@ai-ecoverse/slicc-spectrum 1.99.3 → 1.101.0

package/README.md

@@ -356,6 +356,7 @@ They're also kept in `sessionStorage` (`slicc-spectrum.starting`, so per origin
 Only a reload of the same tab brings them back (the navigation's type is `reload`); any other load, such as a duplicated tab that got a copy of the storage, clears them, so nothing is sent twice.
 After a reload the rows come back in order with their text; attachments can't be restored, so a row that had any isn't sent on its own.
 A row with text and lost files is held (`[data-held]`): it shows an alert icon instead of the clock, a second, muted line "Not sent: tides.csv wasn’t kept after reload." (or "Not sent: 2 files weren’t kept after reload.", `[data-lost]`), **Put back** (`data-action="restore-starting"`), which puts its text into the field (after any draft, on a new line), focuses it and drops the row so the files can be attached again, and **Dismiss**.
+After **Put back**, a muted line under the field with a paperclip icon (`[data-reattach]`) names what to attach: "Attach tides.csv again.", "Attach tides.csv and notes.txt again." and, with more than three, "Attach these 4 files again: …"; it's a quiet button (`data-action="reattach"`) that opens the file picker. It follows the listed files by name: attaching tides.csv leaves "Attach notes.txt again.", other files don't change it, and removing a listed file brings it back; it hides while all of them are attached, and goes once the field is cleared or the message is sent. The list is kept with each agent's draft, and a file is listed once.
 A row that had only attachments shows the alert icon, its file names and "Not kept after reload", and reads "Not sent. Attach the files again." (`[data-unsent]`) with **Dismiss**.
 Neither kind is sent on arrival or holds the other rows back, which still go in order; they stay until they're put back or dismissed.
 Text typed but not sent while it starts is kept for the page the same way, and stays in the field once the agent arrives.
@@ -418,6 +419,7 @@ The Browser rail button carries a dot (`data-driven`) while a tab is in use.
 #### `<slicc-settings>`
 
 Theme, the model and thinking level for new cones, composer and diff preferences (push to talk only where the browser has speech recognition), and accounts to connect, reconnect or disconnect.
+When the `updates` port has `setDeveloper`, an Updates row has the **Developer mode** switch (`sp-switch[data-setting=developer]`, `checked` from `developer()` on every `items`), described as "Check npm for newer releases that aren't certified yet, and offer them as betas in Install / Update."; while `setDeveloper(on)` is pending it is disabled with `aria-busy` and a progress circle, and a rejection shows its message under it (`[data-error]`).
 An account whose status is `signing-in` (or a non-API-key account while its `connect` is pending) reads “Signing in…”; when the port has `cancel(id)`, its row offers Cancel (`data-action="cancel-sign-in"`), and the rejected `connect` that follows shows no error.
 Accounts with `group: 'mcp'` (MCP servers) get their own **MCP servers** heading (`.accounts[data-group=mcp]`).
 An `api-key` account asks for its `secret`: “{provider} API key” by default, “{provider} token” for `secret: 'token'`; when it is `expired` it reads **API key rejected** or **Token rejected**.
@@ -472,11 +474,18 @@ It closes, clearing the field, when the request leaves `waiting` or while the va
 #### `<slicc-updates>`
 
 Install / Update: component states, version changes, last checks, download and link counts, action buttons, failures with Retry, and collapsible install logs behind a quiet chevron, which stay open across a layout switch.
+A row with a pending version change (`from → to`, or a package's `version → offered`) and release notes shows a What’s new disclosure after the row's actions (in package rows, after the command chips), next to the Install log, `details[data-releases]` with `summary[data-action="whats-new"]`, which stays open across a layout switch like the log. It lists every release after the installed version up to the new one, newest first, each as `.release[data-version]` with its version linking to the release page (`a[data-action="release-notes"]`, named "Kernel 1.13.0 release notes") and its notes rendered as markdown in strict mode (`markdown(text, { strict: true })`: raw HTML tags are dropped and their text kept as plain text, only `https:` links stay links, and an image becomes a link with its alt text, so nothing loads; the notes' headings sit one level under the release's, through `level`). Notes over 8 KB (8,192 characters) per release are cut at the last line break before that, with "…" and a Read the full notes link (`[data-cut]`, named "Read the full notes for Kernel 1.13.0"); a release whose `url` isn't `https:` shows its version as plain text. The `<!-- cert-verify -->` block is dropped, and a block that starts with "certified" shows as a subtle Certified badge (`[data-certified]`); a heading line naming the version is dropped too, since the link already shows it. Without notes in the range there is no disclosure.
+An up-to-date row (no pending change) links its installed release with Release notes next to the version; an installed optional package without one links its npm page instead (`a[data-action="npm-page"]`, named "npm page for Biome 2.2.4"). Pins and additions in Your packages show no link. Every link opens in a new tab.
 An install shows one bar for update rows and package rows alike: it fills 0–50% while downloading and 50–100% while linking (`value` against `max-value="100"`). While the row runs it never goes back, not when pnpm's total grows and not when progress drops out between passes. While a download reports `bytes` with a total above 0, the first half fills by bytes and the value label reads "10.0 MB of 40.0 MB". Otherwise, and always while linking, the label falls back to the phase's "n of m" count. The bar starts at 0 again once the row settles.
 Opens at boot until the agent is ready without failures.
 Background updates stay in the header's update status; new failures reopen the panel, and after a reload into a boot that isn't ready yet such a panel closes once the agent is ready.
 Every automatic close is saved to the layout.
 When the port offers packages, an Optional packages section lists them below as compact rows, each with its state, version, download size, requirements, commands, progress, errors and Install log; packages never count in the header or keep the panel open at boot.
+With a port that has `setDeveloper`, a row's `npm` check shows under its version: "npm: no newer release", "Checking npm…", its `reason` when the check failed (the state light stays), "{installed} (certified) · {latest} on npm, not offered: {reason}" (a certified update keeps its target, "6.6.0 (certified) → 6.7.0 · …", and so does a beta row, "6.13.5 beta · certified 6.6.0 → 6.7.0"), or, when `offered`, "{installed} (certified) · {latest} on npm, not certified" with "12 packages change in /opt/agent." (the folder in the label's parentheses; "1 package changes …"), followed by "@slicc/kernel-bridge and @slicc/vault stay at their certified versions." for `gated` ("… stays at its certified version." for one) and **Install beta**; `article[data-npm]` is the state.
+A row with `beta` has a notice **Beta** badge by its name (`[data-beta]`), a notice "Beta installed" light while it is `current` or `installed` ("Up to date" means the certified version only; Ready to apply, Failed and the running states keep their words), reads "{version} beta · certified {certified}" and offers **Back to certified** next to its other actions; Install beta shows only while `npm` is `offered`.
+While `npm` is `offered`, What’s new covers the releases from the installed version up to npm's `latest`, so an offered beta lists its own notes.
+Install beta and Back to certified are secondary buttons and call `act`; without `setDeveloper` (a mirrored port) neither shows.
+For now bios sets these on the agent row only; the other rows follow with bios.
 Packages the user added with pnpm in `/opt/user`, or pinned, show up in their own Your packages section below it, under "Packages you added with pnpm in /opt/user. Seven’s updates keep them until you remove them." (plus "Pinned versions stay until you unpin them." while a row offers `unpin`), with a neutral Pinned light (a hold, not a success) or a positive Added light, their version against seven's, and Unpin or Remove.
 Also available through View and the rails.
 
@@ -486,8 +495,8 @@ What agents remember, grouped by section: search, filter by scope and tag, expan
 The scope picker starts on **Everyone** (`*`), which lists every memory with its scope on it (`.scope[data-scope]`); `global` reads **Shared** whatever the port calls it, and the cones and roles follow.
 The count (“N of M memories”) counts the memories in the picked scope.
 With a search or tag filter that hides everything it says “No memories match.”, otherwise “No memories yet.”, “No shared memories yet.” or “No memories for {scope} yet.”
-Each memory is a row (`li.row[data-id]`, divided from the next by a rule) with one structure open or closed: the title line (`.head`, the disclosure button) keeps its chevron, title and marks where they are, and the text below it (`.content`) shows two lines closed and grows into the full text in place when the row opens, so opening only adds height below. It stays open across a layout switch. Open rows (`data-open`) take no fill, so nothing reads as selected; the chevron turns down. Height and chevron move like Spectrum's accordion (`--swc-animation-duration-100`, ease in and out), and not at all under `prefers-reduced-motion`. A click on a closed row's text opens it too.
