@ai-ecoverse/slicc-bios 1.51.37 → 1.52.0

package/README.md

@@ -381,7 +381,7 @@ Before the kernel starts, `os/transport.js` picks how programs reach the network
 Seven reads no local proxy: a `#proxy=` or `#key=` in the address is taken out before anything loads and never used or stored, and a proxy an older seven kept in IndexedDB (`slicc-os`, store `transport`) is deleted. A small script at the top of the page also takes `#tailscale=`, its `exit=` and `#slicc-pair=` out of the address before anything else loads. It keeps them in local storage under a fresh id and leaves only `#handoff=<id>` in the address, and the boot reads them from there. Once seven has read them, and also when the boot fails, the entry and the id are removed, together with any entry older than 10 minutes. If they can't be stored, the address is still tidied and the values are dropped.
 
 1. **[slicc-extension](https://github.com/ai-ecoverse/slicc-extension):** when the extension defines `globalThis.sliccExtension`, the kernel uses `fetchTransport({ fetch: sliccExtension.fetch })`, with `traits.crossOrigin: 'any'`: the extension's fetch isn't bound by CORS, so the agent offers the providers that need a CORS-free transport (Kimi, Cerebras) there too.
-2. **The page's own `fetch`:** `fetchTransport()`, bound by CORS. A request CORS stops is answered `502` with a hint to run `npx sliccy@next` (the slicc CLI, until `sliccy`'s `latest` is the new CLI) or install slicc-extension, which `curl` prints.
+2. **The page's own `fetch`:** `fetchTransport()`, bound by CORS. It drops `User-Agent` first: Chrome ignores that header on `fetch`, but WebKit preflights it, and npm's registry refuses the preflight, so `pnpm` could reach nothing there. A request CORS stops is answered `502` with a hint to run `npx sliccy@next` (the slicc CLI, until `sliccy`'s `latest` is the new CLI) or install slicc-extension, which `curl` prints.
 
 A response body that sends nothing for 120 s on the extension or the page fetch fails with `ETIMEDOUT`, so a stalled download doesn't hang. ntfy (ntfy.sh and the tray's ntfy gateway) sends a keepalive every 45 s, so after one missed keepalive the next byte comes at 90 s plus the network's latency; 120 s leaves 30 s of slack beyond that, so a quiet long-lived stream (`ntfy sub`, server-sent events, a long poll) survives it. The bound isn't lifted, because a body that Chrome stops handing over under load must still end. The installer's own idle detector, which re-fetches a stalled tarball, stays at 30 s.
 
@@ -399,9 +399,11 @@ Programs in the kernel drive a browser over the Chrome DevTools Protocol: `playw
 
 1. **[slicc-extension](https://github.com/ai-ecoverse/slicc-extension):** browser automation through the extension requires **7.10.0 or later**. When a supported extension defines `sliccExtension.cdp`, its `chrome.debugger` bridge drives the Chrome that seven runs in. Every program connection shares the page's one extension port. The hook gives each connection only the answers to its own commands and the events of the sessions it attached, and on close it detaches every session the connection attached.
 
+2. **The browser's own DevTools port:** a browser can offer a page of an origin it allows a CDP endpoint, as `crestDevTools.webSocketDebuggerUrl` (Crest does, on iOS and the Mac), and announce it with the `crestdevtools` event when it arrives after the page started. Seven reads the endpoint each time it connects, because it changes when the port reopens, and opens one socket per program connection, with flat sessions. It says `Slicc.action` first, which tells the browser this client dispatches its own input when none lands, so nothing is delivered twice. A port whose pages can't report child frames answers `Target.setAutoAttach` with *not found*. Seven passes that to the guard as the extension's refusal, so a page whose iframe the port reports stays locked for paint, DOM and input, and a page without one works. **Known limit:** a frame in a closed shadow root is listed in the frame tree but has no document node, so the guard reads it as an ordinary child frame. Its URL is still checked: a protected one refuses the whole tab, and a frame that moves to one cuts the session. An unprotected one isn't locked, and `Page.captureScreenshot` and `Page.printToPDF` show its pixels. Such a browser also leaves seven's own pages out of its listing and refuses navigation into them. The guard still runs on every connection, so the rules below hold whatever the browser does.
+
 An older extension, or one that cannot report a supported release version, refuses browser automation with `slicc: refused: Update slicc-extension to use browser automation in seven. Reload this tab after updating.` Fetch and sign-in remain available.
 
