@ai-ecoverse/slicc-bios 1.50.2 → 1.51.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -6,7 +6,7 @@ The page shows six boot steps as they run:
|
|
|
6
6
|
|
|
7
7
|
1. **Acquire OPFS** – open the origin private file system and ask for persistent storage.
|
|
8
8
|
2. **Create installer worker** – start `installer.js`, a shared worker that does all of the BIOS's OPFS writes and is shared by every tab.
|
|
9
|
-
3. **Install packages from npm into OPFS** – the installer reads [`src/packages/package-lock.json`](src/packages/package-lock.json), the lockfile the BIOS ships with. It pins only what UI boot and the agent install need (Lars, 2026-10-21): slicc-kernel, slicc-spectrum, slicc-browsers (the guard's catalog), slicc-capture and slicc-audio (the page's capture and audio), wasi-pnpm, bash, coreutils, findutils, the TLS engine (the kernel's HTTPS) and fnox (the agent's secrets). Every other tool comes after boot, at npm's `latest` (see [Seven's tools](#sevens-tools)). It skips packages that name an `os` or `cpu` (native binaries such as esbuild's, which can't run in a browser). For every other locked package it downloads the tarball from `registry.npmjs.org` and checks its `integrity`, then unpacks it with the built-in `DecompressionStream` and [`modern-tar`](https://github.com/ayuhito/modern-tar) into OPFS at its lockfile path (`node_modules/…`), dropping `.` segments from entry names and skipping any entry with `..`. A package that is already there is rewritten in place, never emptied first: every file is overwritten whole (an OPFS write commits on close), the entry points come last: a command's wasm (and its variants), then its glue or script with `bin`, `main` and `exports` targets, then `package.json`, and only then do the files the new version no longer has go, so a running kernel or another tab never finds the package missing. While it unpacks, it hashes every file (SHA-256) and records the hashes in IndexedDB (see [Integrity](#integrity)). It also keeps each file's mode from the tarball, owned by root: once a package's files are in, it hands their paths and modes to the kernel's `writeMetadata` (`@ai-ecoverse/slicc-kernel/meta`, read from the installed kernel), in one batch per run, so an executable outside `bin/`, such as pnpm's `shims/i`, stays executable when the kernel checks modes. The seed's files are recorded as root's `0644`. A kernel without `/meta` skips this. A package installed before the kernel had `/meta` gets its modes once, on the first run with it: the installer fetches its tarball again, checks its integrity, reads the modes from the headers without unpacking, and marks the receipt (`modes: true`). A package installed or replaced later is marked when it's stamped. It also records a receipt in `var/lib/bios/`. A package whose recorded integrity matches the lockfile's and whose files are still there isn't downloaded again, so pinning a new version replaces just that package. Replacing a package keeps its nested `node_modules`, and packages the lockfile no longer lists are deleted along with their receipts and hashes. A package without recorded hashes is downloaded again, even with a receipt, so the first boot after integrity checks arrived downloads the base set once. Last, the installer copies the deployment's `package.json` and `pnpm-lock.yaml` to the OPFS root for pnpm, and the lockfile once more to `var/lib/slicc/pnpm-lock.yaml`, which records what is installed (see [Updates](#updates)).