-An open row ends in an action row at the trailing end: **Edit** and **Forget** (`data-action="edit"`, `data-action="forget"`), Forget in the negative content colour and asking first with the destructive confirm.
+Each memory is a row (`li.row[data-id]`, divided from the next by one straight hairline, a square-ended `--swc-border-width-100` rule in the neutral border colour that spans the row, even where the row's hover fill is rounded) with one structure open or closed: the title line (`.head`, the disclosure button) keeps its chevron, title and marks where they are, and the text below it (`.content`) shows two whole lines closed (the clamp leaves room for one paragraph gap, so a second paragraph's first line is never half cut and doesn't move when the row opens) and grows into the full text in place when the row opens, so opening only adds height below. It stays open across a layout switch. Open rows (`data-open`) take no fill, so nothing reads as selected; the chevron turns down. Height and chevron move like Spectrum's accordion (`--swc-animation-duration-100`, ease in and out), and not at all under `prefers-reduced-motion`. A click on a closed row's text opens it too.
+An open row ends in an action row: first its tag and scope in words next to their icons (`.meta [data-label=tag]`, `[data-label=scope]`, such as “Project” and “harbor only”), since touch has no tooltips, while a closed row shows only the icons; the open row hides its title-line tag and scope icons (`visibility: hidden`, so the title keeps its place) instead of showing them twice; then at the trailing end **Edit** and **Forget** (`data-action="edit"`, `data-action="forget"`), Forget in the negative content colour and asking first with the destructive confirm.
 At the end of the title line, small icons (`.mark`, `role="img"` with an `aria-label` and a tooltip) carry the metadata: the tag (`.tag[data-tag]`: User a file with a person, Feedback a comment, Project a briefcase), “From MEMORY.md” for free text outside an entry (`.from`), and under Everyone the scope (`.scope[data-scope]`: Shared a group of people, a cone a person, a role a person with a gear, labelled “Shared” or “{name} only”).
 The tag is left out where the list already says it: under a section heading that names it (Projects, User, Feedback) and while the tag filter picks it.
 Below 560 px of panel width, the search takes its own line over the two pickers.
@@ -806,7 +815,10 @@ Emit `items` whenever rows or readiness change.
 Use `queued` for a row that waits for another component before it starts; it reads "Waiting" and doesn't count as updating.
 Use `starting` for an installed row that is only starting up: it reads "Starting" without a checked line, and the header shows a neutral "Starting" only when nothing is failed, updating or ready.
 A `failed` row with an installed `from` version reads "Update failed".
-`act(id, action)` resolves when dispatched or rejects with a displayed error; actions are `retry`, `update-now`, `restart-agent` and `reload`.
+`act(id, action)` resolves when dispatched or rejects with a displayed error; actions are `retry`, `update-now`, `restart-agent`, `reload`, `install-beta` and `back-to-certified` (the embedder asks for confirmation itself).
+A row's and a package's optional `releases` (`UpdateRelease[]`) lists the GitHub releases the embedder knows for it, each with its `version`, the release page `url` and optional `notes` (the release body, semantic-release markdown as GitHub returns it). Send every release after the installed version up to the new one, so the panel can show the whole range, plus the installed one for its link; spectrum orders them by version and never fetches them itself. Leave it out, or leave out `notes`, when there's nothing to show.
+Optional `developer()` (false by default) and `setDeveloper(on)`, on the owner's page only, turn developer mode on and off; `setDeveloper` resolves once settled or rejects with a displayed error, and the port emits `items` when either changes.
+A row's optional `beta` (`{ version, certified }`) is set while a beta is installed, and its optional `npm` (`{ state, latest?, reason?, changes?: { count, gated } }`, `state` one of `checking`, `current`, `offered`, `not-offered` or `failed`) is `null` while developer mode is off.
 Missing ports preserve existing adapters and report disconnected information in the panel.
 Optional `packages()` returns `PackageItem` rows for optional tools, each with a short catalog `id`, its npm `package` (shown in the name's tooltip and at the top of its Install log), `label`, a one-sentence `description`, the `commands` it provides, `requires` (other package ids, read as "Uses Python" while it's installed, or "Installs Python too" on a row that isn't installed yet; an installed row leaves out a requirement that isn't installed, since its warning says so), optional `notes` (short plain-text lines shown muted under the row, such as "1 untested dependency: …"; leave it out when there's nothing to say), optional `warnings` (lines with an alert icon, `data-warnings`, such as "Needs Python, which isn't installed.
