@ai-ecoverse/slicc-bios 1.6.0 → 1.7.1

package/README.md

@@ -81,7 +81,7 @@ The kernel runs with users on (slicc-kernel ≥ 1.81.0): files have owners and m
   - **Under `'report'`** nothing is protected, since protection has no report mode of its own. Installs already run as tagged writers from `/opt/slicc/base` with the clean config, and bios watches the six trees through the kernel (`fs.watch`, recursive). Each change made through the page's kernel outside bios's own installs goes to `denials.log` as `op: 'protect'`, `errno: 'EROFS'`: a write that `'enforce'` would refuse. The watch doesn't say which process wrote, so these lines have no user and no tag. Changes made outside the page's kernel (bios's install kernels, the page itself) aren't seen.
   - **Global packages** (`pnpm add -g` into `/usr/local/share/pnpm`) aren't protected and run untagged.
   - **A remembered mount** (`slicc-os.mounts`) at, under or above a protected path is dropped at boot under `'enforce'`, with a notice, *A remembered folder wasn’t mounted*.
-- **Sudo approvals:** the kernel's `approve` hook feeds `model.approvals`, spectrum's sudo dialog. It shows the resolved path and arguments, shell-quoted, the directory, the requester mapped from the tag, the target and *Always allow*. Every tab shows the request (`BroadcastChannel('slicc-approvals')`), and the first decision wins; the other tabs see *Answered in another tab*. *Always allow* is offered only for a command bios trusts to run the same way every time: the kernel's resolved path, whose real path and every directory above it are root's and not group- or other-writable (checked by a root `stat` when the request comes), that isn't a shell, interpreter or wrapper (`bash`, `python*`, `node`, `env`, `xargs`, `sudo`, `timeout`, `find -exec` and the like), doesn't write named files (`tee`, `cp`, `mv`, `chmod`, `dd`, `sed -i`, `tar -x`, `git`, `pnpm` and the like), whose operands are all absolute, inside none of `/tmp`, `/var/tmp`, `/home`, `/mnt`, `/scoops` and `/dev/shm`, and not user-writable (a file that isn't root's or is group- or other-writable, a directory above that is, or a missing path whose parent is), with no shell metacharacter in any argument, and which may not change the secret rules. Everything else gets *Allow once* only. A request that may change the secret rules never offers *Always allow* either. bios decides that at least as broadly as spectrum's dialog: it runs the dialog's own classifier (`os/rules.js`, a port of spectrum 1.62's until spectrum exports it), its own path check (`/etc/fnox`, `/etc/slicc/secrets-policy.toml`, and for a command that isn't read-only `/`, `/etc`, `/etc/slicc`, a name with `fnox` or `secrets-policy`, a glob or `..`), and treats any `$`, backtick, quote or backslash in an argument, and any quoting or `cd` inside a `-c` script, as a possible change. For such a request bios sends `always: false`, and answers an `always` for it, from any tab, as `once`, so no `NOPASSWD` line is written for it.
+- **Sudo approvals:** the kernel's `approve` hook feeds `model.approvals`, spectrum's sudo dialog. It shows the resolved path and arguments, shell-quoted, the directory, the requester mapped from the tag, the target and *Always allow*. Every tab shows the request (`BroadcastChannel('slicc-approvals')`), and the first decision wins; the other tabs see *Answered in another tab*. *Always allow* is offered only for a command bios trusts to run the same way every time: the kernel's resolved path, whose real path and every directory above it are root's and not group- or other-writable (checked by a root `stat` when the request comes), that isn't a shell, interpreter or wrapper (`bash`, `python*`, `node`, `env`, `xargs`, `sudo`, `timeout`, `find -exec` and the like), doesn't write named files (`tee`, `cp`, `mv`, `chmod`, `dd`, `sed -i`, `tar -x`, `git`, `pnpm` and the like), whose operands are all absolute, inside none of `/tmp`, `/var/tmp`, `/home`, `/mnt`, `/scoops` and `/dev/shm`, and not user-writable (a file that isn't root's or is group- or other-writable, a directory above that is, or a missing path whose parent is), with no shell metacharacter in any argument, and which may not change the secret rules. Everything else gets *Allow once* only. A request that may change the secret rules never offers *Always allow* either. bios decides that at least as broadly as spectrum's dialog: it runs the dialog's own classifier (spectrum's exported `secretRules`; without it every command counts as one that may change them), its own path check (`/etc/fnox`, `/etc/slicc/secrets-policy.toml`, and for a command that isn't read-only `/`, `/etc`, `/etc/slicc`, a name with `fnox` or `secrets-policy`, a glob or `..`), and treats any `$`, backtick, quote or backslash in an argument, and any quoting or `cd` inside a `-c` script, as a possible change. For such a request bios sends `always: false`, and answers an `always` for it, from any tab, as `once`, so no `NOPASSWD` line is written for it.
 - **Denials:** denials under `'report'` and `'enforce'` go to `/var/log/slicc/denials.log`, one JSON line per distinct `(uid, tag, op, path, errno)` with its `count`, `first` and last `time`, plus `user`, `tag` (the process's tag, `null` for an untagged one) and `mode`. They're written within a quarter of a second, at every 100 distinct denials, and when the page is hidden (`visibilitychange`). When the page goes away (`pagehide`), the ones not yet written are kept in `localStorage` (`slicc.denials.spool.*`), and the next page writes them once its kernel is up. The log rotates to `denials.log.1` at 1 MiB. `slicc-denials` (in `/usr/local/bin`) sums up the log and its `.1`: the total and time span, then counts by tag kind (`agent`, `user`, `untagged`), op, errno and path prefix; `--json` prints the same as one object.
 - **Not a boundary:** the kernel's loopback (`<port>.kernel.localhost`) isn't one between users (N2). A server any user starts is reachable by every process and by seven's pages.
 
@@ -168,7 +168,7 @@ The Files panel lists `/opt/grammars/node_modules` but doesn't scan it.
 
