@ai-ecoverse/slicc-bios 1.44.4 → 1.44.6

package/README.md

@@ -21,6 +21,8 @@ The kernel's root is the OPFS root, so any file a kernel process writes, such as
 
 The live content also carries `Content-Security-Policy: frame-ancestors 'self'` and `X-Frame-Options: SAMEORIGIN`, so only seven's own pages can frame it. That leaves no clickjacking and no framed captures of seven by another site. The hosting sends the same headers for the files it serves itself (sliccy-ai#22).
 
+Seven's documents are never kept in the back/forward cache. The service worker sends every HTML document it serves from OPFS (seven's own pages and sandboxed files alike), and the BIOS page when it's a document navigation, with `Permissions-Policy: unload=(self)` and `Cache-Control: no-store`. The BIOS page, `/os/` (`os/start.js`, which stays import-free so an uncontrolled `/os/` still reaches the BIOS) and the guest page (`os/join.js`) each keep an `unload` listener, and Chrome doesn't cache a page with one (`UnloadHandlerExistsInMainFrame`). As a belt, a page that is restored anyway (`pageshow` with `persisted`) reloads itself. `no-store` alone doesn't keep a page out of the cache on current Chrome, which restores no-store pages unless cookies change. `bfcache.test.mjs` goes back to `/os/` from another page and fails with *BFCache exclusion lost: only the guard protects seven now* if Chrome restores it or stops naming the unload handler.
+
 Every other OPFS file is served sandboxed: `Content-Security-Policy: sandbox allow-scripts allow-forms allow-popups allow-modals; frame-ancestors 'self'` (without `allow-same-origin`), `X-Content-Type-Options: nosniff`, `Cross-Origin-Resource-Policy: same-origin`, and no COOP or COEP. An HTML page there still renders and runs its scripts, but in an opaque origin, with no access to seven's IndexedDB, `localStorage`, OPFS or keys. JavaScript and TypeScript files there are served as `text/plain` and wasm as `application/octet-stream`, and a request for a script, a worker or a worklet there gets a 403, so none of seven's pages can import, run or instantiate them. Bare imports are resolved only in the live paths. Kernel symlinks live in the kernel's metadata, not in OPFS, so the service worker never follows one. The kernel itself reads binaries from OPFS directly, not through the service worker.
 