 Install Python again to use it."; the dummy adds that one when a required package is removed), `state` (`available`, `queued`, `installing`, `installed`, `outdated`, `updating`, `removing` or `failed`), the installed `version`, the `offered` version and its `size` in bytes, `progress` (`InstallProgress`, or `null` for an indeterminate bar), `error`, `actions` (`install`, `update`, `remove`, `retry`, `unpin`) and an optional `log`.
@@ -867,6 +879,7 @@ An action is a secondary button that stays pending until `act(id, action)` settl
 The close button, labelled "Dismiss: <title>", hides the notice at once and calls `dismiss(id)` synchronously; it shows again only if the port drops the notice from `list()` and brings it back later.
 Emit `notices` whenever they change.
 A notice with `dismissible: false` has no close button and stays until the port drops it.
+An optional `session: true` marks a notice the embedder keeps for the session; the panel shows it like any other, and other fields pass through.
 Hooks: `[data-notice="<id>"]`, buttons with `data-action`, `[data-dismiss]` and `[data-error]`.
 
 #### `tabs` (optional)
@@ -960,9 +973,11 @@ Pass only the surfaces a follower has to `<slicc-app>` (agents, chat, terminal a
 
 The dummy supports `createDummyModel({ updates: 'boot' | 'starting' | 'current' | 'available' | 'restart' | 'failure' })`, also selectable with `?updates=` on `/ui/`.
 Fixtures stay stable for inspection; `model.updates.setScenario('current')` completes boot.
+The dummy's kernel offers three releases from 1.12.0 to 1.13.0, two of them certified, the agent one release to 0.25.0, and the syntax grammars only their installed release; its uv package offers two releases, Python links its release and the other installed packages their npm pages.
 Dummy Update now and Retry simulate download and link progress, and a dummy package install reports half its `size` in bytes on the way; Restart agent and Reload only change fixture state, never restart a real process or reload the browser.
 `createDummyModel({ packages: 'mixed' | 'empty' | 'fail' | 'user' | 'elsewhere' | 'off' })` (or `?packages=` on `/ui/`, off by default) adds invented optional packages in every state: Install and Retry finish after a short wait and install missing requirements too, `fail` makes them fail, `user` adds a pinned agent-kit and two additions (one with a warning) that Unpin and Remove take out of the list, `elsewhere` has git installed for cone with pnpm and TypeScript there at an older version, whose Update keeps it in place, and Biome both from the panel and for cone, whose Remove leaves cone's copy, and removing Python while uv is installed asks through the `confirm` option (the `/ui/` page passes spectrum's `confirm`).
-`updateFixtures`, `packageFixtures` and `DummyUpdates` are exported from `/dummy`.
+`createDummyModel({ beta: 'offered' | 'installed' | 'blocked' | 'failed' | 'off' })` (or `?beta=` on `/ui/`, off by default) turns developer mode on with an invented agent at 6.6.0 (certified) and 6.13.5 on npm, 12 packages and nothing gated: `offered` offers Install beta, `installed` runs the beta, `blocked` isn't offered because it needs a newer kernel, and `failed` is a failed beta install with Retry and Install beta; `setDeveloper` toggles it after a short wait (checking npm again when turned on), and Install beta and Back to certified simulate a short install.
+`updateFixtures`, `betaFixtures`, `packageFixtures` and `DummyUpdates` are exported from `/dummy`.
 `createDummyModel({ mounts: 'mount' | 'cancel' | 'fail' | 'needs' })` (or `?mounts=` on `/ui/`) turns on the optional mount members, which are off by default: `mountFolder` mounts invented files at `/mnt/photos`, resolves with `null`, or rejects, as `model.files.mount.scenario` says; `needs` also lists `/mnt/photos` in `needsFolder()` until a folder is inserted there.
 `createDummyModel({ network: 'ok' | 'limited' | 'failing' | 'off' })` (or `?network=` on `/ui/`, default `limited`) sets the dummy network: slicc on this computer as a linked device (`route: 'link'`, with browser automation through it), the page fetch with CORS failures, or no route, all invented; `off` leaves out the port.
