sliccy 6.87.2 → 6.88.0

package/dist/ui/assets/CLAUDE-4LHXSyPA.js

@@ -0,0 +1 @@
+var e="# CLAUDE.md\n\nThis file covers the default virtual filesystem payload in `packages/vfs-root/`.\n\n## What This Package Contains\n\n`packages/vfs-root/` is copied into the app's virtual filesystem on init/reset. It is content, not runtime code.\n\n## Directory Structure\n\n| Path                                  | Purpose                                                            |\n| ------------------------------------- | ------------------------------------------------------------------ |\n| `packages/vfs-root/shared/`           | Shared content that becomes `/shared/` in the VFS                  |\n| `packages/vfs-root/workspace/`        | Default workspace content that becomes `/workspace/` in the VFS    |\n| `packages/vfs-root/shared/CLAUDE.md`  | Agent-facing runtime instructions bundled into `/shared/CLAUDE.md` |\n| `packages/vfs-root/shared/MEMORY.md`  | User-editable memory curator config bundled as `/shared/MEMORY.md` |\n| `packages/vfs-root/shared/sprinkles/` | Built-in sprinkle UIs                                              |\n| `packages/vfs-root/shared/sounds/`    | Shared notification sounds                                         |\n| `packages/vfs-root/workspace/skills/` | Default installable workspace skills                               |\n\n## Adding Default Content\n\n### Memory curator\n\n- `shared/MEMORY.md` is the single source for the runner's build-time fallback and the seeded\n  `/shared/MEMORY.md` file.\n- The file is seeded only when absent, so user and skill customizations survive later boots.\n- `MEMORY.md` is user-edited only; the curator intentionally cannot rewrite its own instructions.\n- Frontmatter uses a strict YAML subset: block-array items may have `#` comment tails; inline\n  entries containing commas must be quoted. A bare `/` is rejected from `writablePaths`.\n- Frontmatter `allowedCommands` entries extend the curator's built-in base set; they do not\n  replace or remove base commands.\n- The curator may rewrite the entire `/workspace/CLAUDE.md`, and the hard character budget\n  applies to the entire file with no protected region.\n- Every `##`/`###` memory section ends with a `YYYY-MM-DD` last-verified date, in UTC to match\n  archive timestamps. Each pass re-verifies the oldest sections first; undated sections are\n  maximally stale.\n- The curator's write grant is `/workspace/CLAUDE.md` alone, not `/workspace/`. It can run `upskill`\n  to look up a skill for a pitfall it found, and a directory-wide grant would also let it install\n  into `/workspace/skills/`. Reads still cover `/workspace/`. Single-file entries in\n  `writablePaths` work because `generateScoopSudoers` emits both the bare path and the `/**` form.\n- The pass is detached, so it spawns with `notifyOnComplete`. Its closing message reaches the cone\n  on the `scoop-notify` channel; that is where a skill suggestion lands. Without it the report is\n  discarded and the cone never learns the pass ran.\n- Turn count is what a pass costs, because every turn re-reads the whole context as a cache read.\n  Two things keep it down, and both belong to the prompt rather than the runtime: `thinkingLevel`\n  (default `medium`; spawned agents otherwise resolve to `off`) so the curator plans the cut\n  instead of converging by trial and error, and the archive reading recipes so it never `cat`s a\n  multi-megabyte archive whose `slicc:session-data` block is a single line holding half the file.\n\n### Skills\n\n- Add new built-in workspace skills under `packages/vfs-root/workspace/skills/<skill-name>/`.\n- Include `SKILL.md` and any companion assets or `.jsh` scripts the skill needs.\n\n### Sprinkles\n\n- Add built-in sprinkles under `packages/vfs-root/shared/sprinkles/<name>/`.\n- Keep the main file named `<name>.shtml` to match discovery and sprinkle naming conventions.\n\n### Sounds\n\n- Add shared sounds under `packages/vfs-root/shared/sounds/`.\n- Prefer stable filenames because shell commands and docs may reference them directly.\n\n## External Handoffs\n\n- Mechanism: RFC 8288 `Link` response header carrying `https://www.sliccy.ai/rel/handoff` or `https://www.sliccy.ai/rel/upskill` on a main-frame document response → `navigate` lick → cone approval card.\n- Agent-facing flow: `packages/vfs-root/workspace/skills/handoff/SKILL.md` (bundled to `/workspace/skills/handoff/SKILL.md`) and the trigger line in `shared/CLAUDE.md` (bundled to `/shared/CLAUDE.md`).\n- Protocol reference: `docs/slicc-handoff.md`.\n- When handoff behavior changes, keep the skill, `shared/CLAUDE.md`, and `docs/slicc-handoff.md` aligned — do not duplicate their content here.\n\n## Important Distinction\n\n`packages/vfs-root/shared/CLAUDE.md` is **agent-facing runtime content** bundled into the virtual filesystem.\n\nIt is different from the developer-facing `CLAUDE.md` files in the repository. Do not merge those roles together.\n";export{e as default};

package/dist/ui/assets/CLAUDE-Bio4HPGK.js

@@ -0,0 +1 @@
+var e='# sliccy\n\nAI agent in SLICC, a browser-native runtime: code, automate, browse, orchestrate parallel agents.\n\n## Vocabulary\n\n- **Cone**: You. Orchestrate scoops, talk to the human, full FS access.\n- **Scoops**: Isolated sub-agents (`scoop_scoop`, `feed_scoop`, `drop_scoop`, `agent` one-shot).\n- **Sprinkles**: Persistent UI panels (`.shtml`), owned by a long-lived scoop.\n- **Dips**: Inline `shtml` chat widgets; ephemeral, lick-only.\n- **Licks**: Events routed to scoops (below).\n- **Trays**: Remote runtimes. `host` lists; `--runtime=<id>` targets.\n\n## Explore first\n\n100+ commands. When unsure: `commands`, `<cmd> --help`, `man <topic>`, `skill list`.\n\n**Never say "I can\'t" without checking.** If stuck: `upskill search "<query>"`; `upskill tabs` for tab skills.\n\n## SLICC-native commands\n\nOften missed:\n\n- `oauth-token`, `mcp add`, `webhook`, `crontask`, `agent`, `serve`, `ffmpeg`, `hf`, `usb`/`serial`/`hid`/`esptool`, `workflow`\n\n## Principles\n\n- **Scoops do the heavy lifting. The cone orchestrates and synthesizes.** See `man delegation`.\n- When something fails, try another approach.\n- New capabilities = skills, not features. Author: `/workspace/skills/skill-authoring/SKILL.md`.\n\n## Sprinkles\n\nOne scoop per sprinkle, named identically. Cone MUST NOT write `.shtml`/run `sprinkle` — delegate via `feed_scoop`. See `man sprinkle`.\n\n## Dips\n\nInline `shtml` chat widgets — sandboxed, ephemeral, lick-only; the cone writes them directly (buttons emit `slicc.lick(...)`). Persistent UI → Sprinkles. Authoring: `/workspace/skills/dips/SKILL.md`.\n\n## Licks\n\nEvents arrive as `[<Event>: <name>]` with JSON body. **Navigate** (handoff): `man handoff`. **Discovery** (`[Discovery Event: <url>]`): origin advertises agentic resources (ai-catalog.json/llms.txt) — informational; you MAY fetch/act (`mcp add`, read `llms.txt`), never required. **Webhook/Cron/File Watch**: `/workspace/skills/automation/SKILL.md`. **Sprinkle** routes to its scoop. Scoops return on `scoop-notify`/`scoop-idle`/`scoop-wait`.\n\n**Actionable** — `lick_confirm`/`lick_dismiss`. navigate·upskill → `upskill`; session-reload·mount-recovery → re-run `mount`; upgrade → update files; session-reload plain → dismiss-only; navigate·handoff → human-gated.\n\n## Workflows\n\n`workflow run <file.js>` — parallel fan-out, backgrounded; result at `/shared/workflow-runs/<id>.json` (`--wait` blocks). API: `agent(prompt,{schema?,thinking?})`, `parallel`, `pipeline`, `phase`, `log`. Deterministic (`Date`/`Math.random`/`crypto`/timers throw). `workflow status|list|stop|save <id>`.\n\n## Approvals (sudo)\n\n`/etc/sudoers` gates actions; deny → exit 1/`EACCES`. `Cmnd`/`Read`/`Write`/`Export <glob>` (+`NOPASSWD`); "Always" → `sudoers.d/granted`. `sudo <cmd>` requests one. Scoops escalate via `sudo_request` (you resolve; `always` persists).\n\n## Style\n\nProfessional tool, not chatbot. No emoji.\n\n## Memory\n\nPersists across sessions. Add durable user prefs; prune stale. Each scoop has its own `CLAUDE.md`.\n';export{e as default};

