@ai-ecoverse/slicc-bios 1.41.5 → 1.42.0

package/README.md

@@ -200,7 +200,7 @@ The Files panel lists `/opt/grammars/node_modules` but doesn't scan it.
 
 **Release notes (slicc-spectrum#458):** each update check also gives the Kernel, UI, Agent and Tailscale rows a `releases` list from their GitHub repositories (`slicc-kernel`, `slicc-spectrum`, `slicc-agent`, `wasm-tailscale`), and each optional package one from the repository its npm version document names, when that is on GitHub ([`os/releases.js`](src/seed/releases.js)). A row gets the release it has installed and every newer one up to the version it offers, newest first, at most 30. Each release has its `version` (the tag without the `v`, or without the package's name in a shared repository such as homescoop), its `url` and its `notes`, the release body unchanged (the `<!-- cert-verify -->` block included, which spectrum turns into a Certified badge) up to 64 KB. Spectrum renders the notes; bios only fetches them. bios asks GitHub's unauthenticated API (`/repos/<repo>/releases?per_page=100`, page by page down to the installed version, at most 5 pages), without credentials, a referrer or any header but `Accept` and `If-None-Match`. It keeps each list in IndexedDB (`slicc-releases`) for a day and revalidates it with its ETag at every check, and GitHub doesn't count a 304 against its 60 requests an hour. A 403 or 429 backs off until `Retry-After`, the rate limit's reset or 15 minutes, and leaves `releases` out, so the row looks as it does without notes, with no error. The page sets no `connect-src`, so these requests need no change to its CSP.
 
-Below the system rows, Install / Update offers **Optional packages** (spectrum ≥ 1.42.0): tools that seven doesn't preinstall. Seven pins only what UI boot and the agent install need (Lars, 2026-10-21), so every catalog package comes at npm's `latest`, behind [the gate](#optional-packages). A release passes when npm's provenance shows its publisher's release workflow built it on `main`. homescoop publishes its packages (`wasm-*`, `wasi-*`, `wasix-*`) through its ladder. The other publishers are slicc-jsh, mcpcat, slicc-cli (wasi-slicc) and slicc-cdp (sliccy-browser), and the catalog names each one's repository and workflow in its `source`. The catalog, [`src/packages/optional/catalog.json`](src/packages/optional/catalog.json), lists each package by its npm name, with only what npm can't tell: its `id` and `label`, and optionally `requires` (other ids), `notes` (bios's own caveats, one line each, shown next to npm's description), `helpers` (commands to leave out of the list until homescoop marks them `helper: true`), `range` and `abi` (Python's, below), `source` (a publisher other than homescoop: its `repo` and release `workflow`, and optionally `since`, the first version it certifies, and `deny`, versions it never certifies, each with a reason) and `kind: "project"`. A project keeps its `description`, `commands` and `size`, since npm doesn't know it.
+Below the system rows, Install / Update offers **Optional packages** (spectrum ≥ 1.42.0): tools that seven doesn't preinstall. Seven pins only what UI boot and the agent install need (Lars, 2026-10-21), so every catalog package comes at npm's `latest`, behind [the gate](#optional-packages). A release passes when npm's provenance shows its publisher's release workflow built it on `main`. homescoop publishes its packages (`wasm-*`, `wasi-*`, `wasix-*`) through its ladder. The other publishers are slicc-jsh, mcpcat, slicc-cli (wasi-slicc) and slicc-cdp (sliccy-browser), and the catalog names each one's repository and workflow in its `source`. The catalog, [`src/packages/optional/catalog.json`](src/packages/optional/catalog.json), lists each package by its npm name, with only what npm can't tell: its `id` and `label`, and optionally `requires` (other ids), `notes` (bios's own caveats, one line each, shown next to npm's description), `helpers` (commands to leave out of the list until homescoop marks them `helper: true`), `range` and `abi` (Python's, below), `source` (a publisher other than homescoop: its `repo` and the list of release `workflow`s it accepts) and `kind: "project"`. A project keeps its `description`, `commands` and `size`, since npm doesn't know it.
 
 - **What npm tells (`os/packages.js`):** at boot, and at an update check at most every ten minutes, bios fetches each entry's version doc from the registry from the page (`https://registry.npmjs.org/<name>/latest`, which sends CORS `*`; the kernel's network path isn't needed), all in parallel and each with a 15-second timeout. It takes `version` (the row's `offered`), `description` (npm's text, verbatim), the commands (the keys of `slicc.commands`, without one marked `helper: true` or listed in `helpers`, and only names a shell can run), `dist.unpackedSize` (the row's `size`, now what the package unpacks to on disk, its own files only, so git reads 56 MB where the old tarball-based size read 19 MB; the row says `unpacked: true`) and `dist.integrity`. An entry with a `range` (Python's is `3.15.0`) takes the highest version in range from the abbreviated packument instead, where the range is matched against the upstream X.Y.Z with homescoop's `-N` build ignored, so `3.15.0` offers 3.15.0-3 but never a 3.15.1 or 3.16 (pydata's builds are for one Python ABI: homescoop keeps the ABI within one X.Y.Z, and its py-* ranges stop at the next patch). With `abi`, a version whose `slicc.python.abi` differs isn't offered.
 - **Cache:** the last good answer for each entry is kept in `var/lib/slicc/optional/npm.json`, so the panel works offline and shows at once at boot; a later fetch replaces it, an entry that fails keeps its cached answer, and holds only what the rows show. A passing provenance verdict is remembered only in the tab's memory, for the listing (never a refusal, never in OPFS, which kernel processes can write, and never for an install, which always asks npm again).
@@ -208,12 +208,12 @@ Below the system rows, Install / Update offers **Optional packages** (spectrum
 - **The gate** (one function, `gate()` in `os/packages.js`, for the panel's Install and Update, a user's Update and [Your packages](#your-packages)) checks every package in the lock pnpm made. Each must be one of:
   - an exact `name@version` with that integrity in the base set's lockfile (`src/packages/package-lock.json`) or `src/packages/certs.json`; or
   - an `@ai-ecoverse/*` package whose locked integrity equals the registry's `dist.integrity` for that exact version, and that npm's stored SLSA v1 provenance (`dist.attestations`, which bios trusts as npm stores it) binds to that integrity (its subject's sha512) and to its publisher's repository and release workflow at `refs/heads/main`. The publisher is bios's own, never read from npm:
-    - a catalog entry's `source`: slicc-jsh's, mcpcat's and slicc-cli's (for wasi-slicc) own `release.yml`, or their `ci.yml` since they moved onto slicc-shared-web's pipeline, and slicc-cdp's `publish-sliccy-browser.yml` for sliccy-browser;
+    - a catalog entry's `source`: slicc-jsh's, mcpcat's and slicc-cli's (for wasi-slicc) own `release.yml`, or their `ci.yml` since they moved onto slicc-shared-web's pipeline, and slicc-cdp's `publish-sliccy-browser.yml` or `ci.yml` for sliccy-browser;
     - otherwise homescoop's `ladder-build.yml` or `publish.yml` for the `wasm-*`, `wasi-*`, `wasix-*` and `py-*` packages;
-    - and [`sources.json`](src/packages/optional/sources.json) for a dependency-only publisher: slicc-cdp, under sliccy-browser, whose rule is `certified: "tag"`, its npm dist-tag `certified` (from the abbreviated packument), since its main released versions its cert-review didn't pass.
+    - and [`sources.json`](src/packages/optional/sources.json) for a dependency-only publisher: slicc-cdp, under sliccy-browser, by its own `release.yml` or `ci.yml`. No npm dist-tag is read: a `certified` tag neither admits nor refuses a release.
     
     A release from another repository, another workflow or another ref (a maintenance branch, a tag) is refused, and so is a package with no publisher there.
-  - A source's `deny` and `since` refuse those versions, exact matches included: wasi-slicc 1.44.4 and everything before 1.44.1.
+  - A release npm marks deprecated is refused, with npm's message ("… is deprecated on npm: …"). An owner who wants a version refused deprecates it. That covers a `certs.json` exact match too, unless the base set's lockfile ships that version: bios asks npm for it, and refuses it when npm deprecates it or doesn't have it. wasi-slicc 1.44.4 and everything before 1.44.1 are refused this way.
   - Whatever matched, homescoop's certification exceptions then apply, exact matches included: a `fail` verdict refuses that version, and a `requires` verdict refuses it unless every pin of what it requires, in the lock and the base set's lockfile (never `certs.json`'s history), is in range. bios bundles `certification-exceptions.json` at the homescoop commit `pins.test.mjs` pins ([`exceptions.json`](src/packages/optional/exceptions.json); `pins.test` keeps it byte for byte that file) and unions it with homescoop main's (`raw.githubusercontent.com`, CORS `*`), which can only deny or constrain, never grant: a tampered or missing live file is at worst a denial, and the bundled copy decides alone when it can't be fetched. Finally a package whose `engines['slicc-kernel']` or kernel peer range the base set's kernel doesn't meet is refused.
   - Anything that isn't `@ai-ecoverse/*` and isn't in the base set is refused; homescoop packages have no third-party dependencies.
