@ai-ecoverse/slicc-bios 1.44.4 → 1.44.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -0
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -21,6 +21,8 @@ The kernel's root is the OPFS root, so any file a kernel process writes, such as
|
|
|
21
21
|
|
|
22
22
|
The live content also carries `Content-Security-Policy: frame-ancestors 'self'` and `X-Frame-Options: SAMEORIGIN`, so only seven's own pages can frame it. That leaves no clickjacking and no framed captures of seven by another site. The hosting sends the same headers for the files it serves itself (sliccy-ai#22).
|
|
23
23
|
|
|
24
|
+
Seven's documents are never kept in the back/forward cache. The service worker sends every HTML document it serves from OPFS (seven's own pages and sandboxed files alike), and the BIOS page when it's a document navigation, with `Permissions-Policy: unload=(self)` and `Cache-Control: no-store`. The BIOS page, `/os/` (`os/start.js`, which stays import-free so an uncontrolled `/os/` still reaches the BIOS) and the guest page (`os/join.js`) each keep an `unload` listener, and Chrome doesn't cache a page with one (`UnloadHandlerExistsInMainFrame`). As a belt, a page that is restored anyway (`pageshow` with `persisted`) reloads itself. `no-store` alone doesn't keep a page out of the cache on current Chrome, which restores no-store pages unless cookies change. `bfcache.test.mjs` goes back to `/os/` from another page and fails with *BFCache exclusion lost: only the guard protects seven now* if Chrome restores it or stops naming the unload handler.
|
|
25
|
+
|
|
24
26
|
Every other OPFS file is served sandboxed: `Content-Security-Policy: sandbox allow-scripts allow-forms allow-popups allow-modals; frame-ancestors 'self'` (without `allow-same-origin`), `X-Content-Type-Options: nosniff`, `Cross-Origin-Resource-Policy: same-origin`, and no COOP or COEP. An HTML page there still renders and runs its scripts, but in an opaque origin, with no access to seven's IndexedDB, `localStorage`, OPFS or keys. JavaScript and TypeScript files there are served as `text/plain` and wasm as `application/octet-stream`, and a request for a script, a worker or a worklet there gets a 403, so none of seven's pages can import, run or instantiate them. Bare imports are resolved only in the live paths. Kernel symlinks live in the kernel's metadata, not in OPFS, so the service worker never follows one. The kernel itself reads binaries from OPFS directly, not through the service worker.
|
|
25
27
|
|
|
26
28
|
### Next to SLICC 6 (`www.sliccy.ai/7`)
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ai-ecoverse/slicc-bios",
|
|
3
|
-
"version": "1.44.
|
|
3
|
+
"version": "1.44.5",
|
|
4
4
|
"description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -48,7 +48,7 @@
|
|
|
48
48
|
"@ai-ecoverse/slicc-node": "2.5.1",
|
|
49
49
|
"@ai-ecoverse/slicc-shared-web": "2.12.1",
|
|
50
50
|
"@ai-ecoverse/slicc-spectrum": "1.104.1",
|
|
51
|
-
"@ai-ecoverse/slicc-vault": "1.
|
|
51
|
+
"@ai-ecoverse/slicc-vault": "1.17.0",
|
|
52
52
|
"@biomejs/biome": "2.5.15",
|
|
53
53
|
"aws4fetch": "1.0.20",
|
|
54
54
|
"es-module-lexer": "3.0.4",
|