@ai-ecoverse/slicc-bios 1.42.8 → 1.43.0

package/README.md

@@ -312,6 +312,15 @@ Seven keeps its secrets in the vault, a separate origin (`@ai-ecoverse/slicc-vau
 - **Egress:** the vault's token refreshes arrive as `egress` events; seven sends them without following redirects (through its exits when the transport hands redirects back, else the page's own `fetch` with `redirect: 'manual'`), answers a redirect with an error, zeroes the request body once it's sent, and answers on the event's port within 30 s, never logging the request.
 - **Adobe IMS:** with agent ≥ 4.0.0, `login('adobe', …)` opens its popup before anything else, then seals the token as `{ kind: 'model', provider: 'adobe', name: 'ADOBE_IMS_TOKEN', source: 'oauth:adobe', expiresAt }` (the redirect's `expires_in` is in seconds, 86399 for a day) and resolves `{ sealed: true }`, so the token never reaches spectrum or the agent. IMS gives no refresh token: an expired token means signing in again, which replaces the record and keeps its placeholder. Agents before 4.0.0 get the token as before.
 
+## Requests from programs (`/dev/embedder`)
+
+Programs ask seven's page for what only a page can do through the kernel's `/dev/embedder` (slicc-kernel ≥ 1.153.0, #1527). `src/seed/requests.js`'s `pageRequests()` is the one hook seven gives the kernel. Seven owns the list of kinds and their policies (`KINDS`), and every answer goes through the checks seven owns, whoever wrote the handler.
+- **Who answers:** the tab whose session started the process. The owner's `createKernel({ requests })` answers the page's own processes. Each tab's terminals attach with `attachKernel(port, { requests })` on a port the owner made with `connect({ requests: 'attach' })`. The agent's ports carry the owner page's hook (`kernel.connect({ tag, user, requests })`). A remote follower's shell, served by the leader, carries none, so its requests are `ENOTSUP` (`no page answers requests for this session`); they never open in the leader's browser.
+- **Gestures:** a request from a terminal tag (`{ kind: 'user', where: 'terminal:…' }`) in a tab that has just had a keystroke or click (`navigator.userActivation.isActive`) goes ahead at once. Any other request, the agent's always, waits for seven's own prompt: Cancel, or 60 s without an answer, refuses it with `EACCES`, and a signal or closed request withdraws the prompt. A session (its uid and tags) has at most one prompt up: another request from it meanwhile is refused with `EACCES`, `another request is waiting for you`. After a Cancel or a timeout the session rests for 10 s: its requests are refused with the dismissed text and no prompt, unless they come typed in an active tab. Withdrawing or timing out the prompt gives focus back to what had it.
+- **`open.url`** (`{"kind":"open.url","url":"…"}`, an empty reply) opens the URL in a new tab with `noopener,noreferrer`; `background` is ignored. Refusals, all `EACCES`, with this first line: `that isn't a URL`; `seven opens only http and https URLs` (`javascript:`, `data:`, `blob:`, `file:` and the rest); `seven doesn't open its own pages or the vault for a program` (the guard's protected origins: seven's own origin, `*.sliccy.ai` and the vault); `the request to open the page was dismissed`; `nobody answered the request to open the page within 60 s`. For example: `printf '{"kind":"open.url","url":"%s"}\n' "$url" | cat > /dev/embedder`.
+- **Tool modules** (capture, audio) export the kernel's hook object `{ kinds, handle }`. `plugged(hook, prompts)` wraps one: only kinds seven lists and gives a prompt for reach it, and its `handle` runs only after seven's gesture check, with the request unchanged. A module is a pinned dependency, since it runs as seven.
+- Kinds seven doesn't list (`open.file`, `open.download`, `open.reveal`, `clipboard.*`, capture and audio for now) are `ENOTSUP` before the page sees them.
+
 ## Network
 
 Before the kernel starts, `os/transport.js` picks how programs reach the network. The first of these that applies wins:
@@ -604,14 +613,15 @@ No test calls a real model. Every test serves an empty `packages/agent/` project
 
 [`.github/workflows/ci.yml`](.github/workflows/ci.yml) is one caller of [slicc-shared-web's pipeline](https://github.com/ai-ecoverse/slicc-shared-web#pipeline), pinned to the release `@ai-ecoverse/slicc-shared-web` has in `devDependencies` (Renovate moves both in one PR). It runs on pull requests, the merge queue and pushes to `main`:
 
+- **Pull requests:** after lint, the pipeline's `deploy` job publishes a `bb/**` branch's preview (see [Hosting](#hosting)); the tests and reviewers get its URL as `STAGING_URL`.
 - **Pull requests and the merge queue:** lint, then every `test/integration/*.test.mjs` split by the last runs' JUnit timings over 12 pool shards (`ci / integration`), then on a pull request the Claude and Codex reviews (`ci / review`) with this repository's `review-prompt`. The shared guard vectors run as one file per path (extension, proxy), target group (`seven`, `vault`, `vault-x`, `apex` and the rest, `test/integration/guard-groups.mjs`) and detach variant (`lagging` or the others), 20 files of 2 to about 12 minutes, so the split can balance them. The slicc CLI tests use `node_modules/.bin/slicc` (or `SLICC_CLI`).
-- **`main`:** semantic-release publishes the npm package (see [The npm package](#the-npm-package)). When it releases, the pipeline's `after-release` publishes that version to seven, in the `production` environment (see [Hosting](#hosting)). [`deploy.yml`](.github/workflows/deploy.yml) publishes every push to a `bb/**` branch as a preview.
+- **`main`:** semantic-release publishes the npm package (see [The npm package](#the-npm-package)). When it releases, the pipeline's `after-release` publishes that version to seven, in the `production` environment (see [Hosting](#hosting)).
 