package/dist/ui/assets/MEMORY-6FXnIBfJ.js

@@ -0,0 +1,135 @@
+var e=`---
+writablePaths:
+  - /workspace/CLAUDE.md
+visiblePaths:
+  - /sessions/
+  - /shared/
+  - /workspace/
+allowedCommands:
+  - awk
+  - cat
+  - cp
+  - cut
+  - echo
+  - file
+  - find
+  - grep
+  - head
+  - jq # structured reads of JSON stores such as /shared/loose-ends.json
+  - ls
+  - mkdir
+  - mv
+  - od # read-only byte inspection of corrupted stores
+  - printf
+  - rg # recursive, .gitignore-aware search; what the curator actually uses over find|xargs grep
+  - sed
+  - sort
+  - tail
+  - tr
+  - uniq
+  - upskill
+  - wc
+timeoutSeconds: 1200
+thinkingLevel: medium
+---
+
+# Memory curator
+
+Curate the durable memory for session {{SESSION_COUNT}}. Today's date is {{TODAY}}.
+
+**Work fast: a full pass should finish in well under 10 minutes.** The run is hard-stopped at 20 minutes, and a kill mid-write can corrupt the memory file or leave it over budget — so mine the three signals, rewrite the file, compact it in the same pass, and stop, rather than exploring the archive exhaustively.
+
+Read the entire current memory at {{MEMORY_PATH}} if it exists. Then mine the archived session at {{SESSION_ARCHIVE_PATH}} using the reading recipes below. Rewrite the entire {{MEMORY_PATH}} file with the durable information worth carrying into future sessions. Every part of the file is editable and counts toward the budget.
+
+## What to look for
+
+Three things carry across sessions, and each has its own place in the archive:
+
+| Look for        | Where it lives                                                         |
+| --------------- | ---------------------------------------------------------------------- |
+| **Preferences** | the user's own messages — how they want things done, and what to avoid |
+| **Projects**    | tool-call arguments — the paths, repos and files actually worked on    |
+| **Pitfalls**    | failed tool calls — what broke, and the error that proves it           |
+
+Pitfalls are the highest-value and most-often-lost category: a failure that cost half an hour is worth one line next time. Keep the error text that identifies it, not the stack trace.
+
+## Reading the session archive
+
+**Never \`cat\` the archive and never \`head\` it.** Archives reach several megabytes, and the machine-readable \`<!-- slicc:session-data ... -->\` block is a _single line_ holding the whole session as JSON — roughly half the file. Reading it costs a fortune and tells you nothing the prose below it does not. Whole \`### Tool\` result bodies are the other half and are equally not worth reading.
+
+Check the size first, then pull the three signals separately. Together they run about 1% of the archive, so these work on a 2.5 MB file as happily as on a small one.
+
+\`\`\`bash
+wc -c {{SESSION_ARCHIVE_PATH}}
+
+# Preferences — what the user asked for, in their words.
+sed '/^<!-- slicc:session-data$/,/^-->$/d' {{SESSION_ARCHIVE_PATH}} \\
+  | awk '/^## User/{p=1;next} /^## (Assistant|Summary)/{p=0} /^### Tool/{p=0} p'
+
+# Projects — the paths touched most, which name the work.
+sed '/^<!-- slicc:session-data$/,/^-->$/d' {{SESSION_ARCHIVE_PATH}} \\
+  | grep -o '/[A-Za-z0-9_][A-Za-z0-9_./-]\\{3,\\}' \\
+  | sort | uniq -c | sort -rn | head -40
+
+# Pitfalls — failed calls with the input that caused them.
+sed '/^<!-- slicc:session-data$/,/^-->$/d' {{SESSION_ARCHIVE_PATH}} \\
+  | grep -B6 '^Result:.*\\(rror\\|not found\\|failed\\|denied\\|ENOENT\\|fatal\\)' \\
+  | cut -c1-200
+\`\`\`
+
+Only if something is still missing, reach into one specific block with \`grep -n\` plus a bounded \`sed -n 'START,ENDp'\`. Never widen these to the whole file.
+
+## Suggesting a skill
+
+A recurring pitfall is often a missing skill. Once you know what broke and what the work was, spend **one** lookup on it — no more, and skip it entirely when the session had no failures:
+
+\`\`\`bash
+upskill search <a few words from the pitfall>
+upskill list                      # what is already installed — never suggest a duplicate
+\`\`\`
+
+\`upskill ai-ecoverse/skills\` and \`upskill adobe/skills\` list a repo's skills without installing anything. **Never install.** You have no write access to the skills tree, so an install attempt will fail or interrupt the user for approval; recommending is your job, deciding is theirs. Put any suggestion in your closing message, with the pitfall it addresses — that message is delivered to the main agent.
+
+## Working within the budget
+
+Measure, decide, then write once. Do not converge on the budget by trial and error — each attempt re-reads your whole context and is billed accordingly.
+
+1. \`wc -c {{MEMORY_PATH}}\` to get the current size, and subtract {{BUDGET_CHARS}} to get the exact surplus.
+2. Decide up front which sections absorb that surplus, oldest-dated first, and roughly what each one costs. Budget the whole cut before editing anything.
+3. Write the complete file once, already inside the budget. Never write a version you know to be over budget «to fix in the next step»: the pass can be killed at any moment, and the file you leave behind is the one the next session inherits.
+4. \`wc -c {{MEMORY_PATH}}\` to confirm. If you are still over, cut a whole section rather than shaving a few characters at a time.
+
+Per-section costs come out of \`awk\`, not an interpreter: \`awk '/^## /{h=$0} {c[h]+=length($0)+1} END{for(k in c) printf "%7d  %s\\n", c[k], k}' {{MEMORY_PATH}} | sort -rn\` tells you which sections pay for the surplus.
+
+To draft before committing, draft in \`{{SCRATCH_DIR}}\`. That is your own scratch folder: writable without a grant and without an approval prompt, private to this pass, and deleted when the pass ends. Reuse one filename such as \`{{SCRATCH_DIR}}/draft.md\` rather than numbering drafts — you have no \`rm\`, so every extra draft survives until the folder goes.
+
+If the pass is running long, drop the oldest-dated section wholesale and write. An under-budget file missing one stale section is a good outcome; an over-budget file is a broken one.
+
+Rules:
+
+- Keep durable preferences, stable project facts, validated approaches, named resources, and the pitfalls worth not repeating.
+- Organize retained information into concise per-topic sections rather than one flat list. Let the topic lead the heading; preferences, projects and pitfalls are what to look for, not a required table of contents.
+- Never write next to the memory file. It is versioned, so backups and scratch copies beside it are noise; drafts belong in \`{{SCRATCH_DIR}}\`. Do not draft in \`/tmp/\` either: it is shared with every other scoop, which can read and overwrite what you leave there.
+- Shell tools only. Interpreters such as \`python3\` and \`node -e\` are not on your allow-list, so reaching for one costs an approval round-trip and may fail even when approved — \`awk\`, \`sed\`, \`wc\` and \`sort\` cover every measurement this pass needs.
+- End every \`##\` and \`###\` section heading with its last-verified date in \`YYYY-MM-DD\` form, for example \`## Deployment pipeline (2026-08-06)\`. Dates are UTC, matching the session archive timestamps, so a late-evening freeze west of UTC stamps the next day.
+- Stamp sections you write or confirm with today's date, {{TODAY}}.
+- Prioritize re-verifying the oldest-dated sections. Treat undated headings as maximally stale and date them on this pass.
+- Drop ephemera and duplicates. Delete or merge sections that are stale, superseded, or unverifiable.
+- Preserve concrete identifiers such as file paths, URLs, IDs, and names verbatim.
+- Keep the entire file at or below the hard budget of {{BUDGET_CHARS}} characters, with no exempt region. When over budget, compact or remove the oldest-dated sections first.
+- Write the result to {{MEMORY_PATH}}; do not merely return it in your response.
+
+<!-- How to customize
+Add curator instructions here, for example: also update the knowledge base at /path following its WIKI.md. Extend visiblePaths or writablePaths above to grant access to extra stores, and adjust timeoutSeconds when needed.
+
+writablePaths defaults to the memory file alone rather than /workspace/, because the curator can run upskill and a directory-wide grant would also let it install skills into /workspace/skills. Widen it only as far as a task genuinely needs; a single file is a valid entry, not just a directory.
+
+Scratch space needs no entry here. The curator spawns under a fixed per-cone name (memory-curator for the primary cone), so the bridge grants it {{SCRATCH_DIR}} — private to the run, writable without a prompt, and removed when the pass ends — and that is where the prompt sends drafts. /tmp/ is writable too, but it is shared with every other scoop and visible to the cone, so a full rewrite of durable memory does not belong there.
+
+thinkingLevel accepts off, minimal, low, medium, high, or xhigh. Curation is cheaper with reasoning than without: an unreasoned pass converges on the budget by trial and error, and because every turn re-reads the whole context, turn count is what the pass costs. Lower it to off only if you also shrink the prompt to a single mechanical instruction.
+
+MEMORY.md is user-edited only: the curator intentionally has read-only access to /shared/ and cannot rewrite its own instructions. A bare / is rejected in writablePaths.
+
+Frontmatter supports a strict YAML subset. Arrays may use the block form above (with optional # comment tails) or inline form such as [cat, grep]. \`allowedCommands\` is additive: listed commands extend the built-in base set without replacing it. Inline entries containing commas must be quoted, for example ["/knowledge/lars,rebecca/"].
+-->
+`;export{e as default};