 `model.network.setScenario()` switches it and Check again re-emits after a short wait.
@@ -1032,6 +1047,7 @@ Its buttons are plain Spectrum buttons that answer at once: Unlock unlocks, and
 
 On phones the update status and the tray connection show only their status light (the tray's budget is hidden) and the network indicator a cloud icon, with the text in their labels and tooltips; the agent picker keeps room for the cone's name, cut with an ellipsis when long, and the bottom rail scrolls when needed.
 The update status comes first so progress and failures remain reachable on narrow screens.
+While a row has `beta`, the update status shows a notice **Beta** badge (`[data-updates] [data-beta]`) after its light, or alone when nothing else applies, at every size; its tooltip and label add "{label} runs beta {version}, not certified", with the label's folder left out ("Agent runs beta 6.13.5, not certified").
 
 ### Kernel model
 

package/dist/slicc-dummy.js

@@ -1741,8 +1741,8 @@ var DummyAgent = class extends Emitter {
         this.emit("message", { agentId, message: reply });
         const steers = run.steers.splice(0);
         for (const steer of steers) this.#post(agentId, this.#user(steer, "steer"));
-        const latest = steers.at(-1);
-        ({ steps, suggestion } = script(latest.text.trim(), latest.attachments ?? []));
+        const latest2 = steers.at(-1);
+        ({ steps, suggestion } = script(latest2.text.trim(), latest2.attachments ?? []));
         run.pace = this.#pace(agentId, steps);
         reply = this.#reply(agent.model);
         this.#post(agentId, reply);
@@ -4944,6 +4944,65 @@ var DummyTray = class extends Emitter {
 
 // src/dummy/updates.ts
 var checkedAt = Date.UTC(2026, 9, 8, 8, 42);
+var tag = (repo, version, notes2) => ({
+  version,
+  url: `https://github.com/harbor-demo/${repo}/releases/tag/v${version}`,
+  ...notes2 ? { notes: notes2 } : {}
+});
+var certified = (name2, version) => `
+
+<!-- cert-verify -->
+certified @harbor/${name2}@${version} sha256=0f3c9a1e (covers ${version}; downstream: PASS)
+<!-- /cert-verify -->
+`;
+var notes = (repo, version, sections) => `# [${version}](https://github.com/harbor-demo/${repo}/compare/v${version}) (2026-10-07)
+
+${sections}`;
+var releaseFixtures = {
+  kernel: [
+    tag(
+      "harbor-kernel",
+      "1.13.0",
+      notes(
+        "harbor-kernel",
+        "1.13.0",
+        "### Features\n\n* **fs:** watch a folder and get one event per batch of changes\n* **jobs:** `wait -n` returns the first job that finishes"
+      ) + certified("harbor-kernel", "1.13.0")
+    ),
+    tag(
+      "harbor-kernel",
+      "1.12.2",
+      notes(
+        "harbor-kernel",
+        "1.12.2",
+        "### Bug Fixes\n\n* **net:** a slow DNS answer no longer stalls the next request"
+      ) + certified("harbor-kernel", "1.12.2")
+    ),
+    tag(
+      "harbor-kernel",
+      "1.12.1",
+      notes(
+        "harbor-kernel",
+        "1.12.1",
+        "### Bug Fixes\n\n* **tty:** resizing a terminal mid-line keeps the cursor on its column"
+      )
+    ),
+    tag("harbor-kernel", "1.12.0")
+  ],
+  agent: [
+    tag(
+      "harbor-agent",
+      "0.25.0",
+      notes(
+        "harbor-agent",
+        "0.25.0",
+        "### Features\n\n* **tools:** the agent can read a tide table from a CSV file\n\n### Bug Fixes\n\n* **chat:** a long answer keeps its code blocks intact when it is cut"
+      )
+    ),
+    tag("harbor-agent", "0.24.0")
+  ],
+  grammars: [tag("harbor-grammars", "4.5.0")]
+};
 function updateFixtures(scenario) {
   const components = [
     ["bios", "BIOS packages", "0.8.2"],
@@ -4963,7 +5022,8 @@ function updateFixtures(scenario) {
     to: version,
     checkedAt,
     error: null,
-    actions: []
+    actions: [],
+    ...releaseFixtures[kind] ? { releases: releaseFixtures[kind] } : {}
   }));
   const agent = items[2];