 Require `ci / integration` and `ci / review`. There is no retry: a flaky test fails the run.
 
 ## Hosting
 
-The newest release is live at <https://seven.sliccy.ai/>, and every `bb/**` branch at `https://<branch>.sliccy.ai/`, where the branch name is lowercased and runs of anything but letters and digits become `-` (`bb/edge-hosting` → <https://bb-edge-hosting.sliccy.ai/>). Other branches, Renovate's included, get no preview. Each host is its own origin, so a branch gets its own OPFS and service worker and can't disturb `seven`. `https://www.sliccy.ai/7/` serves the same `seven/` next to SLICC 6 (sliccy-ai#51, see [Next to SLICC 6](#next-to-slicc-6-wwwsliccyai7)).
+The newest release is live at <https://seven.sliccy.ai/>, and every pull request from a `bb/**` branch at `https://<branch>.sliccy.ai/`, where the branch name is lowercased and runs of anything but letters and digits become `-` (`bb/edge-hosting` → <https://bb-edge-hosting.sliccy.ai/>). Other branches, Renovate's included, get no preview. Each host is its own origin, so a branch gets its own OPFS and service worker and can't disturb `seven`. `https://www.sliccy.ai/7/` serves the same `seven/` next to SLICC 6 (sliccy-ai#51, see [Next to SLICC 6](#next-to-slicc-6-wwwsliccyai7)).
 
 The hosts are served by the [sliccy-ai](https://github.com/ai-ecoverse/sliccy-ai) worker from the R2 bucket `slicc-bios`. This repo only publishes into that bucket:
 
@@ -619,8 +629,8 @@ The hosts are served by the [sliccy-ai](https://github.com/ai-ecoverse/sliccy-ai
 - The bucket expires everything under `branches/` 30 days after upload. Every push uploads all files again, so a branch stays up while it's active and disappears a month after its last push. Nothing needs to be cleaned up when a branch is deleted.
 - **seven** is published only by a release. On a push to `main`, the pipeline's release job runs semantic-release in the `production` environment, and when that tags a new `v<version>` its `after-release` command runs `edge/publish.mjs main`, which uploads `seven/`. A push that releases nothing (`chore:`, `ci:`, `docs:`, `test:` and the like) publishes nothing, so a change that only matters to seven needs a `fix:` or `feat:` commit to go live. A release job is never cancelled by a newer one.
   - The upload uses `SLICC_BIOS_DEPLOY_TOKEN`, an account token with Workers R2 Storage Write, handed to wrangler as `CLOUDFLARE_API_TOKEN`. That token could overwrite `seven/`, so it lives only in the `production` environment, whose deployment branch policy allows `main` alone, and `ci.yml` gives it only to the release job (`release-secrets`). The pipeline keeps its own `CLOUDFLARE_API_TOKEN`, the reviewers' screenshot token, out of `after-release`, hence the separate name.
-- [`.github/workflows/deploy.yml`](.github/workflows/deploy.yml) publishes every push to a `bb/**` branch, on `ubuntu-latest`. A newer push to the branch cancels its running publish.
-  - **A `bb/**` branch** holds no secret. It runs in the `preview` environment, with no approval step and `id-token: write`. `edge/publish.mjs` asks GitHub for the job's OIDC token (audience `https://sliccy.ai`) and publishes through the sliccy-ai worker's `/api/publish/*` route. The route checks the token's signature, issuer, audience, expiry, repository and branch, then derives `branches/<label>/` from the branch itself. A branch can only ever write its own prefix, and never `seven/`. It first writes a manifest listing both the previous upload's files and this one's, so a publish cancelled midway leaves every file it uploaded on the list for the next publish to delete. Then files go up eight at a time, then deletions, then the final manifest.
+- **A preview** is published by the pipeline's `deploy` job on every pull request, in the `staging` environment, with `id-token: write`. It runs `edge/publish.mjs preview`, which publishes the pull request's merge commit when its branch (`GITHUB_HEAD_REF`) is a `bb/**` branch, writes the URL to the job's `url` output, and skips everything else: other branches, and a pull request from a fork, which gets no OIDC token. A publish that fails (the route refuses it or can't be reached) writes `preview failed: <reason>` to the job summary and sets no URL, so the tests and reviews still run; none of them needs `STAGING_URL`. A push to a branch without a pull request publishes nothing. A newer push cancels the running CI, its publish included.
+  - **A preview** holds no secret: `ci.yml` sets no `deploy-secrets`, and the pipeline (from v2.12.0) passes the deploy job only the secrets that input names, so it gets none. `edge/publish.mjs` asks GitHub for the job's OIDC token (audience `https://sliccy.ai`) and publishes through the sliccy-ai worker's `/api/publish/*` route. The route checks the token's signature, issuer, audience, expiry, repository, the `staging` environment and the `refs/pull/<n>/merge` ref, then derives `branches/<label>/` from the token's `head_ref`. A branch can only ever write its own prefix, and never `seven/`. It first writes a manifest listing both the previous upload's files and this one's, so a publish cancelled midway leaves every file it uploaded on the list for the next publish to delete. Then files go up eight at a time, then deletions, then the final manifest.
 