package/dist/ui/assets/SKILL-BKUxKc7f.js

@@ -0,0 +1,296 @@
+var e=`---
+name: delegation
+description: |
+  Use this when deciding whether to do work yourself or delegate to a scoop, when
+  fanning out parallel scoops, or when picking models for sub-agents. Covers
+  scoop lifecycle (when to drop), parallel orchestration (\`scoop_mute\`,
+  \`scoop_unmute\`, \`scoop_wait\`), one-shot ephemeral sub-agents via the \`agent\`
+  shell command, and model selection. Read this BEFORE running \`scoop_scoop\` for
+  non-trivial work.
+allowed-tools: bash
+---
+
+# Delegation
+
+Scoops do the heavy lifting; the cone orchestrates and synthesizes. This skill is about choosing how to delegate, not about administering scoops.
+
+## When to delegate
+
+**Default to delegation.** Parallel scoops almost always finish faster, and the cone's job is synthesis.
+
+Delegate when:
+
+- Multiple independent sources (scraping 3 sites = 3 scoops).
+- Time-consuming work that doesn't need direct oversight.
+- Work expressible as a clear, self-contained brief.
+
+Do it yourself when:
+
+- Single quick lookup (one page, one API call).
+- Real-time adaptation needed (navigating broken URLs).
+- Overhead of spawning exceeds benefit.
+
+## Brief for authority, not for execution
+
+The most common delegation failure is **the cone doing too much pre-work before delegating**. The cone researches the topic, makes the design decisions, picks the approach, and then hands the scoop a pre-cooked plan to type out. This is bad on three axes:
+
+- **Pollutes the scoop's context.** The brief is bloated with conclusions the scoop now has to re-derive an opinion on, instead of facts it can act on.
+- **Strips the scoop of autonomy.** A scoop that's been told what to think can't push back on a bad call or notice a better path mid-task. You get a typist, not a collaborator.
+- **Wastes the cone's tokens.** The cone's strength is orchestration — picking the right scoops, synthesizing their outputs. Doing the research itself burns the cone's context on work that's parallelizable.
+
+**Heuristic: if the cone reads files, runs commands, or makes decisions before delegating, that should have been part of the scoop's brief.** Hand the scoop the question, the constraints, and the access — let it decide.
+
+| Bad (cone over-prepares)                                                                        | Good (scoop decides)                                                                                                                            |
+| ----------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
+| Cone reads 5 files, picks an approach, tells scoop "implement approach X in file Y."            | Scoop is told "the user wants Z; the relevant code is under \`/workspace/src/\`. Pick an approach and implement it."                              |
+| Cone scrapes 3 docs, summarizes, then asks scoop to "write a comparison based on this summary." | Scoop is told "compare libraries A, B, C for this use case. Their docs are at <urls>. Decide and write the comparison."                         |
+| Cone debugs a failure, isolates the bug, then asks scoop to "fix the off-by-one in line 42."    | Scoop is told "this command fails with \`<output>\`. Find and fix the bug." (Even better: a one-shot \`agent\` for cheap, deterministic bug-fixes.) |
+
+Two carve-outs where pre-work IS the cone's job:
+
+1. **Routing decisions.** Picking which scoop gets which slice of a fan-out is orchestration, not pre-cooking.
+2. **Synthesis after the fact.** Reading scoop outputs to combine them is the cone's whole point.
+
+If a scoop comes back with a wrong call, **drop it and re-spawn with a better brief** — don't feed a correction. Corrections compound the autonomy problem.
+
+## Scoop lifecycle
+
+Drop scoops when done — but **NEVER drop a scoop that owns a sprinkle**.
+
+Drop when:
+
+- Task completed and results synthesized.
+- Stuck or misbehaving (drop and re-spawn with a better brief).
+
+Never drop when:
+
+- It owns an open sprinkle (must stay alive for the sprinkle's lifetime).
+- Running a recurring/long-running task (feed watcher, webhook handler).
+- Work is still in progress (dropping loses all context).
+
+## Three delegation primitives
+
+| Primitive                    | Conversation             | Sprinkle ownership | Auto-cleanup      | When to use                                                 |
+| ---------------------------- | ------------------------ | ------------------ | ----------------- | ----------------------------------------------------------- |
+| \`scoop_scoop\` + \`feed_scoop\` | Persistent (multi-turn)  | Yes                | No (\`drop_scoop\`) | Long-lived work; sprinkle owners; conversational follow-ups |
+| \`scoop_wait\` / \`scoop_mute\`  | Persistent (multi-turn)  | Yes                | No                | Parallel fan-out where you want one synthesis turn          |
+| \`agent\` (shell command)      | One-shot (single prompt) | No                 | Yes (on exit)     | Cheap, predictable, composable; no cone follow-up needed    |
+
+### \`agent\` — one-shot ephemeral sub-agents
+
+\`agent\` is a shell command that spawns a one-shot sub-scoop, feeds it a prompt, blocks until the agent loop completes, and prints the final message on stdout. Runs from any bash context (terminal, \`feed_scoop\` prompt, \`.jsh\` script, dip lick handler, sprinkle button handler).
+
+\`\`\`
+agent <cwd> <allowed-commands> <prompt> [--model <id>] [--read-only <paths>] [--background-after <s>]
+\`\`\`
+
+- \`<cwd>\` — sole writable prefix (plus \`/shared/\`, the scoop's scratch folder, and \`/tmp/\`). Relative paths resolve against the caller's cwd.
+- \`<allowed-commands>\` — comma-separated allow-list; \`*\` for unrestricted.
+- \`<prompt>\` — forwarded verbatim. The spawned scoop has no access to the caller's history; pack context into the prompt.
+- \`--model\` — defaults to the parent scoop's model (or the cone's, when invoked from the terminal). Accepts an exact id, a shorthand (\`haiku\`, \`sonnet\`, \`claude-haiku-4-5\`), or the \`provider:model\` form \`models\` prints (\`openrouter:openai/gpt-5.6-terra-pro\`). A bare id resolves against the selected provider first, then against any other configured provider that offers it; if several do, the error lists the qualified ids to pick from. The scoop runs on the provider the model resolved from. An id that cannot be resolved is a hard error (exit 1) — it never silently falls back to the parent's model. Models from a provider other than the selected one must additionally be allowed in \`/etc/models\` (see [Model access policy](#model-access-policy)); a blocked model exits 1 and the error quotes the line to add.
+- \`--read-only\` — pure-replace list of read-only paths. Default: the **owning cone's** workspace (plus \`/workspace/skills/\`) and the invoking shell's cwd. When replacing it, name your own cone's workspace — a literal \`/workspace/\` is the primary cone's, not yours.
+- \`--background-after <seconds>\` — how long the spawned scoop's \`bash\` waits for a command before detaching it and moving on (default 600). Nobody can cancel a spawned scoop's turn, so a command that never returns would otherwise burn the whole run on one call; a detached command reports its exit code back to that scoop as a \`Background Command\` lick. \`0\` detaches every command immediately.
+
+**Critical property: no handoff.** Ephemeral scoops do NOT notify the cone on completion. Running \`agent\` from a non-cone shell does not trigger an unsolicited cone turn. The caller gets the result on stdout, nothing else. This makes \`agent\` the right choice for cheap, predictable interactions inside dips and sprinkles where you don't want the cone or owning scoop woken up.
+
+\`\`\`bash
+# Parallel, collected to one file. No cone turns spawned.
+for url in site-a site-b site-c; do
+  agent /tmp "curl,jq" "Fetch https://$url/api, return the top-level title field." >> /tmp/titles.txt &
+done
+wait
+
+# Focused refactor with a restricted allow-list.
+agent /workspace/src "rg,sed,node" "Rename getCwd to getCurrentWorkingDirectory across *.ts"
+
+# Cheap one-shot from a faster model.
+agent . '*' 'Summarize the README in one sentence.' --model claude-haiku-4-5
+\`\`\`
+
+For dip and sprinkle interaction patterns built on \`agent\`, see \`/workspace/skills/dips/SKILL.md\` and \`/workspace/skills/sprinkles/SKILL.md\`.
+
+## Shaping the scoop's sandbox: \`visiblePaths\`, \`writablePaths\`, \`allowedCommands\`
+
+\`scoop_scoop\` accepts three sandbox-shaping parameters. **They are how you give a scoop authority — by widening or narrowing what it can read, write, and run.** A scoop that can't reach the files it needs has no autonomy; pre-cooking the brief is what you do to compensate. Get the sandbox right and the brief gets shorter.
+
+| Param             | What it controls                       | Default                                | Pure replace? |
+| ----------------- | -------------------------------------- | -------------------------------------- | ------------- |
+| \`visiblePaths\`    | Read-only VFS paths the scoop can SEE  | \`["/workspace/"]\`                      | Yes           |
+| \`writablePaths\`   | VFS paths the scoop can READ AND WRITE | \`["/scoops/<folder>/", "/shared/"]\`    | Yes           |
+| \`allowedCommands\` | Shell command allow-list               | unrestricted (every built-in + \`.jsh\`) | Yes           |
+
+"Pure replace" means what you set is what you get — the value isn't merged with the default. Pass \`[]\` to drop it entirely. Trailing slashes recommended on path entries (e.g. \`/shared/data/\`).
+
+Subtleties:
+
+- **\`writablePaths\` are always readable too.** A true read-nothing sandbox needs both \`visiblePaths: []\` AND \`writablePaths: []\`.
+- **Mounts remain readable regardless** of \`visiblePaths\`. \`mount\` overlays are always visible — that's how scoops can work against a mounted S3 bucket or DA repo without you naming the path explicitly.
+- **\`allowedCommands\` applies recursively** — pipelines, command substitutions, and network commands are all gated. Pass \`["*"]\` for explicit unrestricted.
+
+### How to choose
+
+Ask three questions, in order:
+