 #### Optional packages
 
-Below the system rows, Install / Update offers **Optional packages** (spectrum ≥ 1.42.0): tools that seven doesn't preinstall, each at the version the homescoop coordinator certified. The catalog is [`src/packages/optional/`](src/packages/optional/): `package.json` pins each package exactly, `package-lock.json` (made with `npm install --package-lock-only --ignore-scripts`, never installed) holds its integrity, and `catalog.json` gives its id, label, description, commands, tarball size and `requires`. A test keeps the three in step. Today it offers git, OpenSSH, Python, uv, Node.js (slicc-jsh's `node` and `jsh`), `sliccy:browser` for `.jsh` scripts, Ruby, Perl, esbuild, TypeScript, Biome, the PDF tools (poppler), qpdf, rsync, buf, screen, SQLite, dig, websocat and GnuPG.
+Below the system rows, Install / Update offers **Optional packages** (spectrum ≥ 1.42.0): tools that seven doesn't preinstall, each at the version the homescoop coordinator certified. The catalog is [`src/packages/optional/`](src/packages/optional/): `package.json` pins each package exactly, `package-lock.json` (made with `npm install --package-lock-only --ignore-scripts`, never installed) holds its integrity, and `catalog.json` gives its id, label, description, commands, tarball size and `requires`. A test keeps the three in step. Today it offers git, OpenSSH, Python, uv, Node.js (slicc-jsh's `node` and `jsh`), `sliccy:browser` for `.jsh` scripts, Ruby, Perl, esbuild, TypeScript, Biome, the PDF tools (poppler), qpdf, rsync, buf, screen, SQLite, dig, websocat, GnuPG and fnox.
 
 - **Install** runs `pnpm add -g <package>@<version>` in the page's kernel, as a user would, under the Web Lock `slicc-optional`, so the commands work at once in every open shell. pnpm 12 gives each global add its own project under `$PNPM_HOME/global/v11/`; bios reads `PNPM_HOME` from the kernel's environment. Afterwards `os/packages.js` reads that project's `pnpm-lock.yaml`: every package in it, the one added and each dependency, must be a version in the catalog's lockfile or the base set's, with that integrity. homescoop pins `@ai-ecoverse/*` dependencies exactly (uv → Python, git → bash), so the catalog's lockfile names them all. Anything else, a dependency pnpm resolved to another version included, removes the package again and fails the row with *This version doesn't match the tested build*. An entry's `requires` (uv needs Python) are installed first.
 - **State** comes from pnpm's global projects, not from a list of bios's own, so a package installed by hand shows as installed with its version. One older than the catalog's offers **Update**, which adds the catalog's version; one at or above it offers **Remove**. bios never downgrades.
@@ -219,11 +219,25 @@ Packages are served unbundled, exactly as npm publishes them, so `pnpm upgrade <
   - `exports` is read with the conditions `browser`, `import`, `module` and `default`, then the `browser` field (including its file mappings), `module` and `main`.
   - A relative import's `browser` file mapping comes from the nearest `package.json` up to the importer's package root (a package directory in a `node_modules`, or `/os`), never from above it and never from `/`. Any process can write `/package.json`, so it must not remap seven's own imports.
   - Extensionless relative imports get `.js`, `.mjs`, `.cjs`, `.json` or `/index.js`.
-- **Node built-ins** (`node:x` and the bare names) become `/__slicc/node/<x>.js`. That's a generated module exporting exactly the names the importer asks for: `crypto.randomUUID`, `getRandomValues`, `webcrypto` and `subtle` are real, and everything else throws when called (not when imported). `node:worker_threads` is a real module instead: its `Worker` starts a module Web Worker, posts `workerData` to it first, and forwards `message` and `error`; inside that worker, `workerData` and a `parentPort` with `postMessage` and `on('message')` work as in Node.
+- **Node built-ins** (`node:x` and the bare names) become `/__slicc/node/<x>.js`. That's a generated module exporting exactly the names the importer asks for: `url`'s `URL` and `URLSearchParams` are the page's own, and everything else throws when called (not when imported). `node:worker_threads` is a real module instead: its `Worker` starts a module Web Worker, posts `workerData` to it first, and forwards `message` and `error`; inside that worker, `workerData` and a `parentPort` with `postMessage` and `on('message')` work as in Node.
 - **CommonJS** (`src/sw/transform.js`): a script without module syntax that uses `require` or `exports` is wrapped as an ES module. Its `require()` calls become imports, `module.exports` is the default export, and `exports.x =` assignments become named exports. As in Node, the wrapped code also gets the free variables `process` and `global`. `global` is `globalThis`. `process` is the page's own `process` if there is one, and otherwise one shared minimal object (`platform: 'browser'`, `env: {}`, `argv: []`, `cwd()` returning `/`, and `nextTick`), so packages that read `process.platform` at load time (cross-spawn, which, isexe) load.
 - **TypeScript** (`src/sw/strip.js`): `.ts`, `.mts` and `.cts` files are served as `text/javascript` with their types blanked out. Annotations, `interface` and `type` declarations, `import type`, `export type` and type-only specifiers, generics, `as` and `satisfies`, non-null `!`, `declare`, access modifiers, `abstract`, optional `?` and `implements` become spaces, so every line and column stays where it was and no source map is needed. This is what Node's `--experimental-strip-types` does, and for every TypeScript file of the three pi extensions in the test matrix the output is the same as Node's. Syntax with no erasable form (`enum`, a `namespace` with values, parameter properties, `import x = require()`, `export =`, `<T>x` and decorators) makes the module throw a `SyntaxError` with the file, line and column. An import of `./x.js` finds `x.ts` when there is no `x.js` (and `.mjs` finds `.mts`, `.cjs` finds `.cts`), as with TypeScript's `nodenext` and `bundler` resolution. Extensionless imports don't look for `.ts`. A `.cts` file is wrapped as CommonJS after stripping.
 - **Caching:** rewritten scripts are cached per file until the file or `/pnpm-lock.yaml` changes, so an update is picked up without reinstalling the service worker.
 
+## Vault
+
+Seven keeps its secrets in the vault, a separate origin (`@ai-ecoverse/slicc-vault`, types only in `devDependencies`; its README's "The embedding API" is the spec). `src/seed/vault.js` brokers it:
+- **The origin** comes from `vaultOrigin()`: production seven (`https://seven.sliccy.ai`) always uses `https://vault.sliccy.ai` and refuses an override with a console error; every other seven uses `https://vault-preview.sliccy.ai`, or the origin in `localStorage['slicc-os.vault-origin']`, which the tests point at a fake vault.
+- **The core frame** is a hidden iframe at that origin. After each `load` (so again after the frame reloads) seven posts the page hello `{ type: 'slicc-vault', v: 1, op: 'hello', role: 'page', sudoGid }`, with the kernel's `sudo` gid from `kernel.groups.list()` (left out under users `off`; the owner tab keeps it in `localStorage['slicc-os.vault-sudo-gid']` for the other tabs), and talks to the vault over that page port only.
+- **`model.vault`** (spectrum's `VaultPort`) gives Settings › Secrets, the value requests and the composer's hold synchronous `status()` and `list()` snapshots (re-listed after every `changed`), `audit`, `availability()` (`connecting` until the welcome, `waiting` without one within 5 s or while an answer is 2 s late, then `locked` or `ready`), and the page ops `put` (with spectrum's `PutOptions` passed through), `cancel`, `remove`, `restore`, `import`, `export`, `lock` and `dismissBackupReminder`. Rejections are `Error`s with the vault's errno as `code`. Values go only through `put` (and `seal`), are never logged, stored or put into an error message, and never reach the agent worker.
+- **`button()`** is a plain iframe of `<vault origin>/button.html`, with no `sandbox`, so it can open the vault's popup. Every `button` message carries seven's current colour scheme as `theme`, and is sent again on the frame's `load` and whenever the scheme changes; spectrum (≥ 1.68.3) gives the iframe the same `color-scheme`, so Chrome doesn't paint it opaque.
+- **The agent's port:** for slicc-agent ≥ 4.0.0 only, each agent worker gets its own `agent`-role port, posted raw as `{ vault, scrub }` next to the agent's `{ kernel, admin }`, and again with a fresh port after the frame reloads. The agent port gets no events, so every lock change in the page port's `status` is posted to the worker as `{ locked: true | false }`. `scrub` is the last `{ needed, version, ready }` pair (`localStorage['slicc-os.vault-scrub']`, `null` before any vault connected); each new pair is posted to the worker as `{ scrub }` before seven relays the `put`, `seal` or `import` answer that caused it. Agents before 4.0.0 speak an earlier draft of that wire, so they get no port and stay inert.
+- **`/dev/sealed`:** the kernel's `sealed` hook relays each request with its kernel stamp (`caller`, unchanged) as the vault's `sealed` op, and returns its one reply. While kernel users aren't `enforce`, `materialize` and `materializeConsume` are refused with `EACCES`; under `enforce`, `materialize` is relayed like the rest, and the kernel's `materializeConsume` (`ticket`, `stamp`, `path`, `resolved`, `argv`, `cwd`, `interpreters`, `trusted`, unchanged) goes to the vault's page op of that name, whose `{ values, placeholders }` go back to the kernel only. jerk's requests (`src/seed/jerk.js`) are answered with `answer`: `jop: list` with rows from each linked device that runs jerk (J1 `list`), `jop: status` from the vault's records (exit 3 without one), `jop: create` through J1 `create` with its progress lines (exit 4 without a jerk device), `unseal` by removing the provider's `jerk:` records, and `oauth` and `jerk-seal` with exit 5 until seven signs in itself. A `cancelled` event stops a running J1 `create`.
+- **Forward (seam):** `forward` is passed through with the kernel's full stamp as `owner` (`users` included, since the vault injects only for `enforce`) and the response port transferred; the exit router's use of it is VAULT-1b's follow-up.
+- **fnox** (the optional catalog's `fnox`, wasi-fnox): every kernel process gets `FNOX_CONFIG_DIR=/etc/fnox`, sudo included, and bios writes `/etc/fnox/config.toml` once as root's `0644` (`default_provider = "seven"`, provider `seven` of type `sealed`), so cones read it and only `sudo` changes it. fnox keeps placeholders there and reaches the vault through `/dev/sealed`; while the vault frame never answered, every sealed operation fails at once with `ENOTCONN`. Use `fnox set` to change a secret (`fnox edit` is refused on WASI).
+- **Egress:** the vault's token refreshes arrive as `egress` events; seven sends them without following redirects (through its exits when the transport hands redirects back, else the page's own `fetch` with `redirect: 'manual'`), answers a redirect with an error, zeroes the request body once it's sent, and answers on the event's port within 30 s, never logging the request.
+- **Adobe IMS:** with agent ≥ 4.0.0, `login('adobe', …)` opens its popup before anything else, then seals the token as `{ kind: 'model', provider: 'adobe', name: 'ADOBE_IMS_TOKEN', source: 'oauth:adobe', expiresAt }` and resolves `{ sealed: true }`, so the token never reaches spectrum or the agent. IMS gives no refresh token: an expired token means signing in again, which replaces the record and keeps its placeholder. Agents before 4.0.0 get the token as before.
+
 ## Network
 
 Before the kernel starts, `os/transport.js` picks how programs reach the network. The first of these that applies wins:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.6.0",
+  "version": "1.7.1",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",
@@ -43,9 +43,11 @@
   },
   "devDependencies": {
     "@ai-ecoverse/slicc": "1.42.0",
-    "@ai-ecoverse/slicc-browsers": "1.7.4",
+    "@ai-ecoverse/slicc-browsers": "1.7.5",
     "@ai-ecoverse/slicc-node": "2.5.1",
     "@ai-ecoverse/slicc-shared-web": "1.20.0",
+    "@ai-ecoverse/slicc-spectrum": "1.77.0",
+    "@ai-ecoverse/slicc-vault": "1.9.1",
     "@biomejs/biome": "2.5.15",
     "es-module-lexer": "3.0.3",
     "fake-indexeddb": "6.2.5",

package/src/packages/agent/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "description": "SLICC's agent, which the UI installs with pnpm in the background into /opt/agent in OPFS",
   "dependencies": {
-    "@ai-ecoverse/slicc-agent": "3.50.2",
-    "@ai-ecoverse/slicc-kernel": "1.102.5"
+    "@ai-ecoverse/slicc-agent": "5.0.3",
+    "@ai-ecoverse/slicc-kernel": "1.110.1"
   }
 }

package/src/packages/agent/pnpm-lock.yaml

@@ -6,37 +6,40 @@ settings:
 
 overrides:
   '@google/genai': '-'
-  esbuild: '-'
 
 importers:
 
   .:
     dependencies:
       '@ai-ecoverse/slicc-agent':
-        specifier: 3.50.2
-        version: 3.50.2(@ai-ecoverse/slicc-kernel@1.102.5)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
+        specifier: 5.0.3
+        version: 5.0.3(@ai-ecoverse/slicc-kernel@1.110.1)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
       '@ai-ecoverse/slicc-kernel':
-        specifier: 1.102.5
-        version: 1.102.5
+        specifier: 1.110.1
+        version: 1.110.1
 
 packages:
 
-  '@ai-ecoverse/slicc-agent@3.50.2':
-    resolution: {integrity: sha512-8WcNCTemX9W7QOTrt3yqUBqieF7eCm04hxdW4J8+PJ6IZpN9vBIeoOZvKS+sdl/Z3qTiITTxXUW53w+kbrX0TQ==}
+  '@ai-ecoverse/slicc-agent@5.0.3':
+    resolution: {integrity: sha512-5mQ7TbLZCfdRaS4YFJXamjLCyzD9DxsWAImD2EU4sl85VNhgeXe6axRiOBkY45tpeKHBWG/MQUV5Mi75llUJMg==}
     engines: {node: '>=24'}
     peerDependencies:
-      '@ai-ecoverse/slicc-kernel': '>=1.47.1 <2'
-      '@ai-ecoverse/slicc-spectrum': ^1.39.0
+      '@ai-ecoverse/slicc-kernel': '>=1.90.0 <2'
+      '@ai-ecoverse/slicc-spectrum': ^1.75.0
     peerDependenciesMeta:
       '@ai-ecoverse/slicc-spectrum':
         optional: true
 
-  '@ai-ecoverse/slicc-browsers@1.5.0':
-    resolution: {integrity: sha512-H+K/cAMqVCPHKycoM68ZW/jDaOBcmqbMR4mVeBKP/L2Tb5U4dX15vcJ/EmFyBvA2XwYDM40KToJSWMUgK/Q/dg==}
+  '@ai-ecoverse/slicc-browsers@1.7.1':
+    resolution: {integrity: sha512-35vGFMbZrl33ZQ9/VgjwZDBXp0RP87mKY0hnIG31tW5Nt5hh+icdp+3Y/t1kypoENAre+jnVEDa9W/H+yK6zyA==}
     engines: {node: '>=24'}
 
-  '@ai-ecoverse/slicc-kernel@1.102.5':
-    resolution: {integrity: sha512-p4ya+WnAUor3eo4hX9ZRDLCfgFn3RYac4Oas1UOO+Efnv2ecGKMCdGfPlGPCoIlrs6ab8FJl8YG1xGtGNem9JQ==}
+  '@ai-ecoverse/slicc-kernel@1.110.1':
+    resolution: {integrity: sha512-9Qh5eitnzfi61tX4mLnCmGyJAMirdYgUN+FSLQvwGoOGY0XydTgJUJ+96jk2gtqmH3c1iyUHYYf2g0a9KUdJ9g==}
+    engines: {node: '>=24'}
+
+  '@ai-ecoverse/slicc-vault@1.9.1':
+    resolution: {integrity: sha512-Ot5MFg0e+lrs4gH0TSMciKrrs299nQ4Fnr75oc6ZjcDAi7zbUUx/0lMUTthCpHxKI9HllLCGtxV6CTrHKT15mw==}
     engines: {node: '>=24'}
 
   '@anthropic-ai/sdk@0.129.0':
@@ -132,42 +135,33 @@ packages:
     resolution: {integrity: sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==}
     engines: {node: '>=6.9.0'}
 
-  '@earendil-works/chord@1.0.4':
-    resolution: {integrity: sha512-d2JZw2utoa/reoSmL07O71wsXiMDhIlnnxTb4LCNV+Oq8Evj2rGLvjVuYrlXZGbXUr0IDNfvd1RT/utCY1UhkQ==}
+  '@earendil-works/chord@1.2.0':
+    resolution: {integrity: sha512-Xh3M5B4D9YotOyBXyVbZ/5WfoUwP6Kt+TheCIDLxLCUx72UExuxZF//hNmIQGD13EkAHf2svKpXr/rCCT1gXTg==}
     engines: {node: '>=22.19.0'}
 
-  '@earendil-works/pi-ai@1.0.4':
-    resolution: {integrity: sha512-/Eu5R0gfor6wcmRcVyOmulUiZmsHJ0bKu5wXXnpCoSHF3y4FnW4fgnjRlLjNza8NJWXdvW5Uew90Zukx7Sh2rw==}
+  '@earendil-works/pi-ai@1.2.0':
+    resolution: {integrity: sha512-U5/1zXqfV1on7/9sbez03tT4Ru49Lvfb4+zXSDK3DBKF5cRk6KxvAOTOY3HJ4jimlZth+rs7vbJqN6iBQAoNuQ==}
     engines: {node: '>=22.19.0'}
     hasBin: true
 
-  '@earendil-works/pi-client@1.0.4':
-    resolution: {integrity: sha512-c+hB+VE+K+2990do99wk4m+R7RvRt7A/Wb9JOHWM3c+vCFqZqo8VdU65a+P/hUZp2cVhoxFnzFZsDf9yqaGvUA==}
-    engines: {node: '>=22.19.0'}
-
-  '@earendil-works/pi-codemode@1.1.0':
-    resolution: {integrity: sha512-8Asc2AzhoNaXS1snmRFa96OhcWIlFM5k1Kuiz6p2DvIYgi5QHQccRAmDVY9oO92TzWrizpvQpconZGQ7JhlI7Q==}
-    engines: {node: '>=22.19.0'}
-
-  '@earendil-works/pi-durable@1.0.4':
-    resolution: {integrity: sha512-i22unyhavxrTF/KS/JcBOKprQRgepufOIztnqBKZXJCWbEHsXDzcINtjmmBSbFB/3S+4FWIl3eJ5FMbRe33Ybg==}
+  '@earendil-works/pi-codemode@1.2.0':
+    resolution: {integrity: sha512-UZF7IN0IIrf3bop2wTxrwoAakGctH6d3zdPwhPN+QHMECfoI5E6B6l6I17YGFZPj8cmGex6xX7mLCNJXRf7wsw==}
     engines: {node: '>=22.19.0'}
 
-  '@earendil-works/pi-mcp@1.1.0':
-    resolution: {integrity: sha512-xGKwvu3SvVTeoIx8Z7UGoJprB4VK20wKORMhufcWGx61fIauhu3J+UqfB5eeoF1oE/geYBA598K6nh1SdABQkg==}
+  '@earendil-works/pi-durable@1.2.0':
+    resolution: {integrity: sha512-2kDyK7HVCTcxf3CTHkDR0rRGCUfIpoZr76fC6n/KZDu7hkDWR62anEujIkJ+8sKjtNpEM+zyKW3bi2NIEUyiCw==}
     engines: {node: '>=22.19.0'}
 
-  '@earendil-works/pi-protocol@1.0.4':
-    resolution: {integrity: sha512-GJ1ieSJdguV3VaO5fXD+LEm6w1Rx0HKk7P1g8I6ZelmiGpmQAYOneUZaCUhAz5BeC6FpyUFzBb+AOo0Npfxtvw==}
+  '@earendil-works/pi-mcp@1.2.0':
+    resolution: {integrity: sha512-ertUv40rUBgssTzw2lIPlejjIBdhvdg4uw+whWCDJYKYHU+ldp1ezhbB0BzwpBfnwef6/YN+m6eKLscj+r3p7w==}
     engines: {node: '>=22.19.0'}
 
-  '@earendil-works/pi-server@1.0.4':
-    resolution: {integrity: sha512-9kQipVdjVMhprBzw/plrimPPDETNfFD7E2N8n1LBoLS7rcX+5js2hmUBJZPddmFnxNQgFeAgTgFH8bsCiWmlqw==}
+  '@earendil-works/pi-telemetry@1.3.0':
+    resolution: {integrity: sha512-ERGZr+aXjNJzoUbB7ZzHVH3g5otzMHjHLs2Fyizm12By5X+gBEhod9cJXFOk13S7M8a29Am+Mq21zm73mRJFLg==}
     engines: {node: '>=22.19.0'}
 
-  '@earendil-works/pi-telemetry@1.0.4':
-    resolution: {integrity: sha512-DL2eXXtnL5/VQkuQd97fL57GXTG1/zKHtMmDsrv8tGeJ5EgYYTWvzy44dqbYL0lD0Z22v/NOwqU3PHO75HVrqA==}
-    engines: {node: '>=22.19.0'}
+  '@silvia-odwyer/photon@0.3.3':
+    resolution: {integrity: sha512-8BhUjEch4slwRe8uXnaA4vcA5uiiOTT90UMsxulOj2gN98X1p0q9Z4Ysk4DkD05uNgbR9XoSqtZ37w+33w4QKQ==}
 
   '@smithy/core@3.35.1':
     resolution: {integrity: sha512-i4YPS4B6ts7bjn7UwLnGjiZdprOvHvgGobFZsYK3GIY3E5hIqtj0rReU69BcTpGp+fvtraSNXeG1l+jtJvF55w==}
@@ -308,6 +302,9 @@ packages:
   typebox@1.3.27:
     resolution: {integrity: sha512-zu+jc1pcy4UiNThxikUr36f0Rybk9PEeCg/NE6adeWr/SKsdNO4EzZHYRDlv2YCVAfj3Odq3dESSo/jNyoBXzA==}
 
+  typebox@1.3.36:
+    resolution: {integrity: sha512-bu2Ec2Ti9B4IFSFj1FcZbtLNB/W7igQwxocMGJLAG2NTv1nI+ImtIA34YgHW4CVyGVlJqNXR1GJyLmdWgV3DuA==}
+
   which@2.0.2:
     resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
     engines: {node: '>= 8'}
@@ -327,19 +324,18 @@ packages:
 
 snapshots:
 
-  '@ai-ecoverse/slicc-agent@3.50.2(@ai-ecoverse/slicc-kernel@1.102.5)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
-    dependencies:
-      '@ai-ecoverse/slicc-browsers': 1.5.0
-      '@ai-ecoverse/slicc-kernel': 1.102.5
-      '@earendil-works/chord': 1.0.4
-      '@earendil-works/pi-ai': 1.0.4(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
-      '@earendil-works/pi-client': 1.0.4
-      '@earendil-works/pi-codemode': 1.1.0
-      '@earendil-works/pi-durable': 1.0.4(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
-      '@earendil-works/pi-mcp': 1.1.0
-      '@earendil-works/pi-protocol': 1.0.4
-      '@earendil-works/pi-server': 1.0.4
+  '@ai-ecoverse/slicc-agent@5.0.3(@ai-ecoverse/slicc-kernel@1.110.1)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
+    dependencies:
+      '@ai-ecoverse/slicc-browsers': 1.7.1
+      '@ai-ecoverse/slicc-kernel': 1.110.1
+      '@ai-ecoverse/slicc-vault': 1.9.1
+      '@earendil-works/chord': 1.2.0
+      '@earendil-works/pi-ai': 1.2.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
+      '@earendil-works/pi-codemode': 1.2.0
+      '@earendil-works/pi-durable': 1.2.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
+      '@earendil-works/pi-mcp': 1.2.0
       '@sqlite.org/sqlite-wasm': 3.53.4-build2
+      typebox: 1.3.36
     transitivePeerDependencies:
       - '@aws-sdk/credential-provider-node'
       - '@smithy/hash-node'
@@ -350,9 +346,11 @@ snapshots:
       - ws
       - zod
 