 ## Rules
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.42.8",
+  "version": "1.43.0",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",
@@ -43,15 +43,15 @@
   },
   "devDependencies": {
     "@ai-ecoverse/slicc": "1.49.3",
-    "@ai-ecoverse/slicc-browsers": "1.18.7",
+    "@ai-ecoverse/slicc-browsers": "1.18.12",
     "@ai-ecoverse/slicc-cdp": "1.41.4",
     "@ai-ecoverse/slicc-node": "2.5.1",
-    "@ai-ecoverse/slicc-shared-web": "2.12.0",
+    "@ai-ecoverse/slicc-shared-web": "2.12.1",
     "@ai-ecoverse/slicc-spectrum": "1.104.1",
     "@ai-ecoverse/slicc-vault": "1.16.4",
     "@biomejs/biome": "2.5.15",
     "es-module-lexer": "3.0.4",
-    "fake-indexeddb": "6.2.5",
+    "fake-indexeddb": "6.2.6",
     "lefthook": "2.2.2",
     "modern-tar": "0.8.6",
     "monocart-coverage-reports": "2.13.2",

package/src/packages/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "slicc-bios-packages",
       "dependencies": {
-        "@ai-ecoverse/slicc-browsers": "1.18.1",
+        "@ai-ecoverse/slicc-browsers": "1.18.12",
         "@ai-ecoverse/slicc-cdp": "1.41.4",
         "@ai-ecoverse/slicc-clipboard": "1.1.1",
         "@ai-ecoverse/slicc-kernel": "1.159.4",
@@ -38,9 +38,9 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-browsers": {
-      "version": "1.18.1",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-browsers/-/slicc-browsers-1.18.1.tgz",
-      "integrity": "sha512-D5C6nZlDnLhnFwPUc7sYKSvzFLJLgl++DNSit/Pq4IHTC/gsDQd7aQuQmseWyJcR23ma/nQRAezPie2D+A3oHQ==",
+      "version": "1.18.12",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-browsers/-/slicc-browsers-1.18.12.tgz",
+      "integrity": "sha512-zAa68AbuzW435nuINYyNstXai1EsofC1Qx8F5DkNOibTiRu3APEnG20hQ+kKzRlkXMnwwwhfAgk1HH07gjEGnw==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=24"

package/src/packages/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "description": "Packages the BIOS installs from npm into OPFS, pinned by package-lock.json and pnpm-lock.yaml",
   "dependencies": {
-    "@ai-ecoverse/slicc-browsers": "1.18.1",
+    "@ai-ecoverse/slicc-browsers": "1.18.12",
     "@ai-ecoverse/slicc-cdp": "1.41.4",
     "@ai-ecoverse/slicc-clipboard": "1.1.1",
     "@ai-ecoverse/slicc-kernel": "1.159.4",

package/src/packages/pnpm-lock.yaml

@@ -9,8 +9,8 @@ importers:
   .:
     dependencies:
       '@ai-ecoverse/slicc-browsers':
-        specifier: 1.18.1
-        version: 1.18.1
+        specifier: 1.18.12
+        version: 1.18.12
       '@ai-ecoverse/slicc-cdp':
         specifier: 1.41.4
         version: 1.41.4
@@ -98,8 +98,8 @@ importers:
 
 packages:
 
-  '@ai-ecoverse/slicc-browsers@1.18.1':
-    resolution: {integrity: sha512-D5C6nZlDnLhnFwPUc7sYKSvzFLJLgl++DNSit/Pq4IHTC/gsDQd7aQuQmseWyJcR23ma/nQRAezPie2D+A3oHQ==}
+  '@ai-ecoverse/slicc-browsers@1.18.12':
+    resolution: {integrity: sha512-zAa68AbuzW435nuINYyNstXai1EsofC1Qx8F5DkNOibTiRu3APEnG20hQ+kKzRlkXMnwwwhfAgk1HH07gjEGnw==}
     engines: {node: '>=24'}
 
   '@ai-ecoverse/slicc-cdp@1.41.4':
@@ -215,7 +215,7 @@ packages:
 
 snapshots:
 
-  '@ai-ecoverse/slicc-browsers@1.18.1': {}
+  '@ai-ecoverse/slicc-browsers@1.18.12': {}
 
   '@ai-ecoverse/slicc-cdp@1.41.4': {}