+1. **What does the scoop need to read?** Files it must consume — source tree, docs, mounted data — go in \`visiblePaths\`. Default \`/workspace/\` is fine for most "do something in the project" briefs. Add specific paths (\`/shared/data/\`, \`/mnt/da/\`) for narrower scopes.
+2. **What is it allowed to change?** Output dirs, the file it's editing, the sprinkle path it owns. Default writable scratch (\`/scoops/<folder>/\`) plus \`/shared/\` is fine for scoops producing artifacts. **Tighten this when the scoop should not modify production code** — e.g. a research scoop with \`writablePaths: ["/scoops/<folder>/"]\` only.
+3. **What commands does it need?** Default unrestricted is right when the scoop will figure out its own toolchain. Tighten only when narrowing to a known set of tools improves reliability or safety — e.g. a scraper with \`["curl","jq"]\`, or a refactor scoop with \`["rg","sed","node"]\`.
+
+### Patterns
+
+\`\`\`
+# Default sandbox: full project, own scratch dir, all commands.
+# Right for most "do this in the project" briefs.
+scoop_scoop({ name: "fix-bug", prompt: "..." })
+
+# Read-only research scoop. Can read everything, can't change anything,
+# can use whatever commands it needs to investigate.
+scoop_scoop({
+  name: "auth-research",
+  visiblePaths: ["/workspace/", "/shared/"],
+  writablePaths: ["/scoops/auth-research/"],
+  prompt: "Map the auth flow across the codebase and write findings to /scoops/auth-research/notes.md."
+})
+
+# Sprinkle-owning scoop. Needs write access to its sprinkle path.
+scoop_scoop({
+  name: "giro-winners",
+  writablePaths: ["/scoops/giro-winners/", "/shared/sprinkles/giro-winners/"],
+  prompt: "..."
+})
+
+# Tight scraper. Only sees public docs, only runs network/json tools,
+# writes to its own scratch.
+scoop_scoop({
+  name: "scraper",
+  visiblePaths: [],
+  writablePaths: ["/scoops/scraper/"],
+  allowedCommands: ["curl", "jq", "rg"],
+  prompt: "Fetch <urls>, extract the price field from each, write a CSV to /scoops/scraper/out.csv."
+})
+
+# Mount-only scoop. Sees just the DA mount, can write back to it.
+# Mount overlays remain readable regardless of visiblePaths.
+scoop_scoop({
+  name: "da-editor",
+  visiblePaths: [],
+  writablePaths: ["/mnt/da/", "/scoops/da-editor/"],
+  prompt: "Edit /mnt/da/index.html to ..."
+})
+\`\`\`
+
+### Don't
+
+- Don't widen \`writablePaths\` "just in case." A scoop with surprise write access can clobber files outside its task — drop and re-spawn with a tighter scope is cheaper than recovering from that.
+- Don't narrow \`allowedCommands\` to "look secure" if you don't know which commands the scoop will need. The agent will hit a wall mid-task and either lie ("I'll skip that step") or spam tool errors.
+- Don't forget the \`writablePaths\`-also-readable rule. \`visiblePaths: []\` alone does not produce a blind sandbox.
+
+### \`background_after\` — bounding a scoop's slow commands
+
+\`scoop_scoop({ background_after: <seconds> })\` sets how long that scoop's \`bash\`
+tool waits for a command before detaching it and continuing the turn (default
+600). This is a resilience knob, not a sandbox one: a scoop's turn cannot be
+cancelled by anyone, so a command that never returns would hang the scoop (and,
+for a blocking \`agent\` call, its caller) indefinitely. When a detached command
+finishes, that scoop receives a \`Background Command\` lick with the exit code, a
+preview, and the path to the full output.
+
+\`\`\`
+# A scoop whose commands must never stall it for more than a minute.
+scoop_scoop({ name: "flaky-net", background_after: 60, allowedCommands: ["curl", "jq"], prompt: "..." })
+\`\`\`
+
+The scoop can also override the budget per call (\`bash({ command, background_after, timeout })\`). Each run is a real pid: \`ps\` lists a detached job and \`kill <pid>\` stops it, so \`timeout\` is a kill rather than just a detach.
+
+## Parallel orchestration: \`scoop_mute\` / \`scoop_unmute\` / \`scoop_wait\`
+
+By default, every non-ephemeral scoop completion fires a \`scoop-notify\` event that wakes the cone for a fresh turn. Fanning out N scoops in parallel produces N extra cone turns whose only job is to acknowledge "scoop X finished" — expensive in tokens, disruptive to orchestration.
+
+These three cone-only tools collapse the fan-out into a single follow-up turn:
+
+- **\`scoop_mute({ scoop_names })\`** — suspends \`scoop-notify\` for the listed scoops. Completions arriving while muted are stashed (full response persisted to \`/shared/scoop-notifications/*.md\`); they do NOT trigger a cone turn.
+- **\`scoop_unmute({ scoop_names })\`** — resumes notifications AND returns every stashed completion inline as the tool's result. The cone reads the summaries in the current turn instead of one extra turn per scoop.
+- **\`scoop_wait({ scoop_names, timeout_ms? })\`** — schedules a NON-BLOCKING wait. Returns immediately so the cone can keep working; when every listed scoop completes (or the timeout fires) the orchestrator delivers a single \`scoop-wait\` channel lick with all captured summaries. Target scoops are implicitly muted for the wait's duration so individual \`scoop-notify\` events don't pre-empt the eventual lick. \`timeout_ms: 0\` fires on the next tick with whatever is already done. Omit \`timeout_ms\` to wait indefinitely. Pre-existing \`scoop_mute\` state survives the wait.
+
+### When to use which
+
+- **Fan-out + synthesis** (your next useful step depends on all scoops) → \`scoop_wait\`.
+- **Background work you'll check later** → \`scoop_mute\` now, \`scoop_unmute\` when you want the summaries.
+- **Single delegation, no parallelism** → don't mute. Default \`scoop-notify\` is fine.
+
+### Examples
+
+\`\`\`
+# Fan-out + synthesize:
+feed_scoop({ scoop_name: "writer-a", prompt: "Draft intro" })
+feed_scoop({ scoop_name: "writer-b", prompt: "Draft outro" })
+scoop_wait({ scoop_names: ["writer-a", "writer-b"], timeout_ms: 600000 })
+# Returns immediately. Cone keeps working. When both finish (or 10 min), a single
+# \`scoop-wait\` lick wakes the cone with both summaries; the next turn synthesizes.
+
+# Background, poll non-blockingly:
+scoop_mute({ scoop_names: ["scraper"] })
+feed_scoop({ scoop_name: "scraper", prompt: "Collect URLs from the sitemap" })
+# ... do other work ...
+scoop_unmute({ scoop_names: ["scraper"] })
+# Tool result has the stashed summary or "No stashed completions".
+\`\`\`
+
+### Notes
+
+- Full response is always persisted to \`/shared/scoop-notifications/<timestamp>-<folder>-<id>.md\` (bounded to the 200 most recent). The summary string in the tool result is truncated at 20 000 characters; read the VFS path when you need the full output.
+- Unknown scoop names are reported in the result but do not abort the call.
+- Dropping or re-registering a muted scoop is safe: \`unregisterScoop\` releases waiters (resolving as \`timedOut: true\`) and clears mute/pending state.
+
+## Inspecting delegation cost
+
+Run \`cost\` to inspect spend for the cone and currently live scoops. The table labels each row's source, and \`--json\` returns the same live-only scope for scripts.
+
+Use \`cost --all\` only when you need the historical picture: it adds dropped scoops from the current runtime and frozen sessions recorded in \`/sessions/index.json\`. Combine it with \`--json\` for structured historical output. Legacy frozen sessions that predate cost persistence are retained with unknown cost rather than reported as zero.
+
+## Model selection for scoops
+
+**Always run \`models\` to verify available models before specifying one.** Model availability depends on the configured provider and API key. \`model\` accepts an exact id, a shorthand (\`haiku\`, \`sonnet\`, \`claude-haiku-4-5\`), or the \`provider:model\` form \`models\` prints (\`openrouter:openai/gpt-5.6-terra-pro\`). A bare id resolves against the selected provider first, then against any other configured provider that offers it; matching several is an error listing the qualified ids. The scoop runs on the provider the model resolved from. An id that cannot be resolved is rejected outright — it never silently falls back to the cone's model. Cross-provider models also need an \`/etc/models\` allow entry (see [Model access policy](#model-access-policy)).
+
+Use \`models --json\` to compare. Intelligence, speed, and cost are independent dimensions:
+
+- **Cost-sensitive** (renames, formatting, grep-and-replace) → low-cost models.
+- **Complex** (architecture, multi-file refactors, subtle debugging) → high-intelligence.
+- **Latency-sensitive** (interactive workflows, quick lookups) → high-speed.
+- **Default** → omit the parameter; inherits the cone's model.
+
+\`\`\`bash
+# 1. Verify available models.
+models
+
+# 2. Create scoops with verified IDs.
+scoop_scoop({ name: "fix-typos", model: "claude-haiku-4-5", prompt: "Fix all typos in /workspace/docs/" })
+scoop_scoop({ name: "architect", model: "claude-opus-4-6", prompt: "Design the new plugin system..." })
+\`\`\`
+
+**Error handling**: scoops retry up to 3 times with exponential backoff for transient errors (rate limits, server errors). Non-retryable errors (invalid model, auth failures) fail immediately and notify the cone, bypassing any \`scoop_mute\` settings.
+
+## Browser tabs
+
+Browser-tab handling rules (track your IDs, never close tabs you didn't open, handle "tab not found" gracefully) live in \`/workspace/skills/playwright-cli/SKILL.md\` under "Multi-Agent Tab Behavior". Read that skill before delegating browser work.
+
+## Model access policy
+
+\`/etc/models\` decides which \`provider:model\` combinations you may spawn against. It
+is keyed by the **selected** provider:
+
+\`\`\`ini
+[adobe]              # while \`adobe\` is selected…
+openrouter:*         # …any openrouter model may be targeted
+-adobe:claude-opus-5 # …but never adobe's own Opus 5
+\`\`\`
+
+- The selected provider's own models are allowed by default — you never list them.
+- Any other provider's model is denied until an entry allows it. This is a spend
+  boundary: the user may keep separate work and personal accounts.
+- \`models\` and the picker hide only what a \`-\` entry denies, so a model you can see
+  is not automatically one you may spawn against; the rejection names the exact
+  line to add.
+
+Do not edit \`/etc/models\` to unblock yourself — the write requires a human approval
+(\`Write /etc/models\` in \`/etc/sudoers\`). Ask the user instead, quoting the line.
+`;export{e as default};