 - **Listing:** each entry's latest goes through the same rules (with its exact `dependencies`) when it's fetched. If latest fails, bios walks back through older versions (in range, not deprecated, at most five; a version whose doc is broken is skipped) and offers the newest that passes, with `newer: { version, reason }` naming latest's blocker. If none passes, the row is `withheld` with that reason, offers no Install or Update, and an installed copy keeps Remove.
@@ -437,9 +437,16 @@ seven can also join a tailnet, with a patched build of Tailscale's wasm client (
       - **Chat (`pi`):** with View, the follower opens `OPEN { kind: 'pi' }` and gets the owner's agent, the same replicated chat a follower tab has. The owner bridges the stream to `owner.port({ readOnly, pages: false, device })` with slicc-agent's `bridgePort` (agent ≥ 3.32.0; `device`, the link's id, from 5.9.0), read-only unless the device has Control, and without `pages`, so a follower's agent can't drive the owner's panels. The follower builds its `AgentConnection` with `linkEndpoint` and `connectAgent`, and spectrum's agent model on top. The stream carries slicc-agent's frames: a `u32` length, a `u8` tag (data, hello or close) and the payload. Without Control, a send, steer or stop is refused by the owner's agent with `EACCES`, and the chat shows that it watches only. Changing Control resets the stream, so the follower reconnects with the new access, and losing View resets it with `EACCES`. The follower installs `/opt/agent` itself, for `page.js` and the agent model, in a kernel it starts only for that install. Linked devices shows *Watching* while a follower's chat is open. A failed connection is tried again after 2 s, except when the owner runs another agent version: `connectAgent` then rejects with `EVERSION` (slicc-agent ≥ 5.5.2), and the follower shows the agent's sentence as bios's own warning (`follow:other-agent-version`, not dismissable) and makes no further attempt in that follow session. Meanwhile its follow port's state carries the sentence as `refused` (spectrum ≥ 1.85.0): the top-bar light turns neutral and reads *Can’t follow <owner>*, the chat drops its *Watch only* note, and the page stays read-only. A later follow session that connects clears it, and the warning with it.
       - **Terminals (`terminal`):** with View and Terminal, the follower's Terminal panel opens shells in the owner's kernel. Each one is `OPEN { kind: 'terminal', cols, rows, cwd? }`, and the owner runs `bash -i` there with its own terminals' prompt, as the same user its own terminals use (root today, so Terminal is a root shell on the owner's SLICC), and answers OPENED `{ pid }`. Both directions then carry records, each a `u32` length, a `u8` type and a payload: `0` terminal bytes, `1` a resize as `{ cols, rows }` JSON, `2` a signal name (`INT`, `TSTP`, `QUIT`, `HUP`), and, from the owner only, `3` the shell's exit status as a decimal string, just before END. A bad record or size resets the stream with `EPROTO` or `EINVAL`. The follower's END closes the shell, and the owner ends the stream when the shell exits. Linked devices shows *Terminal open* while one runs (`terminals`), and turning Terminal or View off resets every open shell with `EACCES`.
       - **Names:** both sides call themselves `SLICC on <platform>` (`navigator.userAgentData.platform`). When two show the same name, the first four hex digits of the certificate fingerprint are added.
-    - **Sevens this kernel follows (the in-kernel `slicc`):** the optional `slicc` package (`@ai-ecoverse/wasi-slicc`, slicc-cli's client commands built for `wasip1`) runs `slicc <join-url> prompt|watch|abort` in seven's terminal against another seven's agent, as slicc-cli's README specifies in §1.4 and §5.16. The program never touches WebRTC, the hub or the join state: it reaches the page's **link facade** at `SLICC_LINK_URL` (`tcp://127.0.0.1:7400`), which `os/os.js` declares with `createKernel({ facades: { link: { port: 7400, hook } } })` (`os/facade.js`, slicc-kernel ≥ 1.90.0), and the page follows that seven's tray for it (`os/leaders.js`).
+    - **Sevens this kernel follows (the in-kernel `slicc`):** the optional `slicc` package (`@ai-ecoverse/wasi-slicc`, slicc-cli's client commands built for `wasip1`) runs `slicc <join-url> prompt|watch|abort` in seven's terminal against another seven's agent, and `slicc tray` against this seven's own tray, as slicc-cli's README specifies in §1.4 and §5.16. The program never touches WebRTC, the hub or the join state: it reaches the page's **link facade** at `SLICC_LINK_URL` (`tcp://127.0.0.1:7400`), which `os/os.js` declares with `createKernel({ facades: { link: { port: 7400, hook } } })` (`os/facade.js`, slicc-kernel ≥ 1.90.0), and the page follows that seven's tray for it (`os/leaders.js`).
