@ai-ecoverse/slicc-bios 1.51.21 → 1.51.24

package/README.md

@@ -397,7 +397,9 @@ The choice is in `document.documentElement.dataset.transport`: `extension` or `p
 
 Programs in the kernel drive a browser over the Chrome DevTools Protocol: `playwright-cli` and `curlwright` ([slicc-cdp](https://github.com/ai-ecoverse/slicc-cdp), in the base set) or anything else that reads `SLICC_CDP_URL`. The kernel's facade on `127.0.0.1:9222` takes connections only from programs inside the kernel. `playwright-cli route`, `route-list` and `unroute` (slicc-cdp ≥ 1.10.0) fulfil or change a tab's requests through `Fetch` on that tab's session while a command runs. A pattern that names a protected host is refused, and a request to a protected origin is never routed. slicc-cdp ≥ 1.11.2 keeps the protected origins out of reach on its own side too: `tab-list` leaves protected tabs out, a command that names one with `--tab` exits 1, `open` and `goto` refuse protected URLs, and a tab it touches can't load a protected document (a script, link, meta refresh or redirect into one gets Chrome's error page). It hands each one to the `cdp` hook that `os/cdp.js` gives `createKernel`, and the hook connects it to a host:
 
-1. **[slicc-extension](https://github.com/ai-ecoverse/slicc-extension):** when the extension defines `sliccExtension.cdp`, its `chrome.debugger` bridge drives the Chrome that seven runs in. Every program connection shares the page's one extension port. The hook gives each connection only the answers to its own commands and the events of the sessions it attached, and on close it detaches every session the connection attached.
+1. **[slicc-extension](https://github.com/ai-ecoverse/slicc-extension):** browser automation through the extension requires **7.10.0 or later**. When a supported extension defines `sliccExtension.cdp`, its `chrome.debugger` bridge drives the Chrome that seven runs in. Every program connection shares the page's one extension port. The hook gives each connection only the answers to its own commands and the events of the sessions it attached, and on close it detaches every session the connection attached.
+
+An older extension, or one that cannot report a supported release version, refuses browser automation with `slicc: refused: Update slicc-extension to use browser automation in seven. Reload this tab after updating.` Fetch and sign-in remain available.
 
 **Seven's own pages and the vault are out of reach.** Every connection, whether through the extension or a linked browser, goes through a guard (`guardProtected` in `os/guard.js`), so no program in the kernel can drive, read or close a protected tab. What is protected comes from [slicc-browsers](https://github.com/ai-ecoverse/slicc-browsers#protected-origins)' `protectedOrigins` (in the base set): every `sliccy.ai` host, the vault (`vault.sliccy.ai`), `blob:`, `filesystem:` and `view-source:` URLs by the URL inside them, and `devtools:`, plus seven's own origin. A blank popup or frame (`about:blank`, `about:srcdoc`) is protected when its opener is protected or unknown, or when it was protected before. Seven's own pages can show files from OPFS that the user or the agent wrote, and the vault holds the user's secrets.
 - **Hidden targets:** `Target.getTargets` and the target events leave protected targets out.
@@ -408,7 +410,7 @@ Programs in the kernel drive a browser over the Chrome DevTools Protocol: `playw
 - **Requests from protected documents:** a request whose URL, document, frame, initiator, `Referer` or `Origin` is protected never reaches the program. The guard continues its `Fetch` pause itself, drops its `Network` events, and refuses its bodies (`Network.getResponseBody`, `getRequestPostData`, `Fetch.getResponseBody` and the like). Bodies, `replayXHR` and `Fetch` replies for a request the guard hasn't seen are refused too. Extra-info events that come before their request wait up to 2 s for it, then are dropped.
 - **Flat sessions only:** `Target.attachToTarget` and `Target.setAutoAttach` need `flatten: true`. `Target.sendMessageToTarget`, `Target.attachToBrowserTarget` and `Target.exposeDevToolsProtocol` are refused, so no command can be tunnelled past the guard.
 
-- **Known limit:** extensions that refuse `Target.setAutoAttach` (including 7.6.x) leave an ordinary page with a cross-site iframe locked for paint, DOM, CSS, accessibility and input. The guard fails closed when it cannot place the child.
+- **Known limit:** extensions that refuse `Target.setAutoAttach` leave an ordinary page with a cross-site iframe locked for paint, DOM, CSS, accessibility and input. The guard fails closed when it cannot place the child.
 
 **Sign-in tabs are held for life (#754).** A sign-in popup shows its token or code in its URL and on the IdP's pages, and the guard can't scrub a page's own content. So the owner tab holds every sign-in tab from the moment it opens. A held tab is never listed, attached, auto-attached or reported to a program on any origin, until it closes. Its events, `urlFragment` included, never reach the program.
 - **Seven's own sign-in:** the popup opens on `about:blank#slicc-sign-in-<nonce>`. bios asks the owner over the `slicc-held` BroadcastChannel to hold it. The owner finds that target by its marker URL on each browser host (slicc-extension), holds it, and only then is the popup sent to the IdP. The owner answers `held` once it has held the tab on every listed host, `none` when no host is listed, and `unheld` otherwise, including when a listed host can't be opened. On `unheld`, on `none` while bios sees a host, or on no answer within 6 s while a host is connected, the sign-in stops before the IdP and says so; it never goes on unheld. On `none`, the sign-in goes on, and the owner keeps it as in flight for 11 minutes (in `localStorage`, `slicc-os.sign-in-flight`, so a reload keeps it). Before any program gets a browser connection, the owner sweeps every host: it holds sign-in tabs still on `about:blank`, and while a sign-in is in flight, every page a protected page opened. So a host that connects in the middle of a sign-in never sees its tab.
@@ -420,7 +422,7 @@ Programs in the kernel drive a browser over the Chrome DevTools Protocol: `playw
 
 A tab a program creates through the guard opens in the background, behind seven, unless it passes `background: false`. A program that needs seven to keep rendering should open tabs, the default, and not `newWindow`: even unfocused, a new window can cover seven's window, and Chrome then throttles seven ([slicc-extension#105](https://github.com/ai-ecoverse/slicc-extension/issues/105)).
 
-A program picks a host by adding `runtime=extension`, or a linked browser's `<device>/<browser>`, to the query of the URL it opens (`playwright-cli --runtime extension`). With no runtime, the extension goes first, then a linked browser. The hook never derives a URL from the request: it reaches only the extension's page global and the linked browsers.
+A program picks a host by adding `runtime=extension`, or a linked browser's `<device>/<browser>`, to the query of the URL it opens (`playwright-cli --runtime extension`). With no runtime, a supported extension goes first, then a linked browser. If an installed extension is unsupported, automatic selection refuses with the update-and-reload message rather than silently using a linked browser; update the extension or name the linked browser explicitly with `--runtime <device>/<browser>`. The hook never derives a URL from the request: it reaches only the extension's page global and the linked browsers.
 
 **No consent dialog.** A connection goes straight through once the hook has found a host; seven doesn't ask first. The once-per-session confirm from #138 was removed by Lars's decision W10. The Network panel shows the host in its browser automation line (`browser` on the network port, from `browserVia`): through the extension, through a linked browser, or not available.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.51.21",
+  "version": "1.51.24",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",
@@ -51,10 +51,10 @@
   "devDependencies": {
     "@ai-ecoverse/slicc": "1.49.33",
     "@ai-ecoverse/slicc-browsers": "1.18.21",
-    "@ai-ecoverse/slicc-cdp": "1.42.8",
+    "@ai-ecoverse/slicc-cdp": "1.42.10",
     "@ai-ecoverse/slicc-shared-web": "2.13.7",
     "@ai-ecoverse/slicc-spectrum": "1.107.2",
-    "@ai-ecoverse/slicc-vault": "1.17.0",
+    "@ai-ecoverse/slicc-vault": "1.17.2",
     "@biomejs/biome": "2.6.2",
     "aws4fetch": "1.0.20",
     "es-module-lexer": "3.0.4",

package/src/packages/agent/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "description": "SLICC's agent, which the UI installs with pnpm in the background into /opt/agent in OPFS",
   "dependencies": {
-    "@ai-ecoverse/slicc-agent": "7.8.13",
+    "@ai-ecoverse/slicc-agent": "7.8.15",
     "@ai-ecoverse/slicc-kernel": "1.170.1"
   }
 }

package/src/packages/agent/pnpm-lock.yaml

@@ -14,19 +14,19 @@ importers:
   .:
     dependencies:
       '@ai-ecoverse/slicc-agent':
-        specifier: 7.8.13
-        version: 7.8.13(@ai-ecoverse/slicc-kernel@1.170.1)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
+        specifier: 7.8.15
+        version: 7.8.15(@ai-ecoverse/slicc-kernel@1.170.1)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
       '@ai-ecoverse/slicc-kernel':
         specifier: 1.170.1
         version: 1.170.1
 
 packages:
 
-  '@ai-ecoverse/jerk-oauth@1.3.0':
-    resolution: {integrity: sha512-dbCU1KgYns8lP8IUCWbvCxQxCFSiVxuEYViu4CcnxphcrL9gltTvPdBpQOfAduU80GQTU3H4CMjGwuCo6EGNhg==}
+  '@ai-ecoverse/jerk-oauth@1.3.2':
+    resolution: {integrity: sha512-BLDMsojkewl82/05mQoEdWpGg4YT04KWVWcpb0TLTKIUcjfJ98GUi7vAE9Q2eDAFAlDlzpRXDCr1dSxqwiJazQ==}
 
-  '@ai-ecoverse/slicc-agent@7.8.13':
-    resolution: {integrity: sha512-jmxcJJaW+dyW2QGzR7y6m4oXrZezTO38HpNnWgADQsDH1XCn/EM6fIn/IcmHKD785OGA/atZ7e0xX2hJQnwtkA==}
+  '@ai-ecoverse/slicc-agent@7.8.15':
+    resolution: {integrity: sha512-ogLqsyasVb/b7p4FA+i4W9X1UJ82S5qm/2cyPelLWTWPMMpkU0tZppjWYxnOJyoV4uKT1aFUpLfDfTJtezB2MQ==}
     engines: {node: '>=24'}
     peerDependencies:
       '@ai-ecoverse/slicc-kernel': '>=1.110.0 <2'
@@ -47,8 +47,8 @@ packages:
     resolution: {integrity: sha512-HZ5qVnVez4B2UTP+UrHbYg6GnHJjpT09byt/HHJ8Y0IRk13q5Oj8rFFCme+R0T5h42ZlmwaNVI+n77VtSaCtuA==}
     engines: {node: '>=24'}
 
-  '@ai-ecoverse/slicc-vault@1.17.0':
-    resolution: {integrity: sha512-mG6CEviDcEnpumTxNIMR7yLF8SYW6VtrVOhABcjOgyvWLGNN/dN6YmhOezHJMNlP2kMF7MX+hSlu3LNS+wH7Ow==}
+  '@ai-ecoverse/slicc-vault@1.17.2':
+    resolution: {integrity: sha512-Zu0YooQmW/Fhieqz73vmPdzKfplPU1Ar88WIRC7/rMNTd1lut3JLywoTKgq0MI4I/G6a2n55D8r03rm5fGgv3A==}
     engines: {node: '>=24'}
 
   '@anthropic-ai/sdk@0.129.0':
@@ -331,8 +331,8 @@ packages:
   typebox@1.3.27:
     resolution: {integrity: sha512-zu+jc1pcy4UiNThxikUr36f0Rybk9PEeCg/NE6adeWr/SKsdNO4EzZHYRDlv2YCVAfj3Odq3dESSo/jNyoBXzA==}
 
-  typebox@1.4.2:
-    resolution: {integrity: sha512-eSoZzgSIyOKDtTH9MI7XMAxMaiXq7UiSFWarysN1ka66baTLDxAVdQ6WkWn6qDqsJFVrcjzvuP+CqHo9yrlQpg==}
+  typebox@1.4.3:
+    resolution: {integrity: sha512-u3nyf7ZciAv1GOijVpI0TDt9At5wmEi7lSHSlRrnjuThv1DcB7fgGBqqrz+fGZ54jAfTpOOX0JXwxSIg3pnxQA==}
 
   which@2.0.2:
     resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
@@ -353,13 +353,13 @@ packages:
 
 snapshots:
 
-  '@ai-ecoverse/jerk-oauth@1.3.0': {}
+  '@ai-ecoverse/jerk-oauth@1.3.2': {}
 
-  '@ai-ecoverse/slicc-agent@7.8.13(@ai-ecoverse/slicc-kernel@1.170.1)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
+  '@ai-ecoverse/slicc-agent@7.8.15(@ai-ecoverse/slicc-kernel@1.170.1)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)':
     dependencies:
       '@ai-ecoverse/slicc-browsers': 1.18.21
       '@ai-ecoverse/slicc-kernel': 1.170.1
-      '@ai-ecoverse/slicc-vault': 1.17.0
+      '@ai-ecoverse/slicc-vault': 1.17.2
       '@aws-sdk/middleware-websocket': 3.972.54
       '@earendil-works/chord': 1.4.0
       '@earendil-works/pi-ai': 1.4.0(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)(ws@8.22.0)
@@ -368,7 +368,7 @@ snapshots:
       '@earendil-works/pi-mcp': 1.4.0
       '@earendil-works/pi-telemetry': 1.4.0
       '@sqlite.org/sqlite-wasm': 3.53.4-build2
-      typebox: 1.4.2
+      typebox: 1.4.3
     transitivePeerDependencies:
       - '@aws-sdk/credential-provider-node'
       - '@modelcontextprotocol/sdk'
@@ -386,9 +386,9 @@ snapshots:
 
   '@ai-ecoverse/slicc-scrub@1.1.0': {}
 
-  '@ai-ecoverse/slicc-vault@1.17.0':
+  '@ai-ecoverse/slicc-vault@1.17.2':
     dependencies:
-      '@ai-ecoverse/jerk-oauth': 1.3.0
+      '@ai-ecoverse/jerk-oauth': 1.3.2
       '@ai-ecoverse/slicc-scrub': 1.1.0
 
   '@anthropic-ai/sdk@0.129.0':
@@ -766,7 +766,7 @@ snapshots:
 
   typebox@1.3.27: {}
 
-  typebox@1.4.2: {}
+  typebox@1.4.3: {}
 
   which@2.0.2:
     dependencies: