@ai-ecoverse/slicc-bios 1.53.3 → 1.53.5

package/README.md

@@ -482,13 +482,13 @@ seven can also join a tailnet, with a patched build of Tailscale's wasm client (
     - **Retries:** an `idempotency-key` or `x-github-delivery` header becomes the delivery id, so a retry isn't delivered twice.
     - **No agent:** with no agent running, or a slicc-agent without page-side webhooks, the delivery is dropped with a warning. The hub has already answered the sender `202`.
   - **Remote control (`agent`):** a linked CLI can prompt, watch and stop seven's agent (`slicc prompt`, `slicc watch`, `slicc abort`). The page offers cap `agent` to a CLI on this computer always, and to a remote device only after **Control** is turned on for it in Linked devices. That setting is kept per device certificate and cleared by unlinking it. Any other link's agent OPEN gets `EACCES`.
-    - Each `OPEN { kind: 'agent', op }` goes to the agent of the tab that runs the kernel, on its active cone, through slicc-agent's `remoteControl`. `prompt` answers OPENED with how the prompt was delivered (or `RESET EBUSY` for `whenBusy: 'reject'` while busy), then streams NDJSON events from the prompt's own `user` event to its `end` line. A prompt over about 60 KiB comes as `length` bytes after an empty OPENED, and the first line then says how it was delivered. `watch` answers with the transcript `head` (and `gap` when `since` is gone), then streams events. `abort` answers `{ aborted }`.
+    - Each `OPEN { kind: 'agent', op }` goes to the agent of the tab that runs the kernel, on its active cone, through slicc-agent's `remoteControl`. `prompt` answers OPENED with how the prompt was delivered (or `RESET EBUSY` for `whenBusy: 'reject'` while busy), then streams NDJSON events from the prompt's own `user` event to its `end` line. A prompt over about 60 KiB comes as `length` bytes after an empty OPENED, and the first line then says how it was delivered. `watch` answers with the transcript `head` (and `gap` when `since` is gone), then streams events. A `watch` OPEN with `busy: true` (`slicc wait`, `slicc prompt --allsettled`) also asks the agent whether it has anything left to do: OPENED then carries `busy: true | false`, and a `{"t":"busy","busy","why"?}` line follows each time that changes. `abort` answers `{ aborted }`.
     - A CLI that goes away ends its stream but never aborts the run; aborting is explicit. A `watch` the CLI half-closes right after OPENED, as slicc does, still ends at once when it is later reset or its link closes, so **Watching** clears without waiting for the agent's next event.
     - Linked devices lists every device that has linked, offline ones too, with its control setting, and shows **Prompting** or **Watching** while a CLI does, also in the header.
     - A device that reconnects replaces only its own process's link, so `slicc <join> prompt` doesn't drop that machine's `follow`. Control-only links (`caps: []`) get no `.slicc.internal` name and no exit.
   - **Folders (`fs`):** a CLI started with `--mount <path>[:<name>][:ro]` lists its folders in HELLO, and later in `OPEN { kind: 'mounts' }` updates; the page offers cap `mounts`. Each is a `hostfs` source named `<device>/<name>`, so `mount -t hostfs lars-mbp/proj /mnt/proj` mounts it, and nothing is mounted unless someone asks. A bare source with no `<device>/` (`mount -t hostfs project /mnt/p`, or one remembered from an older seven), is the folder of that name on the CLI linked on this computer, when exactly one local CLI shares one. The device's row in Linked devices lists its folders (`folders`, with a Read-only badge; spectrum ≥ 1.58.0): **Mount** (`mountFolder(source)`) mounts one at `/mnt/<device>/<name>` (a folder named `.` or `..` is never listed), and **Eject** (`ejectFolder(source)`) unmounts it. The Files panel's Mounted strip shows each `hostfs` mount's source (`mountInfo()`), so `/mnt/proj · lars-mbp/proj` reads as another computer's folder. A mounted linked folder stays with the CLI process it was first granted from (`slicc-os.link-sources`), even if that process comes back under another name. If that process isn't linked, the folder goes to whichever process has the name now, but only when no other process with the same host name shares a folder of that name; otherwise it waits. So a remembered `lars-mbp/proj` never lands on another process's `proj`. A remembered linked folder that is mounted again before its CLI is back stays `nomedium`, and fills in when the CLI links. The kernel's `hostfs` hook answers such a source with a `MessagePort` (slicc-kernel ≥ 1.54.9), and the page serves it with `serveHostfsPort` over `OPEN { kind: 'fs', mount, op, … }` streams: `list` collects its NDJSON, a read over 64 KiB and every write get their own channel, and `watch` streams the CLI's change events. A read-only kernel mount, or a read-only export, sends `readonly: true` on every OPEN. A link that drops makes the mount `nomedium` until the CLI is back; files that were open reopen by path and continue if the host didn't change them.