       - **Who may:** only under kernel users `enforce`, and only root and members of `sudo` (cones), as the kernel's stamp on the connection says. A scoop gets `EACCES` and a `connect` denial in `denials.log`; under `off` and `report` everyone gets `EACCES`.
       - **The facade:** one connection per stream, in records of a `u8` type (`1` control, `2` data, `3` end), a `u32` length and the payload. The first record is `{ v: 1, join, open }`, and the page answers `{ opened }` or `{ reset: 'ERRNO: message' }`. Only `kind: 'agent'` with `prompt`, `watch` or `abort` opens, with only the fields those take. A long prompt (`length`) is answered at once, read whole, and sent on with the length of what it became. After that, only a `reset` may come as control, and it passes on just its errno.
+      - **This seven's own tray (`slicc tray`):** a first record `{ v: 1, open: { kind: 'tray', op } }`, with no `join`, gets one control record, `{ opened }` or a `reset`, and the page closes the connection (`os/facade.js`, `trayRequests`).
+        - **`status`:** `{ tray, error?, hub?, exit, devices }`. `tray` is the tray's state. `hub` is the hub's origin. `exit` is the Network port's exit. `devices` keeps only `id`, `name`, `kind`, `host`, `address`, `mode`, `offers`, `policy`, `exit`, `state` and `access`. It never carries the join, follow or webhook URL or `joinCommand`; any of those inside `error` reads `<join-url>`.
+        - **`url`:** `{ url }`, the join URL, while the tray is `ready`; otherwise `ENOTCONN`. It's the only answer with the join URL.
+        - **`rotate`, `unlink` and `retry`:** go to the Network port's `rotateJoinUrl`, `unlink` and `retryLinks`, then answer `{}`. `unlink` takes a device's exact `id`, else `ENOENT`; slicc matches prefixes.
+        - **Refusals:** another op, a `join`, or `unlink` without an `id` is `EINVAL`. A seven without a tray answers `EOPNOTSUPP`.
+        - **Approval:** from a caller who isn't root, `url`, `rotate` and `unlink` wait for the owner. They go into bios's own approvals as `{ kind: 'tray', op, requester, device?, createdAt, expiresAt }`, which spectrum shows as "Share this seven's join URL?", "Make a new join URL?" or "Unlink {device}?". There is no Always allow. Only Allow once approves. Deny, or 5 minutes without an answer, is `EACCES: the owner didn't approve this`. A caller who hangs up withdraws its request, and an approval that arrives after it left runs nothing. Root, `status` and `retry` aren't asked.
+        - **Tests:** `test/integration/tray-cli.test.mjs` runs the real `slicc tray` from the catalog in seven's terminal. It covers list, `--json`, `url` (root not asked, a cone approved and denied), `rotate`, `retry`, `unlink` by prefix, a hung-up `rotate` withdrawn, a scoop refused, and a raw `status` answer with no join or webhook URL.
       - **Secrets:** while the vault holds values, every outgoing prompt passes its scrubber (`redact`, on an agent-role port of the page's own), so a value leaves as its placeholder. While the scrubber is locked, the answer is `EACCES: unlock the vault to continue`.
       - **The link:** the page attaches as runtime `slicc-link/1`, so the other seven treats it as a CLI: it needs **Allow remote control** for this device in its Linked devices. The other seven decides that on every stream, so a grant counts on the next run without a new link, and its `EACCES` reaches `slicc` with that hint. The page's HELLO has `caps: []` and a fresh `node`, it opens only `agent` streams, and it refuses every stream the other seven opens with `EACCES`.
       - **Following:** there is one link per join URL. The first run dials it (45 s, with retries after 1, 2 and 5 s while it waits). From then on, the owner tab follows that seven: it keeps the link up, dials it again when it drops, with a backoff of 1, 2, 5, 10, 30 and then 60 s, and dials every kept leader again when seven boots. While nothing waits on it, a dial asks the hub once and backs off when that seven isn't on its tray, instead of polling. A tab hidden for 10 minutes stops dialling until it's shown or a run needs the link.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.41.5",
+  "version": "1.42.0",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",
@@ -50,7 +50,7 @@
     "@ai-ecoverse/slicc-spectrum": "1.104.1",
     "@ai-ecoverse/slicc-vault": "1.16.1",
     "@biomejs/biome": "2.5.15",
-    "es-module-lexer": "3.0.3",
+    "es-module-lexer": "3.0.4",
     "fake-indexeddb": "6.2.5",
     "lefthook": "2.2.1",
     "modern-tar": "0.8.5",