package/dist/ui/assets/SKILL-BKyxMoME.js

@@ -0,0 +1 @@
+var e="---\nname: dns\ndescription: |\n  Use this when resolving DNS records or troubleshooting names and addresses\n  with SLICC's built-in `dig` command. Covers record and reverse queries,\n  supported DNS-over-HTTPS resolvers and fallback, output modes, version flags,\n  and accepted `+opts`.\nallowed-tools: bash\n---\n\n# DNS lookups with dig\n\nSLICC's built-in `dig` resolves DNS records over DNS-over-HTTPS (DoH):\n\n```bash\ndig <name> [type] [@server] [+opts] [--json]\ndig <type> <name> [@server] [+opts] [--json]\ndig -x <address> [@server] [+opts] [--json]\ndig -v | dig --version\n```\n\nThe name and supported record type may appear in either order. A lone positional\nis always the name and defaults to type `A`. Supported types are `A`, `AAAA`,\n`MX`, `TXT`, `CNAME`, `NS`, `SOA`, `SRV`, `PTR`, and `CAA`.\n\n## Resolver selection\n\n| Resolver   | Supported `@server` values                       |\n| ---------- | ------------------------------------------------ |\n| Cloudflare | `@1.1.1.1`, `@1.0.0.1`, `@cloudflare-dns.com`    |\n| Google     | `@8.8.8.8`, `@8.8.4.4`, `@dns.google`            |\n| Quad9      | `@9.9.9.9`, `@149.112.112.112`, `@dns.quad9.net` |\n\nCloudflare is the default. Any other `@server` falls back to Cloudflare and\nprints a note on stderr because arbitrary DNS servers cannot be queried over\nthe built-in DoH transport.\n\n## Flags and output\n\n- `-x <address>` performs an IPv4 or IPv6 reverse lookup as a `PTR` query.\n- `-v` and `--version` print `DiG 9.20.0-slicc (DNS-over-HTTPS)` and exit.\n- `+short` prints one answer value per line; `--json` prints the resolver response as JSON.\n  They are mutually exclusive.\n- Other `+opts`, such as `+noall` and `+answer`, are accepted as no-ops.\n";export{e as default};