   if (scenario === "boot") {
@@ -5001,7 +5061,89 @@ function updateFixtures(scenario) {
   }
   return items;
 }
-var offer = (id, label2, description, commands, offered, size, requires) => ({
+var pin = "6.6.0";
+var latest = "6.13.5";
+var betaReleases = [
+  tag(
+    "harbor-agent",
+    "6.13.5",
+    notes(
+      "harbor-agent",
+      "6.13.5",
+      "### Bug Fixes\n\n* **tools:** a tide table with a blank row no longer stops the import"
+    )
+  ),
+  tag(
+    "harbor-agent",
+    "6.10.0",
+    notes(
+      "harbor-agent",
+      "6.10.0",
+      "### Features\n\n* **chat:** answers can quote a buoy reading with its time and place"
+    )
+  ),
+  tag(
+    "harbor-agent",
+    "6.6.0",
+    notes("harbor-agent", "6.6.0", "### Bug Fixes\n\n* **chat:** a pasted chart keeps its axes") + certified("harbor-agent", "6.6.0")
+  )
+];
+var offered = { state: "offered", latest, changes: { count: 12, gated: [] } };
+var blocked = {
+  state: "not-offered",
+  latest,
+  reason: "it needs kernel 1.14.0 or later"
+};
+var betaFailed = "Couldn\u2019t install the beta: pnpm stopped with an error, shown in the install log. Retry.";
+function betaActions(item) {
+  return [
+    ...item.beta ? ["back-to-certified"] : [],
+    ...item.npm?.state === "offered" ? ["install-beta"] : []
+  ];
+}
+function withNpm(items, npm) {
+  return items.map((item) => {
+    if (item.kind !== "agent") return item;
+    const next = { ...item, npm };
+    const kept = item.actions.filter(
+      (action) => action !== "install-beta" && action !== "back-to-certified"
+    );
+    return { ...next, actions: [...kept, ...betaActions(next)] };
+  });
+}
+function betaFixtures(items, scenario) {
+  return items.map((item) => {
+    if (item.kind !== "agent") return item;
+    const base = {
+      ...item,
+      from: pin,
+      to: pin,
+      beta: null,
+      npm: offered,
+      releases: betaReleases
+    };
+    const next = scenario === "installed" ? {
+      ...base,
+      from: latest,
+      to: latest,
+      beta: { version: latest, certified: pin },
+      npm: { state: "current", latest }
+    } : scenario === "blocked" ? { ...base, npm: blocked } : scenario === "failed" ? {
+      ...base,
+      state: "failed",
+      to: latest,
+      error: betaFailed,
+      log: `pnpm add @slicc/demo-agent@${latest}
+ERR_PNPM_FETCH_TIMEOUT Request timed out after 30000ms`
+    } : base;
+    const extra = betaActions(next);
+    return {
+      ...next,
+      actions: [...scenario === "failed" ? ["retry"] : item.actions, ...extra]
+    };
+  });
+}
+var offer = (id, label2, description, commands, offered2, size, requires) => ({
   id,
   package: `@harbor/${id}-wasm`,
   label: label2,
@@ -5010,14 +5152,14 @@ var offer = (id, label2, description, commands, offered, size, requires) => ({
   ...requires ? { requires } : {},
   state: "available",
   version: null,
-  offered,
+  offered: offered2,
   size,
   progress: null,
   error: null,
   actions: ["install"]
 });
 var fetchFailed = "The download stopped. Check the connection and try again.";
-var yours = (project, name2, description, version, pin, change = {}) => ({
+var yours = (project, name2, description, version, pin2, change = {}) => ({
   id: `user:${project}:${name2}`,
   package: name2,
   label: name2.replace(/^@[^/]+\//, ""),
@@ -5028,9 +5170,9 @@ var yours = (project, name2, description, version, pin, change = {}) => ({
   offered: null,
   progress: null,
   error: null,
-  actions: [pin.base === null ? "remove" : "unpin"],
+  actions: [pin2.base === null ? "remove" : "unpin"],
   origin: "user",
-  pin: { ...pin, project: `/opt/${project}` },
+  pin: { ...pin2, project: `/opt/${project}` },
   ...change
 });
 var userPackages = () => [
@@ -5118,7 +5260,28 @@ function packageFixtures(scenario) {
     notes: ["1 untested dependency: @harbor/wasi-sockets@0.4.2-1"],