 ### Next to SLICC 6 (`www.sliccy.ai/7`)
@@ -370,7 +372,7 @@ Programs in the kernel drive a browser over the Chrome DevTools Protocol: `playw
 **Sign-in tabs are held for life (#754).** A sign-in popup shows its token or code in its URL and on the IdP's pages, and the guard can't scrub a page's own content. So the owner tab holds every sign-in tab from the moment it opens. A held tab is never listed, attached, auto-attached or reported to a program on any origin, until it closes. Its events, `urlFragment` included, never reach the program.
 - **Seven's own sign-in:** the popup opens on `about:blank#slicc-sign-in-<nonce>`. bios asks the owner over the `slicc-held` BroadcastChannel to hold it. The owner finds that target by its marker URL on each browser host, the extension and slicc-node, holds it, and only then is the popup sent to the IdP. The owner answers `held` once it has held the tab on every listed host, `none` when no host is listed, and `unheld` otherwise, including when a listed host can't be opened. On `unheld`, on `none` while bios sees a host, or on no answer within 6 s while a host is connected, the sign-in stops before the IdP and says so; it never goes on unheld. On `none`, the sign-in goes on, and the owner keeps it as in flight for 11 minutes (in `localStorage`, `slicc-os.sign-in-flight`, so a reload keeps it). Before any program gets a browser connection, the owner sweeps every host: it holds sign-in tabs still on `about:blank`, and while a sign-in is in flight, every page a protected page opened. So a host that connects in the middle of a sign-in never sees its tab.
 - **The guard decides by itself, too:** a page that a held tab opened is held, on any URL, and so are its own popups in turn, and so are the frames and workers of a held tab (`parentId`). A page seven (or another protected page) opened with opener access (`canAccessOpener`), or that is still on `about:blank`, is held the first time any guard sees it.
-- **Other sign-in tabs:** a watcher in the owner tab holds every page that a protected page (seven or the vault) opened and that is still on `about:blank`, and a popup that a held tab opens, such as the IdP's own. **Through slicc-node** it connects when the owner boots and takes target events, so it holds an unmarked popup from its creation, before any program has connected. **Through slicc-extension** it only polls every 250 ms once a program or a sign-in needs the browser, and the extension reports no opener access, so only marked popups are held reliably there: an unmarked popup that leaves `about:blank` before the next poll can be missed, and a program could then list it, URL and fragment included (a known gap). Seven's own Adobe sign-in carries the marker. The agent's MCP OAuth and device-code popups carry it only from the slicc-agent release with #550, which isn't pinned yet.
+- **Other sign-in tabs:** a watcher in the owner tab holds every page that a protected page (seven or the vault) opened and that is still on `about:blank`, and a popup that a held tab opens, such as the IdP's own. **Through slicc-node** it connects when the owner boots and takes target events, so it holds an unmarked popup from its creation, before any program has connected. **Through slicc-extension** it only polls every 250 ms once a program or a sign-in needs the browser, and the extension reports no opener access, so only marked popups are held reliably there: an unmarked popup that leaves `about:blank` before the next poll can be missed, and a program could then list it, URL and fragment included (a known gap). Seven's own Adobe sign-in carries the marker. The agent's MCP OAuth and device-code popups carry it from slicc-agent 6.19.15 (#550), which seven pins: they ask on `slicc-held` and navigate only on `held` or `none`, so on both hosts they are held before they leave `about:blank`, and with no holder answering the agent's sign-in fails.
 - **Kept:** held tab ids are kept in `localStorage` (`slicc-os.held-targets`, the 32 most recently held or seen again), so a reload of the owner keeps them.
 - **The watcher's connections:** on slicc-extension it connects only once a program or a sign-in needs the browser. On slicc-node it connects when the owner boots, so an owner boot takes slicc-node's browser from another page driving it through the same slicc-node (a known, functional only). If another page then takes it back, the watcher doesn't fight it, and reconnects when the next program connects. Before any program gets a browser connection, the owner sweeps every host; if that listing fails, the program gets no connection, and no host connection is opened for it.
 - **A tab only lent seven's protection** is one that seven opened with no opener access, or that inherited it only from about:blank. It becomes drivable once it commits an ordinary `http:`, `https:` or `data:` page, whether the program saw it at creation or later. Real protected origins stay protected for life, a `blob:` of seven's origin included.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.44.4",
+  "version": "1.44.6",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",
@@ -48,7 +48,7 @@
     "@ai-ecoverse/slicc-node": "2.5.1",
     "@ai-ecoverse/slicc-shared-web": "2.12.1",
     "@ai-ecoverse/slicc-spectrum": "1.104.1",
-    "@ai-ecoverse/slicc-vault": "1.16.4",
+    "@ai-ecoverse/slicc-vault": "1.17.0",
     "@biomejs/biome": "2.5.15",
     "aws4fetch": "1.0.20",
     "es-module-lexer": "3.0.4",

package/src/packages/agent/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "description": "SLICC's agent, which the UI installs with pnpm in the background into /opt/agent in OPFS",
   "dependencies": {
-    "@ai-ecoverse/slicc-agent": "6.18.3",
+    "@ai-ecoverse/slicc-agent": "6.19.15",
     "@ai-ecoverse/slicc-kernel": "1.160.3"
   }
 }

package/src/packages/agent/pnpm-lock.yaml

@@ -14,16 +14,19 @@ importers:
   .:
     dependencies:
       '@ai-ecoverse/slicc-agent':
-        specifier: 6.18.3
-        version: 6.18.3(@ai-ecoverse/slicc-kernel@1.160.3)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
+        specifier: 6.19.15
+        version: 6.19.15(@ai-ecoverse/slicc-kernel@1.160.3)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
       '@ai-ecoverse/slicc-kernel':
         specifier: 1.160.3
         version: 1.160.3
 
 packages:
 
-  '@ai-ecoverse/slicc-agent@6.18.3':
-    resolution: {integrity: sha512-CeWbIv/Ysf62MapzUlUyPGVRL/1+2fgaE0icotkF85Nqbap4PFPApbowG953r+MapsxfC9i/FUa4+3tMlJUXGA==}
+  '@ai-ecoverse/jerk-oauth@1.2.2':
+    resolution: {integrity: sha512-Sen/HPtSrvwUG4qJ72/x3QOuX0oVkYM/0PgpPkmaQhMaiXmOsKTnSzNyNWhbcsMgoCS5QTD0mkh8POOAaj2dXg==}
+
+  '@ai-ecoverse/slicc-agent@6.19.15':
+    resolution: {integrity: sha512-kGBEcUqrqcf/KMKZre7myhHWMFIER9iVm25kHxS1/gZ2e5SmMrjqUZWoSXnhw+/5g/Myjb0LncCe+1WoQe0U3A==}
     engines: {node: '>=24'}
     peerDependencies:
       '@ai-ecoverse/slicc-kernel': '>=1.110.0 <2'
@@ -32,16 +35,20 @@ packages:
       '@ai-ecoverse/slicc-spectrum':
         optional: true
 