package/dist/ui/assets/SKILL-BcELX5TL.js

@@ -0,0 +1 @@
+var e="---\nname: biome\ndescription: |\n  Use this when checking, linting, or formatting code with SLICC's `biome`\n  shell command. Covers its ipk prerequisites, config discovery, check, lint,\n  and format modes, exit codes, and plain or JSON reporters.\nallowed-tools: bash\n---\n\n# Biome\n\nUse the `biome` shell command for Biome checks inside the VFS. It is a thin wrapper over ipk-installed WASM packages, not a bundled Biome binary.\n\n## Install prerequisites\n\nInstall all three backing packages before linting or formatting:\n\n```bash\nipk add @biomejs/wasm-web @biomejs/js-api esbuild-wasm\n```\n\nThere is no CDN fallback. If a package is missing, follow the pinned `ipk add` command printed by `biome --help` or the error message.\n\n## Commands\n\n| Command                           | Behavior                                                      |\n| --------------------------------- | ------------------------------------------------------------- |\n| `biome check <files...>`          | Lint and check formatting. Add `--write` to apply formatting. |\n| `biome lint <files...>`           | Lint only; never writes files.                                |\n| `biome format <file>`             | Print formatted source. Add `--write` to update files.        |\n| `biome format --check <files...>` | Report unformatted files without printing or writing changes. |\n\n`format --write` and `format --check` are mutually exclusive. For piped input, pass `--stdin-file-path <path>` so Biome selects the correct parser.\n\n## Configuration\n\nUse `--config-path <file>` to select a config explicitly. Otherwise, discovery starts at the first target file's directory, or the current directory for stdin, and walks toward `/`. At each directory, `biome.json` takes precedence over `biome.jsonc`.\n\nThe wrapper accepts comments and trailing commas. It does not resolve `extends`.\n\n## Reporters\n\nThe default `plain` reporter emits diagnostics as plain text without HTML entities, HTML tags, or added ANSI escapes.\n\nUse `--reporter json` or `--json` for one JSON document on stdout with `summary`, `diagnostics`, and `files` fields. JSON diagnostic text is not written to stderr, and selecting JSON does not change the exit code.\n\n## Exit codes\n\n| Code | Meaning                                                                                                                |\n| ---- | ---------------------------------------------------------------------------------------------------------------------- |\n| `0`  | No findings, and checked files are formatted.                                                                          |\n| `1`  | Error, fatal, or warning diagnostics; unformatted checked files; missing packages/files; or invalid discovered config. |\n| `2`  | Usage error, including a missing or invalid explicit `--config-path`.                                                  |\n\nTreat code `1` as a failed check even when Biome reports only warnings.\n";export{e as default};

package/dist/ui/assets/SKILL-Bd5ykLEh.js

@@ -0,0 +1 @@
+var e="---\nname: image-processing\ndescription: |\n  Use this when converting, resizing, cropping, stitching, or annotating images;\n  building a filmstrip, contact sheet, or grid; correcting orientation or color;\n  turning a PDF into PNG or JPEG images; or applying common ImageMagick-style\n  effects with SLICC's `convert` / `magick` and `pdftoppm` shell commands.\nallowed-tools: bash\n---\n\n# Image processing with `convert`\n\nSLICC's local ImageMagick WASM command handles common image transforms, multi-image composition, and labels without network access. `magick` is an alias for `convert`.\n\n## Compose filmstrips and grids\n\nJoin images horizontally with `+append` or vertically with `-append`:\n\n```bash\nconvert f00.jpg f01.jpg f02.jpg f03.jpg +append /tmp/filmstrip.jpg\nconvert top.png middle.png bottom.png -append /tmp/column.png\n```\n\nBuild grids with escaped parenthesized groups. Each group produces one intermediate image:\n\n```bash\nconvert \\( f00.jpg f01.jpg f02.jpg f03.jpg +append \\) \\\n  \\( f04.jpg f05.jpg f06.jpg f07.jpg +append \\) \\\n  -append /tmp/grid.jpg\n```\n\n## Transform images\n\nOperations run from left to right on the preceding image or group:\n\n```bash\nconvert photo.jpg -auto-orient -thumbnail '320x320>' -strip thumb.jpg\nconvert input.png -gravity center -crop 800x600+0+0 output.png\nconvert input.png -background white -gravity center -extent 1200x630 output.png\nconvert input.png -colorspace Gray -normalize -sharpen 0x1 output.png\n```\n\nCommon operations:\n\n- Geometry: `-resize`, `-thumbnail`, `-crop`, `-extent`, `-rotate`\n- Orientation: `-auto-orient`, `-flip`, `-flop`\n- Cleanup: `-strip`, `-trim`, `-auto-gamma`, `-auto-level`, `-normalize`\n- Color/alpha: `-background`, `-alpha`, `-colorspace`, `-transparent`, `-negate`\n- Effects: `-blur R[xS]`, `-sharpen R[xS]`\n- Output: `-quality 0-100`\n\nResize geometry accepts ImageMagick modifiers such as `%`, `!`, `^`, `>`, and `<`. Quote geometry containing shell metacharacters.\n\n## Add labels\n\nConfigure the drawing state before `-annotate`:\n\n```bash\nconvert frame.jpg -gravity south -fill white -undercolor '#000000aa' \\\n  -pointsize 24 -annotate +0+10 'Frame 07 — 00:03.5' labeled.jpg\n```\n\nAnnotation uses the bundled Adobe Clean font; custom `-font` selection is not supported yet.\n\nUse `-gravity` with `northwest`, `north`, `northeast`, `west`, `center`, `east`, `southwest`, `south`, or `southeast`. Quote label text and colors containing `#`.\n\n## Rasterize a PDF\n\n`pdftoppm` turns PDF pages into images. `pdftocairo` is an alias.\n\n```bash\npdftoppm -png -r 150 doc.pdf page      # page-1.png, page-2.png, ...\npdftoppm -jpeg -jpegopt quality=80 doc.pdf page\npdftoppm -png -f 2 -l 4 doc.pdf page   # pages 2-4 only\npdftoppm -png -singlefile doc.pdf cover  # exactly cover.png, no page suffix\npdftoppm -png -scale-to 1024 doc.pdf thumb\n```\n\nPage files are numbered `<prefix>-<n>.<ext>`, zero-padded to the digit width of\nthe last page — `page-1.png` for a 9-page document, `page-01.png` for a 12-page\none. `pdftoppm` prints the filenames it wrote.\n\nFor a single page you can also feed the PDF straight to `convert`, which\nrasterizes it first and accepts ImageMagick's 0-based bracket page selector:\n\n```bash\nconvert -density 150 doc.pdf cover.png     # first page\nconvert doc.pdf[2] -resize 800x page3.jpg  # third page, resized\n```\n\nPrefer `pdftoppm` for whole documents: it parses the PDF once, while repeated\n`convert` calls re-parse it per page.\n\n`pdftk` handles page-level PDF work (merge, split, rotate, text extraction)\nwithout rendering, which is cheaper when you do not need an image.\n\n## Verify and inspect\n\n```bash\nfile /tmp/grid.jpg\nopen --view --size high /tmp/grid.jpg\nconvert --help\npdftoppm --help\n```\n\nKeep the output path last. Multiple inputs must be reduced with `+append` or `-append`; escape group parentheses as `\\(` and `\\)` so the shell passes them to `convert`.\n";export{e as default};

