI page to OPFS** – the installer copies `src/seed/` to `os/` in OPFS and records each file's hash. This is a stand-in until the UI ships as a downloadable asset.
 5. **Intercept same-origin requests** – `sw.js`, a module service worker, answers in-scope requests from OPFS and passes everything else to the network (see [What the service worker serves](#what-the-service-worker-serves)). The code it serves from OPFS carries `Cross-Origin-Opener-Policy: same-origin`, `Cross-Origin-Embedder-Policy: require-corp` and `Cross-Origin-Resource-Policy: same-origin`, so the UI page and the workers it starts are cross-origin isolated. Scripts it serves get their bare imports resolved (see [Modules](#modules)).
-6. **Serve UI from OPFS** – navigate to `os/` (keeping the URL fragment) with a cross-document view transition. That page imports [`@ai-ecoverse/slicc-kernel`](https://github.com/ai-ecoverse/slicc-kernel) and [`@ai-ecoverse/slicc-spectrum`](https://github.com/ai-ecoverse/slicc-spectrum) by name from `node_modules/` in OPFS, starts the kernel on the OPFS root and boots SLICC's UI, `<slicc-app>`, on spectrum's kernel model. The agent comes later, from its own pnpm project (see [Agent](#agent)). Commands come from the installed packages: `bash`, coreutils, `grep`, `sed`, findutils, `gawk`, `diff` (with `cmp`, `sdiff` and `diff3`), `patch`, `rg` (ripgrep), `jq`, `less`, `tree`, `tar` with `gzip`, `xz` and `bzip2` (and their `gunzip`, `zcat`, `unxz`, `xzcat`, `lzma`, `bunzip2` and `bzcat` names), `curl`, `mount`, `umount`, `clear`, `tput`, `tset`, `reset`, `pnpm` with its `npm` and `npx` shims, and `playwright-cli` and `curlwright` from slicc-cdp. The shell starts in `/home` as **root** (slicc-kernel ≥ 1.44.0 has users: `/etc/passwd` and `/etc/group` list root, nobody, sudo, users and nogroup), so the prompt ends in `#`, `whoami` and `id` say root, `ls -l` and `ps` show user names, and root's `HOME` is `/root` (mode 0700) with `PNPM_HOME=/usr/local/share/pnpm`. bash, coreutils, procps and git are the homescoop H1 rebuilds that know about users; older builds claimed uid 1000. `tar` forks the compressors for `-z`, `-J` and `-j` through `/bin/sh`. Hard links in archives aren't recreated, and there's no `--zstd`. xz is single-threaded: `-T` is accepted but has no effect. The `zgrep`, `xzgrep` and `bzgrep`-style wrapper scripts aren't installed as commands. Whatever the shell writes stays in OPFS across reloads. The kernel terminates HTTPS with `wasm-tls-engine`, so `curl https://…` works over whichever transport is picked (see [Network](#network)). `wasm-git` is left out for its size (53 MB); it can come later through pnpm.
+6. **Serve UI from OPFS** – navigate to `os/` (keeping the URL fragment) with a cross-document view transition. That page imports [`@ai-ecoverse/slicc-kernel`](https://github.com/ai-ecoverse/slicc-kernel) and [`@ai-ecoverse/slicc-spectrum`](https://github.com/ai-ecoverse/slicc-spectrum) by name from `node_modules/` in OPFS, starts the kernel on the OPFS root and boots SLICC's UI, `<slicc-app>`, on spectrum's kernel model. The agent comes later, from its own pnpm project (see [Agent](#agent)). Commands come from the installed packages: `bash`, coreutils, `grep`, `sed`, findutils, `gawk`, `diff` (with `cmp`, `sdiff` and `diff3`), `patch`, `rg` (ripgrep), `jq`, `less`, `tree`, `tar` with `gzip`, `xz` and `bzip2` (and their `gunzip`, `zcat`, `unxz`, `xzcat`, `lzma`, `bunzip2` and `bzcat` names), `curl`, `mount`, `umount`, `clear`, `tput`, `tset`, `reset`, `pnpm` with its `npm` and `npx` shims, and `playwright-cli` and `curlwright` from slicc-cdp. The shell starts in `/home` as **root** (slicc-kernel ≥ 1.44.0 has users: `/etc/passwd` and `/etc/group` list root, nobody, sudo, users and nogroup), so the prompt ends in `#`, `whoami` and `id` say root, `ls -l` and `ps` show user names, and root's `HOME` is `/root` (mode 0700) with `PNPM_HOME=/usr/local/share/pnpm`. bash, coreutils, procps and git are the homescoop H1 rebuilds that know about users; older builds claimed uid 1000. `tar` forks the compressors for `-z`, `-J` and `-j` through `/bin/sh`. Hard links in archives aren't recreated, and there's no `--zstd`. xz is single-threaded: `-T` is accepted but has no effect. xz's `xzgrep`, `xzdiff` and `xzless` wrapper scripts are installed too, running seven's own grep, diff and less; gzip's `zgrep` and bzip2's `bzgrep`-style wrappers aren't. Whatever the shell writes stays in OPFS across reloads. The kernel terminates HTTPS with `wasm-tls-engine`, so `curl https://…` works over whichever transport is picked (see [Network](#network)). `wasm-git` is left out for its size (53 MB); it can come later through pnpm.
 
 ## What the service worker serves
 
@@ -565,11 +565,11 @@ Seven certifies a gated package (slicc-kernel, slicc-cdp, slicc-clipboard, slicc
 - **Automerge once CI is green:** Renovate turns on auto-merge, so a PR goes through the merge queue once its required checks, `ci / integration` and `ci / review`, are green (see [CI](#ci)). No bot writes to a Renovate branch: the shipped lockfiles are part of what seven certifies, so a certified pin needs no `certs.json` line.
 - **Known breaks** are `packageRules` with `allowedVersions`, each with its reason and issue in `description`. Today the only one is wasi-pnpm skipping the deprecated 12.9.1-11 and 12.9.1-12 (homescoop#1128). wasm-bash's hold below 5.3.0-20 went with the pin of kernel 1.135.2, which has slicc-kernel#1146. bash 5.3.0-20 and later count as certified only with kernel 1.130.2 or later (homescoop#1230), and -21 declares `engines.slicc-kernel >=1.130.2`. `test/integration/renovate.test.mjs` checks the config, the gate and the queue in plain node.
 
-`test/integration/sweep.test.mjs`, the base-set sweep, runs with the other integration tests. It boots the BIOS, checks that each base-set package in OPFS has the version `package-lock.json` pins, and runs every command its `slicc.commands` lists with `--version` or a trivial call under `timeout 60`, then real grep, egrep, sed -i, xz, jq, find, xargs, diff, cmp, patch, awk, gzip, bzip2 and tar work. Each command is its own subtest named `<package> · <call>`. The clipboard commands, `sccopy` and `scpaste` included, run `--help` (`xclip -help`). Known exits: `false` 1, `bunzip2`/`bzcat --version` 2 (upstream), `i --version` 2 (argument parsing; 126 is #495), and `chcon`/`runcon` 1 (listed by coreutils, not built: "unknown program"). `[` runs as bash's builtin, since `timeout` can't exec it.
+`test/integration/sweep.test.mjs`, the base-set sweep, runs with the other integration tests. It boots the BIOS, checks that each base-set package in OPFS has the version `package-lock.json` pins, and runs every command its `slicc.commands` lists with `--version` or a trivial call under `timeout 60`, then real grep, egrep, sed -i, xz, xzgrep, jq, find, xargs, diff, cmp, patch, awk, gzip, bzip2 and tar work. Each command is its own subtest named `<package> · <call>`. The clipboard commands, `sccopy` and `scpaste` included, run `--help` (`xclip -help`). Known exits: `false` 1, `bunzip2`/`bzcat --version` 2 (upstream), `i --version` 2 (argument parsing; 126 is #495), and `chcon`/`runcon` 1 (listed by coreutils, not built: "unknown program"). `[` runs as bash's builtin, since `timeout` can't exec it.
 
 ### The npm package
 
-`@ai-ecoverse/slicc-bios` on npm carries only the manifests a consumer needs to test against what seven ships: `src/packages/package.json`, `package-lock.json`, `pnpm-lock.yaml` and `certs.json`, `src/packages/agent/package.json` and `pnpm-lock.yaml`, and `src/packages/optional/catalog.json`, `sources.json` and `exceptions.json`. It has no runtime code and no dependencies, and those paths stay where they are. `ci.yml` releases it from `main` only, after lint, through slicc-shared-web's pipeline: semantic-release reads the conventional commits, tags `v<version>`, writes the GitHub release and publishes to npm with provenance through npm's trusted publishing (`fledgling.workflow` is `ci.yml`). The deploy to seven (`deploy.yml`) is separate and doesn't wait for it.
+`@ai-ecoverse/slicc-bios` on npm carries only the manifests a consumer needs to test against what seven ships: `src/packages/package.json`, `package-lock.json`, `pnpm-lock.yaml` and `certs.json`, `src/packages/agent/package.json` and `pnpm-lock.yaml`, and `src/packages/optional/catalog.json`, `sources.json` and `exceptions.json`. It has no runtime code and no dependencies, and those paths stay where they are. `ci.yml` releases it from `main` only, after lint, through slicc-shared-web's pipeline: semantic-release reads the conventional commits, tags `v<version>`, writes the GitHub release and publishes to npm with provenance through npm's trusted publishing (`fledgling.workflow` is `ci.yml`). The same release job then publishes seven (see [Hosting](#hosting)).
 
 ## Develop
 
@@ -597,20 +597,21 @@ No test calls a real model. Every test serves an empty `packages/agent/` project
 [`.github/workflows/ci.yml`](.github/workflows/ci.yml) is one caller of [slicc-shared-web's pipeline](https://github.com/ai-ecoverse/slicc-shared-web#pipeline), pinned to the release `@ai-ecoverse/slicc-shared-web` has in `devDependencies` (Renovate moves both in one PR). It runs on pull requests, the merge queue and pushes to `main`:
 
 - **Pull requests and the merge queue:** lint, then every `test/integration/*.test.mjs` split by the last runs' JUnit timings over 12 pool shards (`ci / integration`), then on a pull request the Claude and Codex reviews (`ci / review`) with this repository's `review-prompt`. The shared guard vectors run as one file per path (extension, proxy), target group (`seven`, `vault`, `vault-x`, `apex` and the rest, `test/integration/guard-groups.mjs`) and detach variant (`lagging` or the others), 20 files of 2 to about 12 minutes, so the split can balance them. The slicc CLI tests use `node_modules/.bin/slicc` (or `SLICC_CLI`).
-- **`main`:** semantic-release publishes the npm package (see [The npm package](#the-npm-package)). [`deploy.yml`](.github/workflows/deploy.yml) deploys every push to `main` and `bb/**` (see [Hosting](#hosting)).
+- **`main`:** semantic-release publishes the npm package (see [The npm package](#the-npm-package)). When it releases, the pipeline's `after-release` publishes that version to seven, in the `production` environment (see [Hosting](#hosting)). [`deploy.yml`](.github/workflows/deploy.yml) publishes every push to a `bb/**` branch as a preview.
 
 Require `ci / integration` and `ci / review`. There is no retry: a flaky test fails the run.
 
 ## Hosting
 
-`main` is live at <https://seven.sliccy.ai/>, and every `bb/**` branch at `https://<branch>.sliccy.ai/`, where the branch name is lowercased and runs of anything but letters and digits become `-` (`bb/edge-hosting` → <https://bb-edge-hosting.sliccy.ai/>). Other branches, Renovate's included, get no preview. Each host is its own origin, so a branch gets its own OPFS and service worker and can't disturb `seven`. `https://www.sliccy.ai/7/` serves the same `seven/` next to SLICC 6 (sliccy-ai#51, see [Next to SLICC 6](#next-to-slicc-6-wwwsliccyai7)).
+The newest release is live at <https://seven.sliccy.ai/>, and every `bb/**` branch at `https://<branch>.sliccy.ai/`, where the branch name is lowercased and runs of anything but letters and digits become `-` (`bb/edge-hosting` → <https://bb-edge-hosting.sliccy.ai/>). Other branches, Renovate's included, get no preview. Each host is its own origin, so a branch gets its own OPFS and service worker and can't disturb `seven`. `https://www.sliccy.ai/7/` serves the same `seven/` next to SLICC 6 (sliccy-ai#51, see [Next to SLICC 6](#next-to-slicc-6-wwwsliccyai7)).
 
 The hosts are served by the [sliccy-ai](https://github.com/ai-ecoverse/sliccy-ai) worker from the R2 bucket `slicc-bios`. This repo only publishes into that bucket:
 
