@ai-ecoverse/slicc-bios 1.18.2 → 1.18.4

package/README.md

@@ -251,7 +251,7 @@ Seven keeps its secrets in the vault, a separate origin (`@ai-ecoverse/slicc-vau
 - **The agent's port:** for slicc-agent ≥ 4.0.0 only, each agent worker gets its own `agent`-role port, posted raw as `{ vault, scrub }` next to the agent's `{ kernel, admin }`, and again with a fresh port after the frame reloads. The agent port gets no events, so every lock change in the page port's `status` is posted to the worker as `{ locked: true | false }`. `scrub` is the last `{ needed, version, ready }` pair (`localStorage['slicc-os.vault-scrub']`, `null` before any vault connected); each new pair is posted to the worker as `{ scrub }` before seven relays the `put`, `seal` or `import` answer that caused it. Agents before 4.0.0 speak an earlier draft of that wire, so they get no port and stay inert.
 - **`/dev/sealed`:** the kernel's `sealed` hook relays each request with its kernel stamp (`caller`, unchanged) as the vault's `sealed` op, and returns its one reply. While kernel users aren't `enforce`, `materialize` and `materializeConsume` are refused with `EACCES`; under `enforce`, `materialize` is relayed like the rest, and the kernel's `materializeConsume` (`ticket`, `stamp`, `path`, `resolved`, `argv`, `cwd`, `interpreters`, `trusted`, unchanged) goes to the vault's page op of that name, whose `{ values, placeholders }` go back to the kernel only. jerk's requests (`src/seed/jerk.js`) are answered with `answer`: `jop: list` with rows from each linked device that runs jerk (J1 `list`), `jop: status` from the vault's records (exit 3 without one), `jop: create` through J1 `create` with its progress lines (exit 4 without a jerk device), `unseal` by removing the provider's `jerk:` records, and `oauth` and `jerk-seal` with exit 5 until seven signs in itself. A `cancelled` event stops a running J1 `create`.
 - **Forward (seam):** `forward` is passed through with the kernel's full stamp as `owner` (`users` included, since the vault injects only for `enforce`) and the response port transferred; the exit router's use of it is VAULT-1b's follow-up.
-- **fnox** (the optional catalog's `fnox`, wasi-fnox): every kernel process gets `FNOX_CONFIG_DIR=/etc/fnox`, sudo included, and bios writes `/etc/fnox/config.toml` once as root's `0644` (`default_provider = "seven"`, provider `seven` of type `sealed`), so cones read it and only `sudo` changes it. fnox keeps placeholders there and reaches the vault through `/dev/sealed`; while the vault frame never answered, every sealed operation fails at once with `ENOTCONN`. Use `fnox set` to change a secret (`fnox edit` is refused on WASI).
+- **fnox** (the optional catalog's `fnox`, wasi-fnox): every kernel process gets `FNOX_CONFIG_DIR=/etc/fnox`, sudo included, and bios writes `/etc/fnox/config.toml` once as root's `0644` (`default_provider = "seven"`, provider `seven` of type `sealed`), so cones read it and only `sudo` changes it. A boot skips that seed when `/etc/fnox` is already root's `0755` directory and `config.toml` a non-empty regular file, root's `0644`; any other owner, mode or type reruns it, which keeps the file's contents and repairs only its owner and mode. fnox keeps placeholders there and reaches the vault through `/dev/sealed`; while the vault frame never answered, every sealed operation fails at once with `ENOTCONN`. Use `fnox set` to change a secret (`fnox edit` is refused on WASI).
 - **Egress:** the vault's token refreshes arrive as `egress` events; seven sends them without following redirects (through its exits when the transport hands redirects back, else the page's own `fetch` with `redirect: 'manual'`), answers a redirect with an error, zeroes the request body once it's sent, and answers on the event's port within 30 s, never logging the request.
 - **Adobe IMS:** with agent ≥ 4.0.0, `login('adobe', …)` opens its popup before anything else, then seals the token as `{ kind: 'model', provider: 'adobe', name: 'ADOBE_IMS_TOKEN', source: 'oauth:adobe', expiresAt }` (the redirect's `expires_in` is in seconds, 86399 for a day) and resolves `{ sealed: true }`, so the token never reaches spectrum or the agent. IMS gives no refresh token: an expired token means signing in again, which replaces the record and keeps its placeholder. Agents before 4.0.0 get the token as before.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.18.2",
+  "version": "1.18.4",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",
@@ -43,7 +43,7 @@
   },
   "devDependencies": {
     "@ai-ecoverse/slicc": "1.44.6",
-    "@ai-ecoverse/slicc-browsers": "1.8.4",
+    "@ai-ecoverse/slicc-browsers": "1.8.5",
     "@ai-ecoverse/slicc-node": "2.5.1",
     "@ai-ecoverse/slicc-shared-web": "1.24.2",
     "@ai-ecoverse/slicc-spectrum": "1.86.4",