|
|
9
|
+
3. **Install packages from npm into OPFS** – the installer reads [`src/packages/package-lock.json`](src/packages/package-lock.json), the lockfile the BIOS ships with. It pins only what UI boot and the agent install need (Lars, 2026-10-21): slicc-kernel, slicc-spectrum, slicc-browsers (the guard's catalog), slicc-capture and slicc-audio (the page's capture and audio), wasi-pnpm, bash, coreutils, findutils, the TLS engine (the kernel's HTTPS) and fnox (the agent's secrets). Every other tool comes after boot, at npm's `latest` (see [Seven's tools](#sevens-tools)). It skips packages that name an `os` or `cpu` (native binaries such as esbuild's, which can't run in a browser). For every other locked package it downloads the tarball from `registry.npmjs.org` and checks its `integrity`, then unpacks it with the built-in `DecompressionStream` and [`modern-tar`](https://github.com/ayuhito/modern-tar) into OPFS at its lockfile path (`node_modules/…`), dropping `.` segments from entry names and skipping any entry with `..`. A package that is already there is rewritten in place, never emptied first: every file is overwritten whole (an OPFS write commits on close), the entry points come last: a command's wasm (and its variants), then its glue or script with `bin`, `main` and `exports` targets, then `package.json`, and only then do the files the new version no longer has go, so a running kernel or another tab never finds the package missing. Each package's overwrite, sweep and hashes run inside the installed kernel's `replacing()` (`@ai-ecoverse/slicc-kernel/meta`, kernel 1.168.0 and later, loaded once per run like `writeMetadata` below). It holds the package directory's Web Lock `slicc-kernel-replacing:v1:slicc-kernel:/<path>` until the package is written and the running kernels have been told to drop what they cached of it, and every kernel loads a program's files under that lock. So an exec that starts meanwhile waits, then loads the new version whole, never the new wasm with the old glue ([#663](https://github.com/ai-ecoverse/slicc-bios/issues/663)). A kernel without `replacing()` gets its packages written as before. While it unpacks, it hashes every file (SHA-256) and records the hashes in IndexedDB (see [Integrity](#integrity)). It also keeps each file's mode from the tarball, owned by root: once a package's files are in, it hands their paths and modes to the kernel's `writeMetadata` (`@ai-ecoverse/slicc-kernel/meta`, read from the installed kernel), in one batch per run, so an executable outside `bin/`, such as pnpm's `shims/i`, stays executable when the kernel checks modes. The seed's files are recorded as root's `0644`. A kernel without `/meta` skips this. A package installed before the kernel had `/meta` gets its modes once, on the first run with it: the installer fetches its tarball again, checks its integrity, reads the modes from the headers without unpacking, and marks the receipt (`modes: true`). A package installed or replaced later is marked when it's stamped. It also records a receipt in `var/lib/bios/`. A package whose recorded integrity matches the lockfile's and whose files are still there isn't downloaded again, so pinning a new version replaces just that package. Replacing a package keeps its nested `node_modules`, and packages the lockfile no longer lists are deleted along with their receipts and hashes. A package without recorded hashes is downloaded again, even with a receipt, so the first boot after integrity checks arrived downloads the base set once. Last, the installer copies the deployment's `package.json` and `pnpm-lock.yaml` to the OPFS root for pnpm, and the lockfile once more to `var/lib/slicc/pnpm-lock.yaml`, which records what is installed (see [Updates](#updates)).
|
|
10
10
|
4. **Add UI page to OPFS** – the installer copies `src/seed/` to `os/` in OPFS and records each file's hash. This is a stand-in until the UI ships as a downloadable asset.
|
|
11
11
|
5. **Intercept same-origin requests** – `sw.js`, a module service worker, answers in-scope requests from OPFS and passes everything else to the network (see [What the service worker serves](#what-the-service-worker-serves)). The code it serves from OPFS carries `Cross-Origin-Opener-Policy: same-origin`, `Cross-Origin-Embedder-Policy: require-corp` and `Cross-Origin-Resource-Policy: same-origin`, so the UI page and the workers it starts are cross-origin isolated. Scripts it serves get their bare imports resolved (see [Modules](#modules)).
|
|
12
12
|
|
|
@@ -32,6 +32,7 @@ The other 20 tools are listed in [`src/packages/tools.json`](src/packages/tools.
|
|
|
32
32
|
- npm's `latest`, through the same listing rules as an optional package: provenance, exceptions, engines, and a walk-back of at most five versions;
|
|
33
33
|
- never older than the installed one;
|
|
34
34
|
- one that doesn't pass, or doesn't come back from pnpm, leaves the version it had. Its row reads *Not offered: …*.
|
|
35
|
+
- **While the first round runs:** a command of a tool that isn't there yet (`jq`, `curl`, `rg`, …) answers `jq: seven is still installing it; Install / Update shows its progress` and exits 127, in the terminal, for the agent and under sudo. Before the first round installs anything, seven writes one placeholder package, `slicc-pending-tools`, into `/opt/slicc/pending` (protected like the rest of `/opt/slicc`), with a `#!/bin/sh` script for each command those tools' npm docs list. The kernel scans that root last, after `/opt/slicc/tools` and `/opt/user`, so anything real wins as soon as it's installed. When the round ends, seven removes the whole root, whatever installed, so `command -v jq` and bash's own `command not found` tell the truth again. Later rounds put no placeholders.
|
|
35
36
|
- **Offline:** what's installed stays. Nothing is fetched until npm answers again.
|
|
36
37
|
- **Moving an old profile over:** an existing profile has the tools in `/node_modules`. The installer keeps each one there until `/opt/slicc/tools` has it. When the installer can't read `tools.json` (a network error, a 5xx or broken JSON), it prunes nothing that run, since it can't tell a tool waiting to move from a dropped package; a deployment without `tools.json` (404) prunes as before. Then seven removes the old copy through the kernel, and its receipt and ledger entry through the installer (`retire`). A tool therefore never disappears, offline or not.
|
|
37
38
|
- **Install / Update:** each tool has a row (`tools:<id>`, `preinstalled: true`), with the version it has, what npm offers, and why a newer one isn't offered. Retry or Update checks again. There's no Remove.
|
package/package.json
CHANGED
|
@@ -15,10 +15,10 @@ importers:
|
|
|
15
15
|
dependencies:
|
|
16
16
|
'@ai-ecoverse/slicc-agent':
|
|
17
17
|
specifier: 7.8.8
|
|
18
|
-
version: 7.8.8(@ai-ecoverse/slicc-kernel@1.
|
|
18
|
+
version: 7.8.8(@ai-ecoverse/slicc-kernel@1.168.1)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
|
|
19
19
|
'@ai-ecoverse/slicc-kernel':
|
|
20
|
-
specifier: 1.
|
|
21
|
-
version: 1.
|
|
20
|
+
specifier: 1.168.1
|
|
21
|
+
version: 1.168.1
|
|
22
22
|
|
|
23
23
|
packages:
|
|
24
24
|
|
|
@@ -39,8 +39,8 @@ packages:
|
|
|
39
39
|
resolution: {integrity: sha512-wdihEFKgVCU9xjL7D/lJeMveGBosqwqDXzJNh0Y4mo6XNAXRehY9lpq1XpFx+Pt4jCPzEZwYfjChPLC1MdXu+g==}
|
|
40
40
|
engines: {node: '>=24'}
|
|
41
41
|
|
|
42
|
-
'@ai-ecoverse/slicc-kernel@1.
|
|
43
|
-
resolution: {integrity: sha512-
|
|
42
|
+
'@ai-ecoverse/slicc-kernel@1.168.1':
|
|
43
|
+
resolution: {integrity: sha512-2WpU/oPlBwAcKF8UJYcIlAncPzFL6xwPXX+UfB48e/Skxo0Byo6SfKVgR+2P5qqJ6lPvaBD6v4XZpExuJJohxw==}
|
|
44
44
|
engines: {node: '>=26'}
|
|
45
45
|
|
|
46
46
|
'@ai-ecoverse/slicc-scrub@1.1.0':
|
|
@@ -355,10 +355,10 @@ snapshots:
|
|
|
355
355
|
|
|
356
356
|
'@ai-ecoverse/jerk-oauth@1.3.0': {}
|
|
357
357
|
|
|
358
|
-
'@ai-ecoverse/slicc-agent@7.8.8(@ai-ecoverse/slicc-kernel@1.
|
|
358
|
+
'@ai-ecoverse/slicc-agent@7.8.8(@ai-ecoverse/slicc-kernel@1.168.1)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
|
|
359
359
|
dependencies:
|
|
360
360
|
'@ai-ecoverse/slicc-browsers': 1.18.15
|
|
361
|
-
'@ai-ecoverse/slicc-kernel': 1.
|
|
361
|
+
'@ai-ecoverse/slicc-kernel': 1.168.1
|
|
362
362
|
'@ai-ecoverse/slicc-vault': 1.17.0
|
|
363
363
|
'@aws-sdk/middleware-websocket': 3.972.54
|
|
364
364
|
'@earendil-works/chord': 1.4.0
|
|
@@ -382,7 +382,7 @@ snapshots:
|
|
|
382
382
|
|
|
383
383
|
'@ai-ecoverse/slicc-browsers@1.18.15': {}
|
|
384
384
|
|
|
385
|
-
'@ai-ecoverse/slicc-kernel@1.
|
|
385
|
+
'@ai-ecoverse/slicc-kernel@1.168.1': {}
|
|
386
386
|
|
|
387
387
|
'@ai-ecoverse/slicc-scrub@1.1.0': {}
|
|
388
388
|
|
|
@@ -9,7 +9,7 @@
|
|
|
9
9
|
"@ai-ecoverse/slicc-audio": "1.1.6",
|
|
10
10
|
"@ai-ecoverse/slicc-browsers": "1.18.16",
|
|
11
11
|
"@ai-ecoverse/slicc-capture": "1.4.1",
|
|
12
|
-
"@ai-ecoverse/slicc-kernel": "1.