   - **SSH host key:** the CLI's HELLO carries its host key, and the page writes `<host>.slicc.internal,<address> <key>` into the system-wide `/etc/ssh/ssh_known_hosts`, replacing older entries for that name or address, so `ssh` never trusts a key on first sight, whichever user runs it. Seven manages these keys, not the user, and OpenSSH looks up a user's own file under the passwd home, which isn't always `$HOME`.
-  - **Tests:** `test/integration/remote.test.mjs` runs the real `slicc watch`, `slicc prompt` and `slicc abort` with `--signal stdio` against seven's real agent and a fake Bedrock. It also leads a fake tray hub and sends a `webhook.event`, which reaches the agent as a webhook lick (without its `authorization` header) and starts a run. `test/integration/tray.test.mjs` leads a fake tray hub and links a follower in the page through it, then rotates and unlinks; a remote follower that names kernel port 17180 leaves `SLICC_PAGE_LOOPBACK`, the stored port and the profile script alone. `test/integration/link.test.mjs` links a fake node in the page over a real `RTCPeerConnection`, with a HELLO that names no kernel port, port 80 or 17180, and checks `SLICC_PAGE_LOOPBACK` in login shells and, after a reload, in every program (one that offers `cdp` as version `1.47.2` or without a version shares no browsers while its net and folders still work; `1.47.3`, `dev` and a pseudo-version above share them), and, with `SLICC_CLI` set, the real `slicc attach --signal stdio`, relaying its NDJSON through the CDP binding: raw TCP and the http kind; kernel `ssh` with strict host-key checking against `--runner sh -c`, after `pnpm add -g @ai-ecoverse/wasix-openssh`; and, with the link as the exit, a name from the CLI's `--hosts` file, then refused under `--deny`; and `<port>.kernel.localhost` through the CLI's listener into a kernel server (`httptest`), with 502 for a closed port and the facade refused; a folder shared with `--mount`, mounted as `ref-node/proj`, read, written, seen changing on the host, and refused for writes when mounted `ro`; a second headless Chromium shared with `--cdp-extra`, listed and driven by `playwright-cli --runtime ref-node/<id>`; and a program WebSocket from kernel `bash` through the proxy to a `ws` echo server on the CLI's loopback: text, binary, the subprotocol, a close from each end, and `EACCES` under `--deny`; kernel `websocat`, installed from the catalog, to a `ws` echo on the CLI's loopback and, without `-k`, to `wss://echo.sliccy.ai/` (SLICC's echo, behind Cloudflare's certificate), so its own TLS checks the chain over raw TCP through the link, then failing at once under Directly and with no exit; and a kernel `python3` UDP socket (after `pnpm add -g @ai-ecoverse/wasix-python`) to a UDP echo server on the CLI's loopback, unconnected and connected, and `EACCES` on a connected socket under `--deny`, as with the fake node's own refusal. CI runs the CLI from npm, the pinned `@ai-ecoverse/slicc` devDependency.