package/src/packages/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "slicc-bios-packages",
       "dependencies": {
-        "@ai-ecoverse/slicc-browsers": "1.8.4",
+        "@ai-ecoverse/slicc-browsers": "1.8.5",
         "@ai-ecoverse/slicc-cdp": "1.30.0",
         "@ai-ecoverse/slicc-clipboard": "1.0.2",
         "@ai-ecoverse/slicc-kernel": "1.125.9",
@@ -37,9 +37,9 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-browsers": {
-      "version": "1.8.4",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-browsers/-/slicc-browsers-1.8.4.tgz",
-      "integrity": "sha512-SQGv6pPAsMvnhNI2L7ShDukO2hD61ZZotsTq0PmBVyoglwThB3loSFdUtjUqGI3z6Ds83nZ6UBOSoJVPmqF4Uw==",
+      "version": "1.8.5",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-browsers/-/slicc-browsers-1.8.5.tgz",
+      "integrity": "sha512-Ec91bcUjUORvGzC1YQ9BJ+0N17T8pJMITcAkVSVFayO0cq5OP8T1kXrMC/LoXVqLcOjo8kmxEVsu/qkzylyNFw==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=24"

package/src/packages/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "description": "Packages the BIOS installs from npm into OPFS, pinned by package-lock.json and pnpm-lock.yaml",
   "dependencies": {
-    "@ai-ecoverse/slicc-browsers": "1.8.4",
+    "@ai-ecoverse/slicc-browsers": "1.8.5",
     "@ai-ecoverse/slicc-cdp": "1.30.0",
     "@ai-ecoverse/slicc-clipboard": "1.0.2",
     "@ai-ecoverse/slicc-kernel": "1.125.9",

package/src/packages/pnpm-lock.yaml

@@ -9,8 +9,8 @@ importers:
   .:
     dependencies:
       '@ai-ecoverse/slicc-browsers':
-        specifier: 1.8.4
-        version: 1.8.4
+        specifier: 1.8.5
+        version: 1.8.5
       '@ai-ecoverse/slicc-cdp':
         specifier: 1.30.0
         version: 1.30.0
@@ -95,8 +95,8 @@ importers:
 
 packages:
 
-  '@ai-ecoverse/slicc-browsers@1.8.4':
-    resolution: {integrity: sha512-SQGv6pPAsMvnhNI2L7ShDukO2hD61ZZotsTq0PmBVyoglwThB3loSFdUtjUqGI3z6Ds83nZ6UBOSoJVPmqF4Uw==}
+  '@ai-ecoverse/slicc-browsers@1.8.5':
+    resolution: {integrity: sha512-Ec91bcUjUORvGzC1YQ9BJ+0N17T8pJMITcAkVSVFayO0cq5OP8T1kXrMC/LoXVqLcOjo8kmxEVsu/qkzylyNFw==}
     engines: {node: '>=24'}
 
   '@ai-ecoverse/slicc-cdp@1.30.0':
@@ -200,7 +200,7 @@ packages:
 
 snapshots:
 
-  '@ai-ecoverse/slicc-browsers@1.8.4': {}
+  '@ai-ecoverse/slicc-browsers@1.8.5': {}
 
   '@ai-ecoverse/slicc-cdp@1.30.0': {}