@ai-ecoverse/slicc-bios 1.52.1 → 1.52.2

package/README.md

@@ -112,7 +112,7 @@ A kernel process can still write to `/os/` and `/node_modules/` (any process whi
 - **Changes:** what agents changed in git repositories, by repository, with the diff and **Accept** or **Revert** per change or for all (slicc-agent ≥ 3.21.1, spectrum ≥ 1.37.0). It sits next to the Freezer, closed by default, and opens from the rail or View. Git isn't preinstalled, so until someone runs `pnpm add -g @ai-ecoverse/wasm-git` it says so and shows that command.
 - **Freezer:** every conversation in the session database (slicc-agent ≥ 3.23.0, spectrum ≥ 1.39.0). Live cones show **Open**. A cone deleted with **Delete cone** in Agents (which asks first), an earlier chat left by New chat, or a stopped scoop or agent run stays there with its title, model, kind and message count. **Thaw** brings it back as a cone, and the row then says what it was thawed as. **Remove**, which asks first, deletes its working folders; the conversation stays in the database.
 - **Settings:** the theme, the model, thinking, diffs, and the Bedrock and Adobe accounts. Below Accounts, **MCP servers** lists every server in the agent's `mcp.json` with its state, and **Add server** adds one without a terminal: a name, an `https:` URL and whether it uses a token (slicc-agent ≥ 7.11.0, spectrum ≥ 1.108.0). The agent writes the file for the page's owner, `0600 root:root`, and an entry it refuses, such as a literal secret, shows its reason in the form and writes nothing. **Remove** takes a server out; to change one, remove it and add it again. The file stays the advanced route from a root terminal: with kernel users on, as on production, the agent reads `/etc/slicc/agent/mcp.json` and ignores a `~/.pi/agent/mcp.json` in any home; with users off (`#users=off`) it reads `/home/.pi/agent/mcp.json`. For a server whose headers use a `${NAME}` placeholder, or one added with a token, **Connect** takes the token (slicc-agent ≥ 3.33.0, spectrum ≥ 1.50.0). A server without an `Authorization` header that answers 401 needs an OAuth sign-in: its row reads *Needs sign-in* with **Sign in**, or *Sign-in expired* (slicc-agent ≥ 3.36.0, spectrum ≥ 1.54.0), which opens a pop-up on the server's authorization server. The agent registers `https://<origin>/oauth/mcp-callback` as its redirect URI, and the service worker serves that path from the agent's `dist/oauth/mcp-callback.html` in `/opt/agent`, which hands the code back over `BroadcastChannel('slicc-mcp-oauth')`, clears its address and closes. Tool cards label MCP calls `server · tool`. The agent's `models` command lists the models of the connected accounts and switches the caller's model (slicc-agent ≥ 3.34.0).
-- **Keeping seven's files:** at the first chat send in a page session, `os/storage.js` calls `navigator.storage.persist()`, unless storage is already persisted. If Chrome declines, every chat panel shows a warning notice (`model.notices`, spectrum ≥ 1.43.0, from `os/notices.js`): *Seven’s files may be cleared*, saying Chrome may clear seven's files and chats when disk space runs low. Chrome grants persistence by engagement, not by a setting, and installing seven as an app is the reliable way. So when Chrome offers to install (`beforeinstallprompt`), the notice says to install seven as an app and offers **Install**, which opens Chrome's install prompt. Otherwise it says to bookmark seven. **Try again** asks again. After `appinstalled`, seven asks by itself and drops the notice once storage is kept. Dismissing the notice is remembered in `localStorage`. The folder-mount request (see [Folder mounts](#folder-mounts)) stays as it is.
+- **Keeping seven's files:** at the first chat send in a page session, `os/storage.js` calls `navigator.storage.persist()`, unless storage is already persisted. If Chrome declines, every chat panel shows a warning notice (`model.notices`, spectrum ≥ 1.43.0, from `os/notices.js`): *Seven’s files may be cleared*, saying Chrome may clear seven's files and chats when disk space runs low. Chrome grants persistence by engagement, not by a setting, and installing seven as an app is the reliable way. So when Chrome offers to install (`beforeinstallprompt`), the notice says to install seven as an app and offers **Install**, which opens Chrome's install prompt. Otherwise it says to bookmark seven. A browser without `navigator.userAgentData`, such as WebKit, gets neither piece of advice, which is Chrome's: the notice says only that this browser may clear them. **Ask again** asks once more. After `appinstalled`, seven asks by itself and drops the notice once storage is kept. Dismissing the notice is remembered in `localStorage`. The folder-mount request (see [Folder mounts](#folder-mounts)) stays as it is.
 - **Installing as an app:** [`src/manifest.json`](src/manifest.json) makes seven installable. Its name is *SLICC seven* and its launcher label *seven*. It opens standalone, its `id` and `scope` are `/` and its `start_url` is the BIOS's folder (`./`), and its icons in `src/icons/` come as `any` and `maskable`, relative to the manifest. The UI links `manifest.json`, which the service worker redirects to the BIOS's. The app starts at the BIOS, which checks the packages and goes on to `os/` as in a tab, so the service worker, COOP/COEP and the boot path are the same. Both pages link the manifest and set `theme-color` (`#f8f8f8` light, `#1b1b1b` dark); `os.css` gives `html` the same background, so nothing flashes before the UI paints. Each `<branch>.sliccy.ai` is its own origin, so a preview installs as an app of its own.
 - **Adobe sign-in:** **Connect** on the Adobe account signs in to Adobe IMS. IMS only redirects to `www.sliccy.ai/auth/callback`, and seven is cross-origin isolated, so the popup has no opener to report back to. Which path seven uses depends on where it runs:
   - **On `https://<label>.sliccy.ai`:** seven asks the relay for its own origin (state `{ source: 'origin', origin, nonce }`). The relay navigates the popup to `<origin>/auth/callback`. The service worker serves that page from `os/callback.html`. Its first, inline script keeps the address in memory and replaces it with the bare path before anything loads, and the page sends no referrer. It then hands the nonce and the grant's fields (`access_token`, `expires_in`, `error`, `error_description`) to the tab over the same-origin `BroadcastChannel('slicc-sign-in')`, and closes. The extension isn't needed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.52.1",
+  "version": "1.52.2",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",