-  '@ai-ecoverse/slicc-browsers@1.9.2':
-    resolution: {integrity: sha512-WVaDUiZbd5nwG03+2WoQ8YA8ATC2mkx1DRCWpLuMFBNnyN0cd5IRoGF6KYNjMkXvBQCvZZxP+gwffrpmHYJ/cQ==}
+  '@ai-ecoverse/slicc-browsers@1.18.7':
+    resolution: {integrity: sha512-rStBLMAR6a/WkvVr12auMtZ4ofEqIa/PARv8QvHucLBYH+Ubgoj1BPChwRfSwWC537kv+3cc1YwaMSEm3fhPFg==}
     engines: {node: '>=24'}
 
   '@ai-ecoverse/slicc-kernel@1.160.3':
     resolution: {integrity: sha512-PC9VCRpT68N8CNwbvhEAI7ypiQQ7a53c6u+CZ+ppWvC9dmyjDIRk4CCMkqpoeW8jVMMRBkOsPrDrW4Vp9xkK+g==}
     engines: {node: '>=26'}
 
-  '@ai-ecoverse/slicc-vault@1.15.1':
-    resolution: {integrity: sha512-qr1Pmw7lodtjiQgWkKgGcfbG63H61eHba4XBKXPlGYrRkYJ0vLTts1x82wYS6H6V4FaqAtLfdunwNvT0riz2CQ==}
+  '@ai-ecoverse/slicc-scrub@1.0.0':
+    resolution: {integrity: sha512-Z7maJhs0YmsbdcnVdLZocZrzA2x/iGp1in/+sZ4NBHy8BCZim0nvky3jRCcpCPoqceAreQt7ynfezCqkkeR/VQ==}
+    engines: {node: '>=24'}
+
+  '@ai-ecoverse/slicc-vault@1.15.4':
+    resolution: {integrity: sha512-XH41wPIotEir4VGjmwHiKawr/PoJB15NOTKn46Hdv4vgkvHk3Xj77e5/VJVUf99TIOMLEyLYKx1PbTG3KfR9NQ==}
     engines: {node: '>=24'}
 
   '@anthropic-ai/sdk@0.129.0':
@@ -346,11 +353,13 @@ packages:
 
 snapshots:
 
-  '@ai-ecoverse/slicc-agent@6.18.3(@ai-ecoverse/slicc-kernel@1.160.3)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
+  '@ai-ecoverse/jerk-oauth@1.2.2': {}
+
+  '@ai-ecoverse/slicc-agent@6.19.15(@ai-ecoverse/slicc-kernel@1.160.3)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
     dependencies:
-      '@ai-ecoverse/slicc-browsers': 1.9.2
+      '@ai-ecoverse/slicc-browsers': 1.18.7
       '@ai-ecoverse/slicc-kernel': 1.160.3
-      '@ai-ecoverse/slicc-vault': 1.15.1
+      '@ai-ecoverse/slicc-vault': 1.15.4
       '@aws-sdk/middleware-websocket': 3.972.54
       '@earendil-works/chord': 1.3.0
       '@earendil-works/pi-ai': 1.3.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
@@ -370,11 +379,16 @@ snapshots:
       - ws
       - zod
 
-  '@ai-ecoverse/slicc-browsers@1.9.2': {}
+  '@ai-ecoverse/slicc-browsers@1.18.7': {}
 
   '@ai-ecoverse/slicc-kernel@1.160.3': {}
 
-  '@ai-ecoverse/slicc-vault@1.15.1': {}
+  '@ai-ecoverse/slicc-scrub@1.0.0': {}
+
+  '@ai-ecoverse/slicc-vault@1.15.4':
+    dependencies:
+      '@ai-ecoverse/jerk-oauth': 1.2.2
+      '@ai-ecoverse/slicc-scrub': 1.0.0
 
   '@anthropic-ai/sdk@0.129.0':
     dependencies: