@ai-ecoverse/slicc-bios 1.54.8 → 1.54.10

package/README.md

@@ -354,7 +354,11 @@ Seven keeps its secrets in the vault, a separate origin (`@ai-ecoverse/slicc-vau
 - **The agent's port:** for slicc-agent ≥ 4.0.0 only, each agent worker gets its own `agent`-role port, posted raw as `{ vault, scrub }` next to the agent's `{ kernel, admin }`, and again with a fresh port after the frame reloads. The agent port gets no events, so every lock change in the page port's `status` is posted to the worker as `{ locked: true | false }`. `scrub` is the last `{ needed, version, ready }` pair (`localStorage['slicc-os.vault-scrub']`, `null` before any vault connected); each new pair is posted to the worker as `{ scrub }` before seven relays the `put`, `seal` or `import` answer that caused it. Agents before 4.0.0 speak an earlier draft of that wire, so they get no port and stay inert.
 - **`/dev/sealed`:** the kernel's `sealed` hook relays each request with its kernel stamp (`caller`, unchanged) as the vault's `sealed` op, and returns its one reply. While kernel users aren't `enforce`, `materialize` and `materializeConsume` are refused with `EACCES`; under `enforce`, `materialize` is relayed like the rest, and the kernel's `materializeConsume` (`ticket`, `stamp`, `path`, `resolved`, `argv`, `cwd`, `interpreters`, `trusted`, unchanged) goes to the vault's page op of that name, whose `{ values, placeholders }` go back to the kernel only. jerk's requests (`src/seed/jerk.js`) are answered with `answer`: `jop: list` with rows from each linked device that runs jerk (J1 `list`), `jop: status` from the vault's records, where `mcp:<server>` also counts a `list.mcp` record of exactly that server (exit 3 without one; the vault, not bios, checks that the reader is root), `jop: create` through J1 `create` with its progress lines (exit 4 without a jerk device), `unseal` by removing the provider's `jerk:` records, and `oauth` and `jerk-seal` with exit 5 until seven signs in itself. A `cancelled` event stops a running J1 `create`.
 - **HTTP placeholders:** an attributed kernel request uses the vault's `forward` admission before its selected exit sends it. The carrier must support manual redirects and decoded responses; no unavailable, older or unproven carrier is used instead. Ordinary secret bodies are unchanged. A Settings MCP credential uses its server-bound path, with complete-body scrubbing before send and response scrubbing before return. Body-only placeholders are application data, not injected. An old extension remains unavailable for these requests until its verified store release supports the redirect contract. Link and Tailscale credentialed carriers remain unavailable in this release.
-- **Policy:** with kernel users `enforce`, bios seeds missing policy files under trusted root-owned `/etc/fnox` and `/etc/slicc` directories, without overwriting existing contents or trusting writable, linked or mounted paths. The kernel attests the bytes on boot and change. A trusted missing-file attestation clears and pauses its policy; missing or untrusted ancestors hold protected operations until a trusted resync. Materialize, consume and session operations also require an unlocked, current-capability vault and an accepted trusted policy; an older vault stays refused until it updates. Processes keep `FNOX_CONFIG_DIR=/etc/fnox`; fnox uses placeholders and `/dev/sealed`. Named root MCP calls discover their Settings placeholder directly, without a jerk command.
+- **Refusal causes:** every admission refusal of an HTTP placeholder request rejects with `the credentialed request was refused (<cause>): <explanation>` and the same `cause` on the error (`src/seed/causes.js`). The kernel puts that message into the program's `fetch` error, so mcpcat and other clients can show it. The explanation is a fixed sentence per cause that names the narrowest fix; it never holds a value, a placeholder, a record name or the vault's own `reason`. The causes and explanations are shown to any kernel program that sends a placeholder, root or not, by design: seven is a single-user OS, and they carry no value, record name or placeholder, only coarse state such as a missing policy file, a locked vault or the kind of route. Causes are stable; match on them, never on the explanation. Cancellation, a timeout, a URL that can't be parsed (thrown before admission starts), and transport or response-stream failures keep their existing messages and have no stable cause. The detailed policy causes need a vault that names them (slicc-vault 1.22.0 and later); an older vault's refusals arrive as `vault-refused`, except `policy-paused`.
+  - **Policy** (the vault refused, passed through only when its `cause` is one of these, otherwise `vault-refused`): `policy-paused`, `no-placeholder`, `no-rule`, `rule-domain`, `rule-request`, `rule-exit`, `mcp-server` (the placeholder isn't a sign-in of the MCP server at that URL), `record-removed`, `record-kind`, `record-expired`, `endpoint-protected`, `endpoint-model`, `url-credentials`, `insecure-destination`, `placeholder-in-url`, `placeholder-in-header-name`, `placeholder-repeated`, `value-overlaps`, `basic-invalid`, `basic-user`, `header-unsafe`, `path-ambiguous`, `url-invalid`.
+  - **Precondition** (seven can't forward it here): `users-off`, `vault-unavailable`, `vault-locked`, `policy-syncing`, `policy-missing`, `policy-unaccepted`, `policy-unavailable`, `destination-protected` (seven's own, loopback, reserved or protected addresses), `exit-link` and `exit-tailnet` (the host goes through a linked device or the tailnet, which carry no credentialed request in this release), `extension-outdated` (slicc-extension before 7.11.0), `exit-not-credentialed` (any other route without manual redirects, decoded bodies and a body limit), `route-inactive`, `exit-encoded-bodies`, `exit-follows-redirects`, `body-too-large` (status `413`).
+  - **Protocol**: `protocol-version`, `body-framing`, `mcp-body-framing`, `vault-reply` (an answer this seven doesn't take), `vault-error` (the vault's `forward` call failed; its errno is appended), `changed` (the route, the policy or the vault changed while the request was prepared; send it again).
+- **Policy:** with kernel users `enforce`, bios seeds missing policy files under trusted root-owned `/etc/fnox` and `/etc/slicc` directories, without overwriting existing contents or trusting writable, linked or mounted paths. The kernel attests the bytes on boot and change. A trusted missing-file attestation clears and pauses its policy; missing or untrusted ancestors hold protected operations until a trusted resync. Materialize, consume and session operations also require an unlocked, current-capability vault and an accepted trusted policy; an older vault stays refused until it updates. Processes keep `FNOX_CONFIG_DIR=/etc/fnox`; fnox uses placeholders and `/dev/sealed`. Named root MCP calls discover their Settings placeholder directly, without a jerk command. That is intentional, and the owner's decision: root is the owner, and sudoers decides who gets root, so a root process (including one a cone started through an approved `sudo`) discovers and uses the Settings MCP sign-ins. Discovery is the vault's `placeholder` op by server name, which answers only uid 0 under `enforce`, and only with a usable, addressable record that is the one match for that server name; process-sealed MCP bridge tokens and removed or expired records never answer. Using it, the record must be bound to the destination's server. bios's forwarder and the vault's `forward` check no uid or tag, so HTTP injection isn't partitioned by uid or tag (#1272).
 - **Egress:** token refreshes use the same selected transport with a manual redirect policy, never a native-fetch fallback. An incapable route or redirect is refused; the response returns only to the vault. Request bodies are zeroed after use, and requests are not logged.
 - **Adobe IMS:** with agent ≥ 4.0.0, `login('adobe', …)` opens its popup before anything else, then seals the token as `{ kind: 'model', provider: 'adobe', name: 'ADOBE_IMS_TOKEN', source: 'oauth:adobe', expiresAt }` (the redirect's `expires_in` is in seconds, 86399 for a day) and resolves `{ sealed: true }`, so the token never reaches spectrum or the agent. IMS gives no refresh token: an expired token means signing in again, which replaces the record and keeps its placeholder. Agents before 4.0.0 get the token as before.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.54.8",
+  "version": "1.54.10",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",
@@ -51,10 +51,10 @@
   "devDependencies": {
     "@ai-ecoverse/slicc": "1.61.0",
     "@ai-ecoverse/slicc-browsers": "1.19.0",
-    "@ai-ecoverse/slicc-cdp": "1.44.3",
+    "@ai-ecoverse/slicc-cdp": "1.45.0",
     "@ai-ecoverse/slicc-kernel": "1.172.2",
     "@ai-ecoverse/slicc-shared-web": "2.13.10",
-    "@ai-ecoverse/slicc-spectrum": "1.108.4",
+    "@ai-ecoverse/slicc-spectrum": "1.108.5",
     "@ai-ecoverse/slicc-vault": "1.21.2",
     "@biomejs/biome": "2.6.3",
     "aws4fetch": "1.0.20",

package/src/packages/package-lock.json

@@ -10,7 +10,7 @@
         "@ai-ecoverse/slicc-browsers": "1.19.0",
         "@ai-ecoverse/slicc-capture": "1.4.1",
         "@ai-ecoverse/slicc-kernel": "1.172.2",
-        "@ai-ecoverse/slicc-spectrum": "1.108.4",
+        "@ai-ecoverse/slicc-spectrum": "1.108.5",
         "@ai-ecoverse/wasi-fnox": "1.43.0-1",
         "@ai-ecoverse/wasi-pnpm": "12.9.1-21",
         "@ai-ecoverse/wasm-bash": "5.3.0-23",
@@ -146,9 +146,9 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-spectrum": {
-      "version": "1.108.4",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-spectrum/-/slicc-spectrum-1.108.4.tgz",
-      "integrity": "sha512-BglBvXbkc6wRjSn+9Xt39S/IXQAWfibyXeIPtQ/020NYgla7tkOmk68CYgYCRJu87kan0UCFsii9m4YgWg9AAw==",
+      "version": "1.108.5",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-spectrum/-/slicc-spectrum-1.108.5.tgz",
+      "integrity": "sha512-FLb+qxLhsXR2IwEA+uey5rVtbmX0c6YOf0sGHL6EnTtBswTBqlNKNz1dNFukcjh5KKwipohBGFBILJ7I44l3xQ==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=24"

package/src/packages/package.json

@@ -7,7 +7,7 @@
     "@ai-ecoverse/slicc-browsers": "1.19.0",
     "@ai-ecoverse/slicc-capture": "1.4.1",
     "@ai-ecoverse/slicc-kernel": "1.172.2",
-    "@ai-ecoverse/slicc-spectrum": "1.108.4",
+    "@ai-ecoverse/slicc-spectrum": "1.108.5",
     "@ai-ecoverse/wasi-fnox": "1.43.0-1",
     "@ai-ecoverse/wasi-pnpm": "12.9.1-21",
     "@ai-ecoverse/wasm-bash": "5.3.0-23",

package/src/packages/pnpm-lock.yaml

@@ -21,8 +21,8 @@ importers:
         specifier: 1.172.2
         version: 1.172.2
       '@ai-ecoverse/slicc-spectrum':
-        specifier: 1.108.4
-        version: 1.108.4
+        specifier: 1.108.5
+        version: 1.108.5
       '@ai-ecoverse/wasi-fnox':
         specifier: 1.43.0-1
         version: 1.43.0-1
@@ -105,8 +105,8 @@ packages:
       webgpu:
         optional: true
 
-  '@ai-ecoverse/slicc-spectrum@1.108.4':
-    resolution: {integrity: sha512-BglBvXbkc6wRjSn+9Xt39S/IXQAWfibyXeIPtQ/020NYgla7tkOmk68CYgYCRJu87kan0UCFsii9m4YgWg9AAw==}
+  '@ai-ecoverse/slicc-spectrum@1.108.5':
+    resolution: {integrity: sha512-FLb+qxLhsXR2IwEA+uey5rVtbmX0c6YOf0sGHL6EnTtBswTBqlNKNz1dNFukcjh5KKwipohBGFBILJ7I44l3xQ==}
     engines: {node: '>=24'}
 
   '@ai-ecoverse/wasi-fnox@1.43.0-1':
@@ -270,7 +270,7 @@ snapshots:
       - utf-8-validate
     optional: true
 
-  '@ai-ecoverse/slicc-spectrum@1.108.4': {}
+  '@ai-ecoverse/slicc-spectrum@1.108.5': {}
 
   '@ai-ecoverse/wasi-fnox@1.43.0-1': {}