+  - **Tests:** `test/integration/remote.test.mjs` runs the real `slicc watch`, `slicc prompt`, `slicc abort` and `slicc wait` with `--signal stdio` against seven's real agent and a fake Bedrock; `slicc wait` keeps waiting while a held model answer keeps the agent busy, and exits once it is idle. It also leads a fake tray hub and sends a `webhook.event`, which reaches the agent as a webhook lick (without its `authorization` header) and starts a run. `test/integration/tray.test.mjs` leads a fake tray hub and links a follower in the page through it, then rotates and unlinks; a remote follower that names kernel port 17180 leaves `SLICC_PAGE_LOOPBACK`, the stored port and the profile script alone. `test/integration/link.test.mjs` links a fake node in the page over a real `RTCPeerConnection`, with a HELLO that names no kernel port, port 80 or 17180, and checks `SLICC_PAGE_LOOPBACK` in login shells and, after a reload, in every program (one that offers `cdp` as version `1.47.2` or without a version shares no browsers while its net and folders still work; `1.47.3`, `dev` and a pseudo-version above share them), and, with `SLICC_CLI` set, the real `slicc attach --signal stdio`, relaying its NDJSON through the CDP binding: raw TCP and the http kind; kernel `ssh` with strict host-key checking against `--runner sh -c`, after `pnpm add -g @ai-ecoverse/wasix-openssh`; and, with the link as the exit, a name from the CLI's `--hosts` file, then refused under `--deny`; and `<port>.kernel.localhost` through the CLI's listener into a kernel server (`httptest`), with 502 for a closed port and the facade refused; a folder shared with `--mount`, mounted as `ref-node/proj`, read, written, seen changing on the host, and refused for writes when mounted `ro`; a second headless Chromium shared with `--cdp-extra`, listed and driven by `playwright-cli --runtime ref-node/<id>`; and a program WebSocket from kernel `bash` through the proxy to a `ws` echo server on the CLI's loopback: text, binary, the subprotocol, a close from each end, and `EACCES` under `--deny`; kernel `websocat`, installed from the catalog, to a `ws` echo on the CLI's loopback and, without `-k`, to `wss://echo.sliccy.ai/` (SLICC's echo, behind Cloudflare's certificate), so its own TLS checks the chain over raw TCP through the link, then failing at once under Directly and with no exit; and a kernel `python3` UDP socket (after `pnpm add -g @ai-ecoverse/wasix-python`) to a UDP echo server on the CLI's loopback, unconnected and connected, and `EACCES` on a connected socket under `--deny`, as with the fake node's own refusal. CI runs the CLI from npm, the pinned `@ai-ecoverse/slicc` devDependency.
   - **As the exit:** a CLI linked on this computer (`npx sliccy@next`) is the exit by itself until the user chooses one, so the kernel's HTTP and raw TCP get past CORS at once; a Tailscale exit node that is on comes first. A remote device that offers to be a default exit carries other traffic only once it's chosen. The Network panel's **Internet traffic** picker (`setExit`) is one choice across Directly, Tailscale exit nodes and linked devices: choosing a device turns off Tailscale's exit node, and choosing Tailscale clears the device. The choice of a device is kept in `localStorage` (`slicc-os.exit`), and while that device isn't connected, after a reload or while it reconnects, internet traffic **waits**: raw connections get `ENETUNREACH` and HTTP fails, rather than going out directly. Choosing Directly sends it directly again and is kept (`direct`), so a local CLI doesn't take it over, while a Tailscale exit node turned on later still does; unlinking the chosen exit device goes back to the automatic choice.
   - **What the agent sees:** the transport's `traits` name the default exit while there is one, so the agent can say how its fetches go. `traits.exit` is `{ kind, caps }`:
     - **`kind`:** `local` (a CLI on this computer), `remote` (a chosen linked device) or `tailnet` (a Tailscale exit node);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.53.3",
+  "version": "1.53.5",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",
@@ -49,13 +49,13 @@
     "format": "biome check --write ."
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc": "1.57.1",
+    "@ai-ecoverse/slicc": "1.57.2",
     "@ai-ecoverse/slicc-browsers": "1.18.21",
     "@ai-ecoverse/slicc-cdp": "1.44.2",
     "@ai-ecoverse/slicc-kernel": "1.172.2",
     "@ai-ecoverse/slicc-shared-web": "2.13.8",
     "@ai-ecoverse/slicc-spectrum": "1.108.3",
-    "@ai-ecoverse/slicc-vault": "1.21.1",
+    "@ai-ecoverse/slicc-vault": "1.21.2",
     "@biomejs/biome": "2.6.3",
     "aws4fetch": "1.0.20",
     "es-module-lexer": "3.0.4",