 - [`edge/publish.mjs`](edge/publish.mjs) `<branch>` uploads `src/` to `seven/` for `main` and to `branches/<label>/` for every other branch, and deletes what the previous upload had and this one doesn't. A manifest next to it (`seven.json`, `branches/<label>.json`) records which branch owns the label, so two branches that map to the same label can't overwrite each other.
 - The bucket expires everything under `branches/` 30 days after upload. Every push uploads all files again, so a branch stays up while it's active and disappears a month after its last push. Nothing needs to be cleaned up when a branch is deleted.
-- [`.github/workflows/deploy.yml`](.github/workflows/deploy.yml) publishes on every push to `main` or a `bb/**` branch, on `ubuntu-latest`. A newer push to a `bb/**` branch cancels its running publish; a publish of `main` is never cancelled.
-  - **`main`** publishes `seven/` with `CLOUDFLARE_API_TOKEN`, an account token with Workers R2 Storage Write. That token could overwrite `seven/`, so it lives only in the `production` environment, whose deployment branch policy allows `main` alone. A branch that changes the workflow can't read it.
+- **seven** is published only by a release. On a push to `main`, the pipeline's release job runs semantic-release in the `production` environment, and when that tags a new `v<version>` its `after-release` command runs `edge/publish.mjs main`, which uploads `seven/`. A push that releases nothing (`chore:`, `ci:`, `docs:`, `test:` and the like) publishes nothing, so a change that only matters to seven needs a `fix:` or `feat:` commit to go live. A release job is never cancelled by a newer one.
+  - The upload uses `SLICC_BIOS_DEPLOY_TOKEN`, an account token with Workers R2 Storage Write, handed to wrangler as `CLOUDFLARE_API_TOKEN`. That token could overwrite `seven/`, so it lives only in the `production` environment, whose deployment branch policy allows `main` alone, and `ci.yml` gives it only to the release job (`release-secrets`). The pipeline keeps its own `CLOUDFLARE_API_TOKEN`, the reviewers' screenshot token, out of `after-release`, hence the separate name.
+- [`.github/workflows/deploy.yml`](.github/workflows/deploy.yml) publishes every push to a `bb/**` branch, on `ubuntu-latest`. A newer push to the branch cancels its running publish.
   - **A `bb/**` branch** holds no secret. It runs in the `preview` environment, with no approval step and `id-token: write`. `edge/publish.mjs` asks GitHub for the job's OIDC token (audience `https://sliccy.ai`) and publishes through the sliccy-ai worker's `/api/publish/*` route. The route checks the token's signature, issuer, audience, expiry, repository and branch, then derives `branches/<label>/` from the branch itself. A branch can only ever write its own prefix, and never `seven/`. It first writes a manifest listing both the previous upload's files and this one's, so a publish cancelled midway leaves every file it uploaded on the list for the next publish to delete. Then files go up eight at a time, then deletions, then the final manifest.
 
 ## Rules

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.42.5",
+  "version": "1.42.7",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",

package/src/packages/agent/package.json

@@ -4,6 +4,6 @@
   "description": "SLICC's agent, which the UI installs with pnpm in the background into /opt/agent in OPFS",
   "dependencies": {
     "@ai-ecoverse/slicc-agent": "6.18.3",
-    "@ai-ecoverse/slicc-kernel": "1.153.0"
+    "@ai-ecoverse/slicc-kernel": "1.159.4"
   }
 }

package/src/packages/agent/pnpm-lock.yaml

@@ -15,10 +15,10 @@ importers:
     dependencies:
       '@ai-ecoverse/slicc-agent':
         specifier: 6.18.3
-        version: 6.18.3(@ai-ecoverse/slicc-kernel@1.153.0)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
+        version: 6.18.3(@ai-ecoverse/slicc-kernel@1.159.4)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
       '@ai-ecoverse/slicc-kernel':
-        specifier: 1.153.0
-        version: 1.153.0
+        specifier: 1.159.4
+        version: 1.159.4
 
 packages:
 
@@ -36,8 +36,8 @@ packages:
     resolution: {integrity: sha512-WVaDUiZbd5nwG03+2WoQ8YA8ATC2mkx1DRCWpLuMFBNnyN0cd5IRoGF6KYNjMkXvBQCvZZxP+gwffrpmHYJ/cQ==}
     engines: {node: '>=24'}
 
-  '@ai-ecoverse/slicc-kernel@1.153.0':
-    resolution: {integrity: sha512-t3HYo8sUNqStArqjdmIeI3HHM2+99xUE+AtepQuZiGmCZjyj9nWZ6cX9R3DZGTv/S24ypUZXTJ0mYDBfQ3X1NQ==}
+  '@ai-ecoverse/slicc-kernel@1.159.4':
+    resolution: {integrity: sha512-LSiUILx2oUctYW7PCHSm3QmK+msLF0yqdwFW0n4Ihokzd7oWjnTeYt3MNzXMYnI5HkCbhYGUJNnKNFDqcAp4hg==}
     engines: {node: '>=26'}
 
   '@ai-ecoverse/slicc-vault@1.15.1':
@@ -346,10 +346,10 @@ packages:
 
 snapshots:
 
-  '@ai-ecoverse/slicc-agent@6.18.3(@ai-ecoverse/slicc-kernel@1.153.0)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
+  '@ai-ecoverse/slicc-agent@6.18.3(@ai-ecoverse/slicc-kernel@1.159.4)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
     dependencies:
       '@ai-ecoverse/slicc-browsers': 1.9.2
-      '@ai-ecoverse/slicc-kernel': 1.153.0
+      '@ai-ecoverse/slicc-kernel': 1.159.4
       '@ai-ecoverse/slicc-vault': 1.15.1
       '@aws-sdk/middleware-websocket': 3.972.54
       '@earendil-works/chord': 1.3.0
@@ -372,7 +372,7 @@ snapshots:
 
   '@ai-ecoverse/slicc-browsers@1.9.2': {}
 
-  '@ai-ecoverse/slicc-kernel@1.153.0': {}
+  '@ai-ecoverse/slicc-kernel@1.159.4': {}
 
   '@ai-ecoverse/slicc-vault@1.15.1': {}
 

package/src/packages/package-lock.json

@@ -9,7 +9,7 @@
         "@ai-ecoverse/slicc-browsers": "1.18.1",
         "@ai-ecoverse/slicc-cdp": "1.41.4",
         "@ai-ecoverse/slicc-clipboard": "1.1.1",
-        "@ai-ecoverse/slicc-kernel": "1.153.0",
+        "@ai-ecoverse/slicc-kernel": "1.159.4",
         "@ai-ecoverse/slicc-spectrum": "1.104.1",
         "@ai-ecoverse/wasi-fnox": "1.40.0-1",
         "@ai-ecoverse/wasi-pnpm": "12.9.1-21",
@@ -76,9 +76,9 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-kernel": {
-      "version": "1.153.0",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-kernel/-/slicc-kernel-1.153.0.tgz",
-      "integrity": "sha512-t3HYo8sUNqStArqjdmIeI3HHM2+99xUE+AtepQuZiGmCZjyj9nWZ6cX9R3DZGTv/S24ypUZXTJ0mYDBfQ3X1NQ==",
+      "version": "1.159.4",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-kernel/-/slicc-kernel-1.159.4.tgz",
+      "integrity": "sha512-LSiUILx2oUctYW7PCHSm3QmK+msLF0yqdwFW0n4Ihokzd7oWjnTeYt3MNzXMYnI5HkCbhYGUJNnKNFDqcAp4hg==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=26"

package/src/packages/package.json

@@ -6,7 +6,7 @@
     "@ai-ecoverse/slicc-browsers": "1.18.1",
     "@ai-ecoverse/slicc-cdp": "1.41.4",
     "@ai-ecoverse/slicc-clipboard": "1.1.1",
-    "@ai-ecoverse/slicc-kernel": "1.153.0",
+    "@ai-ecoverse/slicc-kernel": "1.159.4",
     "@ai-ecoverse/slicc-spectrum": "1.104.1",
     "@ai-ecoverse/wasi-fnox": "1.40.0-1",
     "@ai-ecoverse/wasi-pnpm": "12.9.1-21",

package/src/packages/pnpm-lock.yaml

@@ -18,8 +18,8 @@ importers:
         specifier: 1.1.1
         version: 1.1.1
       '@ai-ecoverse/slicc-kernel':
-        specifier: 1.153.0
-        version: 1.153.0
+        specifier: 1.159.4
+        version: 1.159.4
       '@ai-ecoverse/slicc-spectrum':
         specifier: 1.104.1
         version: 1.104.1
@@ -112,8 +112,8 @@ packages:
     engines: {node: '>=24', slicc-kernel: '>=1.75.0'}
     hasBin: true
 
-  '@ai-ecoverse/slicc-kernel@1.153.0':
-    resolution: {integrity: sha512-t3HYo8sUNqStArqjdmIeI3HHM2+99xUE+AtepQuZiGmCZjyj9nWZ6cX9R3DZGTv/S24ypUZXTJ0mYDBfQ3X1NQ==}
+  '@ai-ecoverse/slicc-kernel@1.159.4':
+    resolution: {integrity: sha512-LSiUILx2oUctYW7PCHSm3QmK+msLF0yqdwFW0n4Ihokzd7oWjnTeYt3MNzXMYnI5HkCbhYGUJNnKNFDqcAp4hg==}
     engines: {node: '>=26'}
 
   '@ai-ecoverse/slicc-spectrum@1.104.1':
@@ -221,7 +221,7 @@ snapshots:
 
   '@ai-ecoverse/slicc-clipboard@1.1.1': {}
 
-  '@ai-ecoverse/slicc-kernel@1.153.0': {}
+  '@ai-ecoverse/slicc-kernel@1.159.4': {}
 
   '@ai-ecoverse/slicc-spectrum@1.104.1': {}