@ai-ecoverse/slicc-bios 1.55.14 → 1.55.16

package/README.md

@@ -142,8 +142,8 @@ The kernel runs with users on (slicc-kernel ≥ 1.81.0): files have owners and m
   - **Under `'report'`** nothing is protected, since protection has no report mode of its own. Installs already run as tagged writers from `/opt/slicc/base` with the clean config, and bios watches the six trees through the kernel (`fs.watch`, recursive). Each change made through the page's kernel outside bios's own installs goes to `denials.log` as `op: 'protect'`, `errno: 'EROFS'`: a write that `'enforce'` would refuse. The watch doesn't say which process wrote, so these lines have no user and no tag. Changes made outside the page's kernel (bios's install kernels, the page itself) aren't seen.
   - **Global packages** (`pnpm add -g` into `/usr/local/share/pnpm`) aren't protected and run untagged.
   - **A remembered mount** (`slicc-os.mounts`) at, under or above a protected path is dropped at boot under `'enforce'`, with a notice, *A remembered folder wasn’t mounted*.
-- **Sudo approvals through the agent** (slicc-agent ≥ 5.9.0): while the agent runs, the kernel's `approve` hook hands each request to the agent's `owner.approve(req, { signal, where })`. It becomes a `sudo` item in the agent's approvals, which every owner device answers with the same powers: this tab, other tabs, and linked followers with or without Control, *Always allow* included where bios offered it. bios sets `req.always` from the checks below, and turns an *Always* it didn't offer into *Allow once*. A request from a follower's shell names that device (`where`, "on <device>"), and each linked device's agent port is opened with `owner.port({ device })`, so the item records which device answered. The tab hands its own approvals port to `createAgentModel(connection, { approvals })`, so `model.approvals` lists both sets. When the agent can't take a request (it rejects with `EAGAIN`: released, restarting or an older worker) or isn't running, bios's own dialog below asks instead.
-- **Sudo approvals in bios's dialog:** the kernel's `approve` hook feeds `model.approvals`, spectrum's sudo dialog. It shows the resolved path and arguments, shell-quoted, the directory, the requester mapped from the tag, the target and *Always allow*. Every tab shows the request (`BroadcastChannel('slicc-approvals')`), and the first decision wins; the other tabs see *Answered in another tab*. *Always allow* is offered only for a command bios trusts to run the same way every time: the kernel's resolved path, whose real path and every directory above it are root's and not group- or other-writable (checked by a root `stat` when the request comes), that isn't a shell, interpreter or wrapper (`bash`, `python*`, `node`, `env`, `xargs`, `sudo`, `timeout`, `find -exec` and the like), doesn't write named files (`tee`, `cp`, `mv`, `chmod`, `dd`, `sed -i`, `tar -x`, `git`, `pnpm` and the like), whose operands are all absolute, inside none of `/tmp`, `/var/tmp`, `/home`, `/mnt`, `/scoops` and `/dev/shm`, and not user-writable (a file that isn't root's or is group- or other-writable, a directory above that is, or a missing path whose parent is), with no shell metacharacter in any argument, and which may not change the secret rules. Everything else gets *Allow once* only. A request that may change the secret rules never offers *Always allow* either. bios decides that at least as broadly as spectrum's dialog: it runs the dialog's own classifier (spectrum's exported `secretRules`, where `certain`, `maybe` and `once` all count; `once` is `xargs` running a program whose write flags spectrum gates, such as `xargs sort`, which may get a write flag from its input; without it every command counts as one that may change them), its own path check (`/etc/fnox`, `/etc/slicc/secrets-policy.toml`, and for a command that isn't read-only `/`, `/etc`, `/etc/slicc`, a name with `fnox` or `secrets-policy`, a glob or `..`), and treats any `$`, backtick, quote or backslash in an argument, and any quoting or `cd` inside a `-c` script, as a possible change. For such a request bios sends `always: false`, and answers an `always` for it, from any tab, as `once`, so no `NOPASSWD` line is written for it.
+- **Sudo approvals through the agent** (slicc-agent ≥ 7.17.0, slicc-kernel ≥ 1.174.0, spectrum ≥ 1.112.0): bios only routes. While the agent runs, the kernel's `approve` hook hands each request to the agent's `owner.approve(req, { signal, where })` unchanged, the kernel's facts included: `always` (`false` when the line can't be recorded as a rule), `stdin` (`tty`, `none`, `pipe` or `file`) and `rootOnly` (for the directory and each path on the line, whether only root can change it). bios returns the agent's answer as it is. It becomes a `sudo` item in the agent's approvals, which every owner device answers with the same powers: this tab, other tabs, and linked followers with or without Control. The judge is slicc-agent's: it gives each request a level and a reason, and offers *Always allow* only to a person, at level 1, when its model says a later run of the same line can do no more. Enforcement and rule recording are the kernel's: it writes an *Always* as the exact line with `Stdin none`, and runs an *Always* for a line it can't record once. bios checks no command text. A request from a follower's shell names that device (`where`, "on <device>"), and each linked device's agent port is opened with `owner.port({ device })`, so the item records which device answered. The tab hands its own approvals port to `createAgentModel(connection, { approvals })`, so `model.approvals` lists both sets. When the agent can't take a request (it rejects with `EAGAIN`: released, restarting or an older worker), isn't running, or was started from a release older than 7.17.0 (one without the judge, which can still run until it restarts after an update), bios's own dialog below asks instead.
+- **Sudo approvals in bios's dialog:** without the agent there is no judge, so the kernel's `approve` hook feeds `model.approvals`, spectrum's sudo dialog, with *Allow once* and *Deny* only and no verdict. It shows the resolved path and arguments, shell-quoted, the directory, the requester mapped from the tag and the target. Every tab shows the request (`BroadcastChannel('slicc-approvals')`), and the first decision wins; the other tabs see *Answered in another tab*. The item has `always: false`, and an `always` decision for it, from any tab, is refused with *Always isn't offered for this request.* and the request stays open, so no `NOPASSWD` line is written from bios's dialog.
 - **Denials:** denials under `'report'` and `'enforce'` go to `/var/log/slicc/denials.log`, one JSON line per distinct `(uid, tag, op, path, errno)` with its `count`, `first` and last `time`, plus `user`, `tag` (the process's tag, `null` for an untagged one) and `mode`. They're written within a quarter of a second, at every 100 distinct denials, and when the page is hidden (`visibilitychange`). When the page goes away (`pagehide`), the ones not yet written are kept in `localStorage` (`slicc.denials.spool.*`), and the next page writes them once its kernel is up. The log rotates to `denials.log.1` at 1 MiB. `slicc-denials` (in `/usr/local/bin`) sums up the log and its `.1`: the total and time span, then counts by tag kind (`agent`, `user`, `untagged`), op, errno and path prefix; `--json` prints the same as one object.
 - **Schedules** (slicc-agent ≥ 5.9.0, slicc-kernel ≥ 1.110.0): each user's kernel crontab (`/var/spool/cron/crontabs/<user>`, `crontab -l`) holds them, and the kernel runs a due job as its user. A job that runs `agent send <target> '<message>'` comes back as a cron lick. The agent moves an older agent's `~/.slicc/crontab` lines into the file owner's crontab (as `# name: <name>` and `<schedule> agent send …`) and keeps the file as `~/.slicc/crontab.migrated`.
 - **Not a boundary:** the kernel's loopback (`<port>.kernel.localhost`) isn't one between users (N2). A server any user starts is reachable by every process and by seven's pages.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.55.14",
+  "version": "1.55.16",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",
@@ -49,14 +49,14 @@
     "format": "biome check --write ."
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc": "1.61.9",
-    "@ai-ecoverse/slicc-browsers": "1.19.2",
-    "@ai-ecoverse/slicc-cdp": "1.45.2",
+    "@ai-ecoverse/slicc": "1.61.10",
+    "@ai-ecoverse/slicc-browsers": "1.20.0",
+    "@ai-ecoverse/slicc-cdp": "1.46.0",
     "@ai-ecoverse/slicc-kernel": "1.174.0",
     "@ai-ecoverse/slicc-shared-web": "2.13.10",
     "@ai-ecoverse/slicc-spectrum": "1.112.0",
     "@ai-ecoverse/slicc-vault": "1.22.0",
-    "@biomejs/biome": "2.6.3",
+    "@biomejs/biome": "2.6.4",
     "aws4fetch": "1.0.20",
     "es-module-lexer": "3.0.4",
     "fake-indexeddb": "6.2.6",