-**Seven's own pages and the vault are out of reach.** Every connection, whether through the extension or a linked browser, goes through a guard (`guardProtected` in `os/guard.js`), so no program in the kernel can drive, read or close a protected tab. What is protected comes from [slicc-browsers](https://github.com/ai-ecoverse/slicc-browsers#protected-origins)' `protectedOrigins` (in the base set): every `sliccy.ai` host, the vault (`vault.sliccy.ai`), `blob:`, `filesystem:` and `view-source:` URLs by the URL inside them, and `devtools:`, plus seven's own origin. A blank popup or frame (`about:blank`, `about:srcdoc`) is protected when its opener is protected or unknown, or when it was protected before. Seven's own pages can show files from OPFS that the user or the agent wrote, and the vault holds the user's secrets.
+**Seven's own pages and the vault are out of reach.** Every connection, whether through the extension, a DevTools port or a linked browser, goes through a guard (`guardProtected` in `os/guard.js`), so no program in the kernel can drive, read or close a protected tab. What is protected comes from [slicc-browsers](https://github.com/ai-ecoverse/slicc-browsers#protected-origins)' `protectedOrigins` (in the base set): every `sliccy.ai` host, the vault (`vault.sliccy.ai`), `blob:`, `filesystem:` and `view-source:` URLs by the URL inside them, and `devtools:`, plus seven's own origin. A blank popup or frame (`about:blank`, `about:srcdoc`) is protected when its opener is protected or unknown, or when it was protected before. Seven's own pages can show files from OPFS that the user or the agent wrote, and the vault holds the user's secrets.
 - **Hidden targets:** `Target.getTargets` and the target events leave protected targets out.
 - **Refused commands** answer an error: any command whose `targetId` or `frameId` is a protected target (the guard asks for the target's current URL first) (`Target.attachToTarget`, `activateTarget`, `closeTarget`, `getTargetInfo`, `Browser.getWindowForTarget` and the rest, with or without a session); any command whose `url`, origin (`origin`, `securityOrigin`, `ownerOrigin`, `topLevelSite`, `scopeURL` and the like), `storageKey`, `cacheId` or cookie `domain` is protected, at any depth of its parameters, which covers navigation, `IndexedDB.*`, `CacheStorage.*`, `DOMStorage.*`, `Storage.*`, `ServiceWorker.*` and cookie writes; `Network.clearBrowserCookies`, `Storage.clearCookies`, `ServiceWorker.stopAllWorkers`, `BackgroundService.clearEvents`, `Storage.getPrivateVerificationTokens` and `Tracing.start`, which reach every origin; `Network.loadNetworkResource`, which follows redirects the guard can't see; `IO.read` and `IO.close` on a stream the guard didn't hand out in an answer; a `ServiceWorker` command for a registration or version the guard hasn't shown; `Target.detachFromTarget` of a session the connection didn't attach; and every `Fetch.*` command without a tab session, so nothing can pause the whole browser. Free-form values such as `expression` or `headers` aren't searched.
 - **Filtered answers and events:** cookie lists leave out cookies whose domain is protected and partitioned cookies under a protected site. `Storage`, `DOMStorage`, `IndexedDB`, `CacheStorage` and `BackgroundService` events that name a protected origin are dropped, and so are service worker registrations and versions on one.
@@ -413,7 +415,7 @@ An older extension, or one that cannot report a supported release version, refus
 - **Known limit:** extensions that refuse `Target.setAutoAttach` leave an ordinary page with a cross-site iframe locked for paint, DOM, CSS, accessibility and input. The guard fails closed when it cannot place the child.
 
 **Sign-in tabs are held for life (#754).** A sign-in popup shows its token or code in its URL and on the IdP's pages, and the guard can't scrub a page's own content. So the owner tab holds every sign-in tab from the moment it opens. A held tab is never listed, attached, auto-attached or reported to a program on any origin, until it closes. Its events, `urlFragment` included, never reach the program.
-- **Seven's own sign-in:** the popup opens on `about:blank#slicc-sign-in-<nonce>`. bios asks the owner over the `slicc-held` BroadcastChannel to hold it. The owner finds that target by its marker URL on each browser host (slicc-extension), holds it, and only then is the popup sent to the IdP. The owner answers `held` once it has held the tab on every listed host, `none` when no host is listed, and `unheld` otherwise, including when a listed host can't be opened. On `unheld`, on `none` while bios sees a host, or on no answer within 6 s while a host is connected, the sign-in stops before the IdP and says so; it never goes on unheld. On `none`, the sign-in goes on, and the owner keeps it as in flight for 11 minutes (in `localStorage`, `slicc-os.sign-in-flight`, so a reload keeps it). Before any program gets a browser connection, the owner sweeps every host: it holds sign-in tabs still on `about:blank`, and while a sign-in is in flight, every page a protected page opened. So a host that connects in the middle of a sign-in never sees its tab.
+- **Seven's own sign-in:** the popup opens on `about:blank#slicc-sign-in-<nonce>`. bios asks the owner over the `slicc-held` BroadcastChannel to hold it. The owner finds that target by its marker URL on each browser host (slicc-extension, a DevTools port), holds it, and only then is the popup sent to the IdP. The owner answers `held` once it has held the tab on every listed host, `none` when no host is listed, and `unheld` otherwise, including when a listed host can't be opened. On `unheld`, on `none` while bios sees a host, or on no answer within 6 s while a host is connected, the sign-in stops before the IdP and says so; it never goes on unheld. On `none`, the sign-in goes on, and the owner keeps it as in flight for 11 minutes (in `localStorage`, `slicc-os.sign-in-flight`, so a reload keeps it). Before any program gets a browser connection, the owner sweeps every host: it holds sign-in tabs still on `about:blank`, and while a sign-in is in flight, every page a protected page opened. So a host that connects in the middle of a sign-in never sees its tab.
 - **The guard decides by itself, too:** a page that a held tab opened is held, on any URL, and so are its own popups in turn, and so are the frames and workers of a held tab (`parentId`). A page seven (or another protected page) opened with opener access (`canAccessOpener`), or that is still on `about:blank`, is held the first time any guard sees it.
 - **Other sign-in tabs:** a watcher in the owner tab holds every page that a protected page (seven or the vault) opened and that is still on `about:blank`, and a popup that a held tab opens, such as the IdP's own. It goes through slicc-extension and only polls every 250 ms once a program or a sign-in needs the browser, and the extension reports no opener access, so only marked popups are held reliably there: an unmarked popup that leaves `about:blank` before the next poll can be missed, and a program could then list it, URL and fragment included (a known gap). Seven's own Adobe sign-in carries the marker. The agent's MCP OAuth and device-code popups carry it from slicc-agent 6.19.15 (#550), which seven pins: they ask on `slicc-held` and navigate only on `held` or `none`, so they are held before they leave `about:blank`, and with no holder answering the agent's sign-in fails.
 - **Kept:** held tab ids are kept in `localStorage` (`slicc-os.held-targets`, the 32 most recently held or seen again), so a reload of the owner keeps them.
@@ -422,11 +424,11 @@ An older extension, or one that cannot report a supported release version, refus
 
 A tab a program creates through the guard opens in the background, behind seven, unless it passes `background: false`. A program that needs seven to keep rendering should open tabs, the default, and not `newWindow`: even unfocused, a new window can cover seven's window, and Chrome then throttles seven ([slicc-extension#105](https://github.com/ai-ecoverse/slicc-extension/issues/105)).
 
-A program picks a host by adding `runtime=extension`, or a linked browser's `<device>/<browser>`, to the query of the URL it opens (`playwright-cli --runtime extension`). With no runtime, a supported extension goes first, then a linked browser. If an installed extension is unsupported, automatic selection refuses with the update-and-reload message rather than silently using a linked browser; update the extension or name the linked browser explicitly with `--runtime <device>/<browser>`. The hook never derives a URL from the request: it reaches only the extension's page global and the linked browsers.
+A program picks a host by adding `runtime=extension`, `runtime=devtools`, or a linked browser's `<device>/<browser>`, to the query of the URL it opens (`playwright-cli --runtime extension`). With no runtime, a supported extension goes first, then a DevTools port, then a linked browser. If an installed extension is unsupported, automatic selection refuses with the update-and-reload message rather than silently using a linked browser; update the extension or name the linked browser explicitly with `--runtime <device>/<browser>`. The hook never derives a URL from the request: it reaches only the extension's page global, the browser's own endpoint and the linked browsers.
 
-**No consent dialog.** A connection goes straight through once the hook has found a host; seven doesn't ask first. The once-per-session confirm from #138 was removed by Lars's decision W10. The Network panel shows the host in its browser automation line (`browser` on the network port, from `browserVia`): through the extension, through a linked browser, or not available.
+**No consent dialog.** A connection goes straight through once the hook has found a host; seven doesn't ask first. The once-per-session confirm from #138 was removed by Lars's decision W10. The Network panel shows the host in its browser automation line (`browser` on the network port, from `browserVia`): through the extension, through this browser's DevTools port (`devtools`), through a linked browser, or not available.
 
-When no host can drive a browser, `/json/list` and the WebSocket handshake answer `502` with `CDP host: no browser to drive: install slicc-extension, or link a computer with npx sliccy@next`. A runtime that isn't `extension` or a linked browser gets `CDP host: unknown runtime "<name>" (extension, …)`, listing the linked browsers. `/json/version` answers either way, since a hook is always offered.
+When no host can drive a browser, `/json/list` and the WebSocket handshake answer `502` with `CDP host: no browser to drive: install slicc-extension, or link a computer with npx sliccy@next`. A runtime that isn't `extension`, `devtools` or a linked browser gets `CDP host: unknown runtime "<name>" (extension, devtools, …)`, listing the linked browsers. `/json/version` answers either way, since a hook is always offered.
 
 ### Tailscale (proof of concept)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.51.37",
+  "version": "1.52.0",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",