     actions: ["remove"]
   });
-  patch("uv", { state: "outdated", version: "0.8.1", actions: ["update", "remove"] });
+  patch("python", {
+    releases: [
+      { version: "3.13.1", url: "https://github.com/harbor-demo/python-wasm/releases/tag/v3.13.1" }
+    ]
+  });
+  patch("uv", {
+    state: "outdated",
+    version: "0.8.1",
+    actions: ["update", "remove"],
+    releases: [
+      {
+        version: "0.9.2",
+        url: "https://github.com/harbor-demo/uv-wasm/releases/tag/v0.9.2",
+        notes: "## 0.9.2\n\n### Bug Fixes\n\n* `uv run` finds the project in a parent folder again"
+      },
+      {
+        version: "0.9.0",
+        url: "https://github.com/harbor-demo/uv-wasm/releases/tag/v0.9.0",
+        notes: "## 0.9.0\n\n### Features\n\n* `uv add` keeps the comments in `pyproject.toml`"
+      }
+    ]
+  });
   patch("esbuild", {
     state: "installing",
     actions: [],
@@ -5158,9 +5321,16 @@ var DummyUpdates = class extends Emitter {
   #packages = [];
   #fail = false;
   #confirm;
+  #beta;
+  #developer = true;
   constructor(scenario, clock2, options = {}) {
     super();
-    this.#items = updateFixtures(scenario);
+    this.#beta = options.beta;
+    this.#items = this.#fixtures(scenario);
+    if (options.beta) {
+      this.developer = () => this.#developer;
+      this.setDeveloper = (on) => this.#setDeveloper(on);
+    }
     this.#ready = scenario !== "boot" && scenario !== "starting";
     this.#clock = clock2;
     this.#confirm = options.confirm;
@@ -5290,8 +5460,32 @@ Done in 3.8s`
   ready() {
     return this.#ready;
   }
+  #fixtures(scenario) {
+    const items = updateFixtures(scenario);
+    if (!this.#beta) return items;
+    const fixed = betaFixtures(items, this.#beta);
+    return this.#developer ? fixed : withNpm(fixed, null);
+  }
+  async #setDeveloper(on) {
+    await this.#clock.sleep(4);
+    this.#developer = on;
+    this.#npm(on ? { state: "checking" } : null);
+    if (!on) return;
+    await this.#clock.sleep(4);
+    const agent = this.#items.find((item) => item.kind === "agent");
+    this.#npm(this.#check(agent.from));
+  }
+  #check(version) {
+    if (!this.#developer) return null;
+    if (version === latest) return { state: "current", latest };
+    return this.#beta === "blocked" ? blocked : offered;
+  }
+  #npm(npm) {
+    this.#items = withNpm(this.#items, npm);
+    this.emit("items", this.#items);
+  }
   setScenario(scenario) {
-    this.#items = updateFixtures(scenario);
+    this.#items = this.#fixtures(scenario);
     this.#ready = scenario !== "boot" && scenario !== "starting";
     this.emit("items", this.#items);
   }
@@ -5302,7 +5496,9 @@ Done in 3.8s`
   async act(id, action) {
     const item = this.#items.find((candidate) => candidate.id === id);
     if (!item?.actions.includes(action)) throw new Error(`Update action unavailable: ${id}`);
-    if (action === "update-now" || action === "retry") {
+    const back = action === "back-to-certified";
+    const beta = back || action === "install-beta" || action === "retry" && item.to === latest;
+    if (action === "update-now" || action === "retry" || beta) {
       this.#patch(id, {
         state: "downloading",
         progress: { phase: "download", done: 0, total: 95 },
@@ -5318,13 +5514,30 @@ Done in 3.8s`
       });
       await this.#clock.sleep(2);
     }
+    if (beta) {
+      const version = back ? pin : latest;
+      const next = {
+        ...this.#items.find((candidate) => candidate.id === id),
+        state: "ready",
+        from: version,
+        to: version,
+        progress: null,
+        error: null,
+        checkedAt,
+        beta: back ? null : { version, certified: pin },
+        npm: this.#check(version)
+      };
+      this.#patch(id, { ...next, actions: ["restart-agent", ...betaActions(next)] });
+      return;
+    }