package/dist/ui/assets/SKILL-Bt-RhG0L.js

@@ -0,0 +1 @@
+var e="---\nname: workflows\ndescription: |\n  Use this when a task is a fan-out/aggregate job worth orchestrating in code rather\n  than doing turn-by-turn: codebase-wide sweeps, large migrations, multi-source research\n  you cross-check, or multi-angle planning. Covers authoring a workflow (the meta block +\n  the agent/parallel/pipeline/phase/log API), running it (non-blocking by default), and\n  saving a good run as a reusable command. NOT for one-off single-agent tasks — use a\n  plain scoop or `agent` for those.\nallowed-tools: bash, read_file, write_file\n---\n\n# Workflows\n\nA workflow is a plain-JS orchestration script that fans out to parallel sub-agents and\nkeeps intermediate results in script variables (not your context). You author it, run it\nwith `workflow run`, and — once it's good — `workflow save` it as a reusable command.\n\n## When to reach for a workflow\n\n- A sweep over many files/items where each unit is independent (lint, classify, summarize).\n- A migration applied across a codebase in parallel, then aggregated.\n- Research that fans out to several sources and cross-checks them.\n- Multi-angle planning (draft N approaches in parallel, then synthesize).\n\nIf it's a single self-contained task, just use a plain scoop or the `agent` command — a\nworkflow is overhead you don't need.\n\n## The API (available inside a workflow script)\n\n- `agent(prompt, opts?)` → the sub-agent's text (or parsed JSON when `opts.schema` is set),\n  or `null` on failure. `opts`: `{ model?, thinking?, schema?, phase?, label? }`.\n  - `model`: a **bare model id** (run `models` to see the ids you can use) to run this\n    sub-agent on a specific model; omit to inherit the workflow's model. Always pass the\n    bare id (e.g. `claude-opus-4-8`), never a `provider:model` form.\n  - `thinking`: `off | minimal | low | medium | high | xhigh` (per-agent reasoning effort).\n  - `schema`: a JSON Schema; the result is constrained to it and JSON-parsed for you.\n  - `phase` / `label`: display-only grouping (no execution effect yet).\n- `parallel(thunks)` → runs an array of `() => Promise` concurrently (bounded by the cap).\n- `pipeline(items, ...stages)` → maps items through stages.\n- `phase(title)` / `log(message)` → progress markers.\n- `args` → the value passed when the workflow is invoked (`<name> '<json>'`).\n\n## Authoring\n\nA workflow MUST export a `meta` block with a `name` (description optional):\n\n```js\nexport const meta = { name: 'weekly-audit', description: 'Audit each package in parallel' };\n\nconst pkgs = args?.packages ?? ['webapp', 'node-server'];\nphase('audit');\nconst findings = await parallel(\n  pkgs.map((p) => () => agent(`Audit packages/${p} for TODOs. One line each.`, { thinking: 'low' }))\n);\nreturn findings.filter(Boolean);\n```\n\n## Running\n\n```bash\nworkflow run my.workflow.js            # non-blocking (default) — returns a run id immediately\nworkflow run my.workflow.js --wait     # block and print the full result inline\nworkflow status <runId>                # one-shot progress check (NOT for polling loops)\nworkflow list                          # all runs\n```\n\n**Non-blocking is the default, and it is lick-driven — do NOT sleep or poll to wait for it.**\n`workflow run` returns a run id and your turn ends. When the run finishes, its result is delivered\nback to you automatically as a **new turn** (a completion _lick_) carrying the result path plus a\npreview — you will be re-invoked then. So the pattern is: **launch it, then stop.** Never `sleep`,\nand never loop on `workflow status` waiting for completion — the lick is how you get the result, and\nmanually waiting just wastes a turn (and `setTimeout`/`sleep` inside the workflow itself is banned by\nthe determinism guard anyway).\n\nYou do **not** need to wait for a run to finish before saving it: `workflow save` persists the\nscript _source_, which exists the moment the run starts. So the idiomatic flow is **launch\nnon-blocking → `workflow save <runId> <name>` right away → end your turn**; the result lick arrives\non its own.\n\nUse `--wait` ONLY when you genuinely need the full result inline in the current turn (it blocks until\nthe run finishes). Note `--wait` runs are **not** saveable (they have no tracked run id) — run\nnon-blocking when you intend to save.\n\n## Saving as a reusable command\n\n```bash\nworkflow save <runId> weekly-audit     # → /workspace/.workflows/weekly-audit.workflow.js\nweekly-audit                           # now a bare command\nweekly-audit '{\"packages\":[\"cherry\"]}' # JSON arg arrives as `args`\n```\n\nSaved workflows live in `/workspace/.workflows/` and become bare commands (`weekly-audit`).\nSkills can also ship workflows under `skills/<skill>/.workflows/`, which register as\n`<skill>:<name>`. If a bare name collides, the precedence is `built-in > .jsh > saved-workflow`\n(a built-in or `.jsh` keeps the bare name; the workflow is still runnable via\n`workflow run /workspace/.workflows/<name>.workflow.js`). `workflow save` rejects a name\nthat's already a command, so pick another.\n";export{e as default};

package/dist/ui/assets/SKILL-CED8RXQP.js

@@ -0,0 +1,69 @@
+var e=`---
+name: x-search
+description: |
+  Search X (formerly Twitter) for real-time posts, sentiment, and citations
+  via xAI's \`x_search\` server-side tool. Works with any model — the search
+  call runs through your xAI Grok OAuth credentials regardless of which
+  model is steering the cone. Use when you need fresh social-media signal,
+  public reactions, or to find specific posts by keyword, hashtag, or handle.
+allowed-tools: bash
+---
+
+# X Search
+
+Run \`x_search\` from bash. The script pipes a one-shot request to xAI's
+Responses API with the \`x_search\` server tool enabled, then prints the
+model's answer plus any citation URLs.
+
+## Authentication
+
+The shell command resolves the bearer token through \`oauth-token xai-grok\`,
+so you must be signed in to xAI Grok first:
+
+\`\`\`bash
+oauth-token xai-grok
+\`\`\`
+
+If the command prints \`xai-grok: not signed in\`, run \`/login\` in the side
+panel (or the same \`oauth-token xai-grok\` interactively) to complete the
+xAI OAuth flow before searching.
+
+## Usage
+
+\`\`\`bash
+# Free-form query — most common usage
+x_search "what are people saying about Grok 4.3?"
+
+# Restrict to specific handles (comma-separated, max 10)
+x_search --from "elonmusk,xai" "ship dates for Grok"
+
+# Date range (ISO 8601)
+x_search --since 2025-01-01 --until 2025-03-31 "earnings call reactions"
+
+# Pin the underlying search model (default: grok-4.3)
+PI_XAI_X_SEARCH_MODEL=grok-4.5 x_search "fed minutes hot takes"
+\`\`\`
+
+## Output
+
+Plain text answer followed by citations:
+
+\`\`\`text
+Recent posts indicate broadly positive sentiment …
+
+Sources:
+- https://x.com/user/status/...
+- https://x.com/user/status/...
+\`\`\`
+
+## Notes
+
+- \`x_search\` is a separate xAI request, not a context-bearing tool call. The
+  result is folded into your transcript as a bash result, so you can quote
+  or summarize it directly.
+- Per-request \`enable_image_understanding\` / \`enable_video_understanding\`
+  toggles are intentionally not exposed; xAI's defaults are sensible and the
+  toggles bloat the response.
+- This skill is a slicc-native shell command — \`pi.registerTool\` does not
+  apply here. The behavior matches stnly/pi-grok's \`x_search\` tool.
+`;export{e as default};

package/dist/ui/assets/SKILL-CNdAIhbb.js

@@ -0,0 +1 @@
+var e="---\nname: package-execution\ndescription: |\n  Use this when the user asks to run or install a JavaScript/npm package with\n  `npx` or `ipx`, or to run a `package.json` script with `npm run`. Covers\n  built-in hints, any required `ipk add` bootstrap, the `--force` bypass, and\n  how script bodies resolve installed bins.\nallowed-tools: bash\n---\n\n# JavaScript package execution\n\n`ipx` runs package bins from the nearest installed `node_modules`; `npx` is an alias with the same behavior. If no local bin or installed package resolves, it normally installs the requested package and runs its bin.\n\nBefore that network install, mapped package names that duplicate SLICC built-ins redirect to the built-in instead. The command exits non-zero and prints an actionable stderr hint naming the built-in and suggesting an invocation with the original arguments. The hint may also include an exact `ipk add` bootstrap; run that bootstrap first when present, then use the suggested built-in.\n\nPrefer the built-in. To deliberately preserve install-and-run behavior for the npm package, put `--force` before its name:\n\n```bash\nnpx --force <package> [args...]\nipx --force <package> [args...]\n```\n\nAlready-installed packages, locally resolved bins, and unmapped package names keep their normal behavior. Use `commands` to discover available built-ins instead of maintaining a package mapping here.\n\n## Running package.json scripts\n\n`npm run <script>` (also `ipk run`, `npm run-script`, and the `npm test` / `start` / `stop` / `restart` shortcuts) runs a `scripts` entry from the nearest `package.json`, in that package's directory. `npm run` with no script name lists what is available — read that list instead of guessing a script name.\n\n```bash\nnpm run                      # list scripts\nnpm run build                # run build, with prebuild/postbuild around it\nnpm run build -- --watch     # pass extra args to the script body\nnpm run build --silent       # no banner, script output only (either side of the name)\nnpm run lint -- --help       # --help after -- goes to the script, not to npm\n```\n\n`--silent`/`-s` and `--if-present` are npm's own flags anywhere before `--`; everything after `--` reaches the script untouched. Missing `start` falls back to `node server.js` when the package has one, and missing `restart` to `npm stop --if-present && npm start`.\n\nA bare bin word in a script body (`vitest run`) is rewritten to `ipx vitest run` when that package is installed, because `$PATH` does not cover `node_modules/.bin` shims. This also applies after keywords like `if`/`then`/`do`. A SLICC built-in with the same name wins, and an unknown word is not installed implicitly — install it with `ipk add <pkg>` first.\n";export{e as default};