|
|
12
|
+
"@ai-ecoverse/slicc-kernel": "1.168.1",
|
|
13
13
|
"@ai-ecoverse/slicc-spectrum": "1.107.2",
|
|
14
14
|
"@ai-ecoverse/wasi-fnox": "1.40.0-1",
|
|
15
15
|
"@ai-ecoverse/wasi-pnpm": "12.9.1-21",
|
|
@@ -61,9 +61,9 @@
|
|
|
61
61
|
}
|
|
62
62
|
},
|
|
63
63
|
"node_modules/@ai-ecoverse/slicc-kernel": {
|
|
64
|
-
"version": "1.
|
|
65
|
-
"resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-kernel/-/slicc-kernel-1.
|
|
66
|
-
"integrity": "sha512-
|
|
64
|
+
"version": "1.168.1",
|
|
65
|
+
"resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-kernel/-/slicc-kernel-1.168.1.tgz",
|
|
66
|
+
"integrity": "sha512-2WpU/oPlBwAcKF8UJYcIlAncPzFL6xwPXX+UfB48e/Skxo0Byo6SfKVgR+2P5qqJ6lPvaBD6v4XZpExuJJohxw==",
|
|
67
67
|
"license": "Apache-2.0",
|
|
68
68
|
"engines": {
|
|
69
69
|
"node": ">=26"
|
|
@@ -6,7 +6,7 @@
|
|
|
6
6
|
"@ai-ecoverse/slicc-audio": "1.1.6",
|
|
7
7
|
"@ai-ecoverse/slicc-browsers": "1.18.16",
|
|
8
8
|
"@ai-ecoverse/slicc-capture": "1.4.1",
|
|
9
|
-
"@ai-ecoverse/slicc-kernel": "1.
|
|
9
|
+
"@ai-ecoverse/slicc-kernel": "1.168.1",
|
|
10
10
|
"@ai-ecoverse/slicc-spectrum": "1.107.2",
|
|
11
11
|
"@ai-ecoverse/wasi-fnox": "1.40.0-1",
|
|
12
12
|
"@ai-ecoverse/wasi-pnpm": "12.9.1-21",
|
|
@@ -18,8 +18,8 @@ importers:
|
|
|
18
18
|
specifier: 1.4.1
|
|
19
19
|
version: 1.4.1
|
|
20
20
|
'@ai-ecoverse/slicc-kernel':
|
|
21
|
-
specifier: 1.
|
|
22
|
-
version: 1.
|
|
21
|
+
specifier: 1.168.1
|
|
22
|
+
version: 1.168.1
|
|
23
23
|
'@ai-ecoverse/slicc-spectrum':
|
|
24
24
|
specifier: 1.107.2
|
|
25
25
|
version: 1.107.2
|
|
@@ -58,8 +58,8 @@ packages:
|
|
|
58
58
|
engines: {node: '>=24', slicc-kernel: '>=1.153.0'}
|
|
59
59
|
hasBin: true
|
|
60
60
|
|
|
61
|
-
'@ai-ecoverse/slicc-kernel@1.
|
|
62
|
-
resolution: {integrity: sha512-
|
|
61
|
+
'@ai-ecoverse/slicc-kernel@1.168.1':
|
|
62
|
+
resolution: {integrity: sha512-2WpU/oPlBwAcKF8UJYcIlAncPzFL6xwPXX+UfB48e/Skxo0Byo6SfKVgR+2P5qqJ6lPvaBD6v4XZpExuJJohxw==}
|
|
63
63
|
engines: {node: '>=26'}
|
|
64
64
|
|
|
65
65
|
'@ai-ecoverse/slicc-ortllama@1.28.0':
|
|
@@ -252,7 +252,7 @@ snapshots:
|
|
|
252
252
|
|
|
253
253
|
'@ai-ecoverse/slicc-capture@1.4.1': {}
|
|
254
254
|
|
|
255
|
-
'@ai-ecoverse/slicc-kernel@1.
|
|
255
|
+
'@ai-ecoverse/slicc-kernel@1.168.1': {}
|
|
256
256
|
|
|
257
257
|
'@ai-ecoverse/slicc-ortllama@1.28.0':
|
|
258
258
|
dependencies:
|