     const apply = action === "update-now" && ["agent", "bios", "kernel", "ui"].includes(item.kind);
     this.#patch(id, {
       state: apply ? "ready" : "installed",
       from: apply ? item.from : item.to,
       progress: null,
       checkedAt,
-      actions: apply ? [item.kind === "agent" ? "restart-agent" : "reload"] : []
+      actions: apply ? [item.kind === "agent" ? "restart-agent" : "reload"] : [],
+      ...apply ? {} : { actions: betaActions(item) }
     });
   }
 };
@@ -5431,7 +5644,7 @@ function refused(settings) {
   if (bad)
     throw vaultFailure("EINVAL", `The vault refused ${bad[0]}. Check that value and try again.`);
 }
-function accountRecords(now2 = Date.now(), pin) {
+function accountRecords(now2 = Date.now(), pin2) {
   return [
     {
       name: "MCP_DOCS_TOKEN",
@@ -5441,7 +5654,7 @@ function accountRecords(now2 = Date.now(), pin) {
       source: "settings",
       sourceDevice: null,
       server: "docs",
-      ...pin ? { url: pin, pinned: true } : {},
+      ...pin2 ? { url: pin2, pinned: true } : {},
       domains: ["docs.example"],
       rules: [{ domain: "docs.example", header: "Authorization", methods: [], paths: [] }],
       exec: false,
@@ -6022,11 +6235,11 @@ var DummyVault = class extends Emitter {
     await this.#time.sleep(5);
     this.#unlocked();
     for (const name2 of names) {
-      const pin = this.#list.audit.find(
+      const pin2 = this.#list.audit.find(
         (entry) => entry.type === "endpoints" && entry.pinned?.name === name2
       );
-      if (pin?.type === "endpoints" && pin.pinned)
-        this.#log(name2, { type: "endpoints", unpinned: pin.pinned });
+      if (pin2?.type === "endpoints" && pin2.pinned)
+        this.#log(name2, { type: "endpoints", unpinned: pin2.pinned });
     }
     this.emit("list", this.#list);
   }
@@ -6063,20 +6276,20 @@ var DummyVault = class extends Emitter {
       password: !!options.password,
       ...pick ? { pick: [...pick] } : {}
     });
-    const offered = kind === "keepass" ? [...candidates, duplicate] : candidates;
-    if (!pick) return { stage: "pick", candidates: offered.map((item) => ({ ...item })) };
+    const offered2 = kind === "keepass" ? [...candidates, duplicate] : candidates;
+    if (!pick) return { stage: "pick", candidates: offered2.map((item) => ({ ...item })) };
     const chosen = new Map(
       pick.map(
         (item) => typeof item === "string" ? [item, "secret"] : [item.name, item.kind]
       )
     );
-    const taken = offered.filter((item) => chosen.has(item.name) && !item.refused);
+    const taken = offered2.filter((item) => chosen.has(item.name) && !item.refused);
     return {
       stage: "done",
       imported: taken.map((item) => this.#seal(item.name, `import:${kind}`, chosen.get(item.name))),
-      skipped: offered.filter((item) => !taken.includes(item)).map((item) => item.name),
+      skipped: offered2.filter((item) => !taken.includes(item)).map((item) => item.name),
       reasons: Object.fromEntries(
-        offered.flatMap((item) => item.refused ? [[item.name, item.refused]] : [])
+        offered2.flatMap((item) => item.refused ? [[item.name, item.refused]] : [])
       )
     };
   }
@@ -6167,6 +6380,7 @@ function createDummyModel({
   updates = "current",
   packages = "off",
   confirm,
+  beta = "off",
   mounts = "off",
   network = "limited",
   tailnet,
@@ -6247,6 +6461,7 @@ function createDummyModel({
     tray: new DummyTray(tray, time),
     updates: new DummyUpdates(updates, time, {
       ...packages === "off" ? {} : { packages },
+      ...beta === "off" ? {} : { beta },
       confirm
     }),
     ...network === "off" ? {} : { network: new DummyNetwork(network, time, tailnet, links, files3, leaders) },
@@ -6284,6 +6499,7 @@ export {
   DummyVaultButton,
   actionLimits,
   approvalFixtures,
+  betaFixtures,
   browserHistory,
   createDummyModel,
   createGuestModel,