-  '@ai-ecoverse/slicc-browsers@1.5.0': {}
+  '@ai-ecoverse/slicc-browsers@1.7.1': {}
+
+  '@ai-ecoverse/slicc-kernel@1.110.1': {}
 
-  '@ai-ecoverse/slicc-kernel@1.102.5': {}
+  '@ai-ecoverse/slicc-vault@1.9.1': {}
 
   '@anthropic-ai/sdk@0.129.0':
     dependencies:
@@ -543,13 +541,15 @@ snapshots:
 
   '@babel/runtime@7.29.7': {}
 
-  '@earendil-works/chord@1.0.4': {}
+  '@earendil-works/chord@1.2.0':
+    dependencies:
+      typebox: 1.3.27
 
-  '@earendil-works/pi-ai@1.0.4(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
+  '@earendil-works/pi-ai@1.2.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
     dependencies:
       '@anthropic-ai/sdk': 0.129.0
       '@aws-sdk/client-bedrock-runtime': 3.1127.0
-      '@earendil-works/pi-telemetry': 1.0.4
+      '@earendil-works/pi-telemetry': 1.3.0
       '@smithy/node-http-handler': 4.12.1
       http-proxy-agent: 9.1.0
       https-proxy-agent: 9.1.0
@@ -566,19 +566,16 @@ snapshots:
       - ws
       - zod
 
-  '@earendil-works/pi-client@1.0.4':
-    dependencies:
-      '@earendil-works/chord': 1.0.4
-      '@earendil-works/pi-protocol': 1.0.4
-
-  '@earendil-works/pi-codemode@1.1.0':
+  '@earendil-works/pi-codemode@1.2.0':
     dependencies:
       quickjs-wasi: 3.6.2
 
-  '@earendil-works/pi-durable@1.0.4(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
+  '@earendil-works/pi-durable@1.2.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
     dependencies:
-      '@earendil-works/chord': 1.0.4
-      '@earendil-works/pi-ai': 1.0.4(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
+      '@earendil-works/chord': 1.2.0
+      '@earendil-works/pi-ai': 1.2.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
+      '@earendil-works/pi-codemode': 1.2.0
+      '@silvia-odwyer/photon': 0.3.3
       diff: 8.0.4
       typebox: 1.3.27
     transitivePeerDependencies:
@@ -591,21 +588,13 @@ snapshots:
       - ws
       - zod
 
-  '@earendil-works/pi-mcp@1.1.0':
+  '@earendil-works/pi-mcp@1.2.0':
     dependencies:
       cross-spawn: 7.0.6
 
-  '@earendil-works/pi-protocol@1.0.4':
-    dependencies:
-      '@earendil-works/chord': 1.0.4
-      typebox: 1.3.27
-
-  '@earendil-works/pi-server@1.0.4':
-    dependencies:
-      '@earendil-works/chord': 1.0.4
-      '@earendil-works/pi-protocol': 1.0.4
+  '@earendil-works/pi-telemetry@1.3.0': {}
 
-  '@earendil-works/pi-telemetry@1.0.4': {}
+  '@silvia-odwyer/photon@0.3.3': {}
 
   '@smithy/core@3.35.1':
     dependencies:
@@ -720,6 +709,8 @@ snapshots:
 
   typebox@1.3.27: {}
 
+  typebox@1.3.36: {}
+
   which@2.0.2:
     dependencies:
       isexe: 2.0.0

package/src/packages/certs.json

@@ -275,6 +275,14 @@
     "integrity": "sha512-p4ya+WnAUor3eo4hX9ZRDLCfgFn3RYac4Oas1UOO+Efnv2ecGKMCdGfPlGPCoIlrs6ab8FJl8YG1xGtGNem9JQ==",
     "sha256": "162a062bdcf2dcf48b3d55197eeac073d23e5c327f5a066a2ba9318d005b22d0"
   },
+  "@ai-ecoverse/slicc-kernel@1.108.4": {
+    "integrity": "sha512-A2HSJmRtwAhE5IkwNberHY32q7kvrw84b62rsi4BKMplVTS7GWjYgyb7Twda4qlQMGyM1FwEQhavrwWDs2qGbA==",
+    "sha256": "607621abcb47cefb161d72fda99b94bc05fca4a73664203deb8025b85e91cce1"
+  },
+  "@ai-ecoverse/slicc-kernel@1.110.1": {
+    "integrity": "sha512-9Qh5eitnzfi61tX4mLnCmGyJAMirdYgUN+FSLQvwGoOGY0XydTgJUJ+96jk2gtqmH3c1iyUHYYf2g0a9KUdJ9g==",
+    "sha256": "f59beab296b367cf84c28d0343d656b12fe9d3ebdc5045d0106376bd904c3f68"
+  },
   "@ai-ecoverse/wasi-biome@2.5.15-2": {
     "integrity": "sha512-5oIfngw8Ln2/ddCJ0wtqMoSnW+UO2zuih0+x1CNDbwKkB18TxuWoI60QFQySjd69N6eP+blL/stz/AZyoYpeuw==",
     "sha256": "25599e4317ec2e7ca9a447ff99ac01f271358cd06bd2d727e6b28b10c05bf44a"
@@ -291,6 +299,10 @@
     "integrity": "sha512-xpi0li0G2wD3ezIlHGcfDJ8Pd1/pT9w+dNU5U3vrx8XlkIAEnpjJRpPU/+sIDeBy81EauPd9H0M3ke33wZD53g==",
     "sha256": "ea735648aff0c8620b62462bcbe9023d10c7306bbb41930e140977a2aa530964"
   },
+  "@ai-ecoverse/wasi-fnox@1.39.0-2": {
+    "integrity": "sha512-puU9FN7kXKnlxaClZyqGd/m/229HHmVOA50+YExQBxzb1IrwPz/yS0Q1KDw0GnzC/glVLqu6jkSyc05LK1Fzyg==",
+    "sha256": "3b6607de060ea30756807aa936774842b3bded9f463025c4d10732a8b474b175"
+  },
   "@ai-ecoverse/wasi-esbuild@0.28.2-2": {
     "integrity": "sha512-Z6LXuBY2G9Po4cbEUFhbASSQ0ab5tdSHqtt1qDxNCgJFquAk525swjbTRVsj/j0v2iJVlq3Um1r2eYiYkGyLrQ==",
     "sha256": "9d9ed5820c8b5e8cb1924d4f2756e8a9a59f82ed344508ff1704b213bc1199ca"

package/src/packages/optional/catalog.json

@@ -157,6 +157,13 @@
     "commands": ["websocat"],
     "size": 1266828
   },
+  "@ai-ecoverse/wasi-fnox": {
+    "id": "fnox",
+    "label": "fnox",
+    "description": "Secrets by name: fnox keeps placeholders and seven's vault keeps the values. Pipe a value into fnox set NAME to add or change one; fnox exec hands a program the values the secret rules allow.",
+    "commands": ["fnox"],
+    "size": 2154238
+  },
   "@ai-ecoverse/wasix-gnupg": {
     "id": "gpg",
     "label": "GnuPG",

package/src/packages/optional/package-lock.json

@@ -12,6 +12,7 @@
         "@ai-ecoverse/wasi-buf": "1.73.0-2",
         "@ai-ecoverse/wasi-dig": "0.1.0-2",
         "@ai-ecoverse/wasi-esbuild": "0.28.2-2",
+        "@ai-ecoverse/wasi-fnox": "1.39.0-2",
         "@ai-ecoverse/wasi-gh": "2.102.0-1",
         "@ai-ecoverse/wasi-typescript": "7.0.2-1",
         "@ai-ecoverse/wasix-gnupg": "2.4.9-5",
@@ -97,6 +98,15 @@
         "slicc-kernel": ">=1.30.0"
       }
     },
+    "node_modules/@ai-ecoverse/wasi-fnox": {
+      "version": "1.39.0-2",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasi-fnox/-/wasi-fnox-1.39.0-2.tgz",
+      "integrity": "sha512-puU9FN7kXKnlxaClZyqGd/m/229HHmVOA50+YExQBxzb1IrwPz/yS0Q1KDw0GnzC/glVLqu6jkSyc05LK1Fzyg==",
+      "license": "MIT",
+      "engines": {
+        "slicc-kernel": ">=1.83.0"
+      }
+    },
     "node_modules/@ai-ecoverse/wasi-gh": {
       "version": "2.102.0-1",
       "resolved": "https://registry.npmjs.org/@ai-ecoverse/wasi-gh/-/wasi-gh-2.102.0-1.tgz",

package/src/packages/optional/package.json

@@ -9,6 +9,7 @@
     "@ai-ecoverse/wasi-buf": "1.73.0-2",
     "@ai-ecoverse/wasi-dig": "0.1.0-2",
     "@ai-ecoverse/wasi-esbuild": "0.28.2-2",
+    "@ai-ecoverse/wasi-fnox": "1.39.0-2",
     "@ai-ecoverse/wasi-gh": "2.102.0-1",
     "@ai-ecoverse/wasi-typescript": "7.0.2-1",
     "@ai-ecoverse/wasix-gnupg": "2.4.9-5",

package/src/packages/package-lock.json

@@ -6,11 +6,11 @@
     "": {
       "name": "slicc-bios-packages",
       "dependencies": {
-        "@ai-ecoverse/slicc-browsers": "1.7.4",
+        "@ai-ecoverse/slicc-browsers": "1.7.5",
         "@ai-ecoverse/slicc-cdp": "1.25.1",
         "@ai-ecoverse/slicc-clipboard": "1.0.2",
-        "@ai-ecoverse/slicc-kernel": "1.102.5",
-        "@ai-ecoverse/slicc-spectrum": "1.68.0",
+        "@ai-ecoverse/slicc-kernel": "1.110.1",
+        "@ai-ecoverse/slicc-spectrum": "1.77.0",
         "@ai-ecoverse/wasi-pnpm": "12.9.1-8",
         "@ai-ecoverse/wasi-ripgrep": "15.2.0-3",
         "@ai-ecoverse/wasm-bash": "5.3.0-18",
@@ -37,9 +37,9 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-browsers": {
-      "version": "1.7.4",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-browsers/-/slicc-browsers-1.7.4.tgz",
-      "integrity": "sha512-u4RqQ2kI8R/5r0+ARHeuEBlIc262PTz3GDTpmQoriNcSKaNujDjfN6KvWeO/F5Hr9L7g9xlh/OnQQsMr0PD82w==",
+      "version": "1.7.5",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-browsers/-/slicc-browsers-1.7.5.tgz",
+      "integrity": "sha512-98ZdWV86qyEJhV5U6gvd5VaZkvgL4TUjj13FXa8fdO12nTLVagXhGOI4K21jVP4HB1me/KpwQojUf6dB++6+ww==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=24"
@@ -68,18 +68,18 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-kernel": {
-      "version": "1.102.5",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-kernel/-/slicc-kernel-1.102.5.tgz",
-      "integrity": "sha512-p4ya+WnAUor3eo4hX9ZRDLCfgFn3RYac4Oas1UOO+Efnv2ecGKMCdGfPlGPCoIlrs6ab8FJl8YG1xGtGNem9JQ==",
+      "version": "1.110.1",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-kernel/-/slicc-kernel-1.110.1.tgz",
+      "integrity": "sha512-9Qh5eitnzfi61tX4mLnCmGyJAMirdYgUN+FSLQvwGoOGY0XydTgJUJ+96jk2gtqmH3c1iyUHYYf2g0a9KUdJ9g==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=24"
       }
     },
     "node_modules/@ai-ecoverse/slicc-spectrum": {
-      "version": "1.68.0",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-spectrum/-/slicc-spectrum-1.68.0.tgz",
-      "integrity": "sha512-X4YdicEzvSvoaFC1zcVNXkQroENlXxqXe9ipF6YxW3G1F1L4+q5oDUfX7zUx4kD1ecpvtacH/k3szc6DS9HKdg==",
+      "version": "1.77.0",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-spectrum/-/slicc-spectrum-1.77.0.tgz",
+      "integrity": "sha512-2IDp53NpmNoqKqdIgtv3H+wEAEYCp3Z4GeNp0DFnzqx/PUiC9crEdKt9ce3a3NHNJKtcPeDGwr1lu7GLRfEWPg==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=24"