package/dist/ui/assets/SKILL-CcMg6eqt.js

@@ -0,0 +1 @@
+var e='---\nname: upgrade\ndescription: |\n  Use this when you receive an `[Upgrade Event: x.y.z→a.b.c]` lick — fired on\n  boot whenever the bundled SLICC version differs from the previous run. The\n  lick renders a binary action card: `lick_confirm` to Update workspace files\n  (three-way merge of bundled `vfs-root` files against the user\'s local edits)\n  or `lick_dismiss` to clear it. Reviewing the changelog from GitHub, and\n  checking installed skills for updates with `upskill update --dry-run`, are\n  separate steps you can run first. Never auto-applies; the user resolves the\n  card.\nallowed-tools: bash, read_file, write_file, edit_file\n---\n\n# Upgrade\n\nWhen SLICC boots and discovers that the bundled version (baked into the build at release time from the root `package.json`) differs from the version it was last seen running, it emits an `upgrade` lick to the cone. This skill describes how to react.\n\n## Event shape\n\nYou receive a message like:\n\n```text\n[Upgrade Event: 0.4.1→0.5.0]\n\nSLICC was upgraded from `0.4.1` to `0.5.0`.\nReleased: 2026-04-15T12:00:00Z\n\nUse the **upgrade** skill (...)\n```\n\nThe two version strings (`from`, `to`) are valid git tags on `https://github.com/ai-ecoverse/slicc` — the public source repository. The lick message carries a `Lick ID:` line — you resolve the card with that id.\n\n## What to do when you receive an upgrade lick\n\nThe runtime renders the upgrade lick as a binary action card automatically — you do not render a sprinkle. The card has exactly two outcomes, which you drive with the lick tools using the `Lick ID` from the message:\n\n- **`lick_confirm` → Update workspace files.** This runs `upgrade apply` with the stored release versions. Only confirm once the user has decided to pull the new files.\n- **`lick_dismiss` → clear the card.** Use this when the user wants to skip the merge; nothing is changed and the card mutes (✗). The lick will not fire again until the next upgrade.\n\nThe card flips to ✓ on confirm / muted ✗ on dismiss. Never auto-run the merge — the user must choose. Reviewing the changelog is **not** a card action; it is a separate step you can run first to help the user decide.\n\n## Which version am I running?\n\n`uname -r` prints the running version. `upgrade status` adds the last-booted one, whether a merge is pending, and the exact `upgrade apply` line to run when it is — that is where `--from`/`--to` come from without a card on screen. Realm scripts read `globalThis.SLICC_VERSION`.\n\n## Changelog review (separate step — not a card action)\n\nBefore the user decides, you can fetch the GitHub compare API for the two tags and summarize the result. This is optional and independent of the card; it does not resolve the lick.\n\n```bash\n# The repo is public — no auth required for the compare endpoint.\n# stdin here is fully buffered, so read() drains the whole response in one shot.\ncurl -sSL "https://api.github.com/repos/ai-ecoverse/slicc/compare/v${FROM_VERSION}...v${TO_VERSION}" \\\n  | node -e \'const j=JSON.parse(process.stdin.read()||"{}");console.log((j.commits||[]).map(c=>"- "+c.commit.message.split("\\n")[0]).join("\\n"))\'\n```\n\nShow the conventional-commit messages grouped by type (`feat`, `fix`, `chore`, ...). If the compare returns 404 (tags missing), fall back to the GitHub releases page URL: `https://github.com/ai-ecoverse/slicc/releases/tag/v${TO_VERSION}`.\n\n## Applying workspace files (the `lick_confirm` action)\n\n`lick_confirm` runs the browser-native command below through the cone shell using the versions stored with the lick. Do not run a second merge after confirming.\n\n```bash\nupgrade apply --from="${FROM_VERSION}" --to="${TO_VERSION}"\n```\n\nThe command discovers bundled files at both release refs under `/workspace/skills`, `/shared/sprinkles`, `/shared/sounds`, and `/etc`, plus the single file `/shared/MEMORY.md`; prefetches and preflights every path; then applies safe updates with `VirtualFS` and the built-in three-way merge. `/shared/MEMORY.md` (the memory-curator contract) and the `/etc` policy files (`sudoers`, `models`, `llmstxtignore`) are seeded only when absent, so this merge is the only way a rule change in them reaches an existing profile — including approval rules such as the `Write /etc/models` gate. Applying a change to `/etc/sudoers` still raises its own approval prompt: the card authorizes the merge, not the policy edit. Its JSON output classifies every bundled path as `auto-applied`, `merged-clean`, `kept-local`, `needs-review`, `unchanged`, or `added-new`.\n\nAn exit code of `1` means discovery/fetch failed or at least one path needs review. Conflicts are written to the reported collision-safe sidecar while the live file remains unchanged. Show the JSON summary and sidecar paths to the user; never copy conflict markers into the live file automatically. The command never deletes local-only files.\n\nThe command can also be run directly with explicit release versions for manual recovery, but an upgrade card still requires the user\'s confirmation before changing files.\n\n## Also check installed skills (separate step — not a card action)\n\nThe card only covers **bundled** files (`/workspace/skills`, `/shared/sprinkles`, `/shared/sounds`, `/shared/MEMORY.md`, `/etc`). Skills the user installed themselves with `upskill` are never touched by it, and they drift silently — a stale one can sit months behind upstream while still loading fine.\n\nA new SLICC release is a good moment to check them. This is read-only:\n\n```bash\nupskill update --dry-run\n```\n\nIt reads each skill\'s `.upskill` provenance record (written at install time: source repo, ref, resolved commit, file list) and compares the recorded commit against the ref\'s head. Skills whose commit has not moved report `already current` without downloading anything; the rest are fetched and classified with the same vocabulary as `upgrade apply` — `unchanged`, `updated`, `added`, `removed`, `kept-local`.\n\nReport what would change and let the user decide. To apply:\n\n```bash\nupskill update              # every skill with provenance\nupskill update <skill>      # just one\n```\n\nNotes worth knowing:\n\n- **Dotfiles are never touched.** `upskill` will not modify or delete a dotfile in a skill directory, so credentials (`scripts/.config`) and the `.upskill` record survive updates and `--force` reinstalls. Never hand-copy a credential file "to be safe" — it is already safe, and moving it can break the skill.\n- **`kept-local` is not a failure.** It marks dotfiles and files the user added themselves; leaving them is the correct outcome.\n- A skill installed before provenance tracking reports `no install provenance`. If the user knows where it came from, record it in place — `upskill update <skill> --from <owner>/<repo> --dry-run` first, then without `--dry-run`. That first update never deletes anything, because nothing is attributable to a previous install yet.\n\n## Do not\n\n- Do not run `upgrade apply` before the user confirms. Confirmation runs it automatically; dismissal runs nothing.\n- Do not delete files that no longer exist in the new release — many users name-collide their own scripts with bundled ones; deletion is too dangerous to automate.\n- Do not modify files outside `/workspace/skills/`, `/shared/sprinkles/`, `/shared/sounds/`, `/shared/MEMORY.md`, and `/etc/` without the user explicitly extending the scope.\n- Do not run `upskill update` (without `--dry-run`) unless the user asks for it — the dry run is the safe default when you are volunteering the check.\n- Do not advance the bundled version marker yourself. The runtime advances it automatically once this lick has been routed; if the user dismisses, the lick will not fire again until the next upgrade.\n';export{e as default};