package/src/packages/package.json

@@ -3,11 +3,11 @@
   "private": true,
   "description": "Packages the BIOS installs from npm into OPFS, pinned by package-lock.json and pnpm-lock.yaml",
   "dependencies": {
-    "@ai-ecoverse/slicc-browsers": "1.7.4",
+    "@ai-ecoverse/slicc-browsers": "1.7.5",
     "@ai-ecoverse/slicc-cdp": "1.25.1",
     "@ai-ecoverse/slicc-clipboard": "1.0.2",
-    "@ai-ecoverse/slicc-kernel": "1.102.5",
-    "@ai-ecoverse/slicc-spectrum": "1.68.0",
+    "@ai-ecoverse/slicc-kernel": "1.110.1",
+    "@ai-ecoverse/slicc-spectrum": "1.77.0",
     "@ai-ecoverse/wasi-pnpm": "12.9.1-8",
     "@ai-ecoverse/wasi-ripgrep": "15.2.0-3",
     "@ai-ecoverse/wasm-bash": "5.3.0-18",

package/src/packages/pnpm-lock.yaml

@@ -9,8 +9,8 @@ importers:
   .:
     dependencies:
       '@ai-ecoverse/slicc-browsers':
-        specifier: 1.7.4
-        version: 1.7.4
+        specifier: 1.7.5
+        version: 1.7.5
       '@ai-ecoverse/slicc-cdp':
         specifier: 1.25.1
         version: 1.25.1
@@ -18,11 +18,11 @@ importers:
         specifier: 1.0.2
         version: 1.0.2
       '@ai-ecoverse/slicc-kernel':
-        specifier: 1.102.5
-        version: 1.102.5
+        specifier: 1.110.1
+        version: 1.110.1
       '@ai-ecoverse/slicc-spectrum':
-        specifier: 1.68.0
-        version: 1.68.0
+        specifier: 1.77.0
+        version: 1.77.0
       '@ai-ecoverse/wasi-pnpm':
         specifier: 12.9.1-8
         version: 12.9.1-8
@@ -95,8 +95,8 @@ importers:
 
 packages:
 
-  '@ai-ecoverse/slicc-browsers@1.7.4':
-    resolution: {integrity: sha512-u4RqQ2kI8R/5r0+ARHeuEBlIc262PTz3GDTpmQoriNcSKaNujDjfN6KvWeO/F5Hr9L7g9xlh/OnQQsMr0PD82w==}
+  '@ai-ecoverse/slicc-browsers@1.7.5':
+    resolution: {integrity: sha512-98ZdWV86qyEJhV5U6gvd5VaZkvgL4TUjj13FXa8fdO12nTLVagXhGOI4K21jVP4HB1me/KpwQojUf6dB++6+ww==}
     engines: {node: '>=24'}
 
   '@ai-ecoverse/slicc-cdp@1.25.1':
@@ -107,12 +107,12 @@ packages:
     resolution: {integrity: sha512-p7b1h85qkiU0LKjNLCLiU7GVXjGigkyR2+VUCInM1cZo2yjLFxr7tGAOO09e6OG9nB7XKiQn3W88wb3s0gxy+g==}
     engines: {node: '>=24', slicc-kernel: '>=1.75.0'}
 
-  '@ai-ecoverse/slicc-kernel@1.102.5':
-    resolution: {integrity: sha512-p4ya+WnAUor3eo4hX9ZRDLCfgFn3RYac4Oas1UOO+Efnv2ecGKMCdGfPlGPCoIlrs6ab8FJl8YG1xGtGNem9JQ==}
+  '@ai-ecoverse/slicc-kernel@1.110.1':
+    resolution: {integrity: sha512-9Qh5eitnzfi61tX4mLnCmGyJAMirdYgUN+FSLQvwGoOGY0XydTgJUJ+96jk2gtqmH3c1iyUHYYf2g0a9KUdJ9g==}
     engines: {node: '>=24'}
 
-  '@ai-ecoverse/slicc-spectrum@1.68.0':
-    resolution: {integrity: sha512-X4YdicEzvSvoaFC1zcVNXkQroENlXxqXe9ipF6YxW3G1F1L4+q5oDUfX7zUx4kD1ecpvtacH/k3szc6DS9HKdg==}
+  '@ai-ecoverse/slicc-spectrum@1.77.0':
+    resolution: {integrity: sha512-2IDp53NpmNoqKqdIgtv3H+wEAEYCp3Z4GeNp0DFnzqx/PUiC9crEdKt9ce3a3NHNJKtcPeDGwr1lu7GLRfEWPg==}
     engines: {node: '>=24'}
     peerDependencies:
       '@shikijs/langs': 4.5.0
@@ -199,15 +199,15 @@ packages:
 
 snapshots:
 
-  '@ai-ecoverse/slicc-browsers@1.7.4': {}
+  '@ai-ecoverse/slicc-browsers@1.7.5': {}
 
   '@ai-ecoverse/slicc-cdp@1.25.1': {}
 
   '@ai-ecoverse/slicc-clipboard@1.0.2': {}
 
-  '@ai-ecoverse/slicc-kernel@1.102.5': {}
+  '@ai-ecoverse/slicc-kernel@1.110.1': {}
 
-  '@ai-ecoverse/slicc-spectrum@1.68.0': {}
+  '@ai-ecoverse/slicc-spectrum@1.77.0': {}
 
   '@ai-ecoverse/wasi-pnpm@12.9.1-8': {}