package/src/packages/agent/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "description": "SLICC's agent, which the UI installs with pnpm in the background into /opt/agent in OPFS",
   "dependencies": {
-    "@ai-ecoverse/slicc-agent": "7.16.1",
+    "@ai-ecoverse/slicc-agent": "7.18.0",
     "@ai-ecoverse/slicc-kernel": "1.174.0"
   }
 }

package/src/packages/agent/pnpm-lock.yaml

@@ -14,8 +14,8 @@ importers:
   .:
     dependencies:
       '@ai-ecoverse/slicc-agent':
-        specifier: 7.16.1
-        version: 7.16.1(@ai-ecoverse/slicc-kernel@1.174.0)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)
+        specifier: 7.18.0
+        version: 7.18.0(@ai-ecoverse/slicc-kernel@1.174.0)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)
       '@ai-ecoverse/slicc-kernel':
         specifier: 1.174.0
         version: 1.174.0
@@ -25,8 +25,8 @@ packages:
   '@ai-ecoverse/jerk-oauth@1.4.0':
     resolution: {integrity: sha512-fwDK5WV+6TW6u9Y6KE0PwtSYiAxvfGHLwqQzEKsSyRUVKcYMYuGNQ9d9mvX+B15Wry4sUx96u/56VTQhQVXJYg==}
 
-  '@ai-ecoverse/slicc-agent@7.16.1':
-    resolution: {integrity: sha512-aeDCBceLonRtRO3jABbOctMppiTVIoh0oFoH8+CCVbYAh7iMdWT2WZYExp8x0wvE+MjpZphd3CyOdOsAweLmIA==}
+  '@ai-ecoverse/slicc-agent@7.18.0':
+    resolution: {integrity: sha512-1ZiBtprgENZRuLJsW8ygTxuuHqH0dqrC6/2n3YwI8r5moRhSw2j7b5/ZVpxUmI5JDC784t6t23eIVg4B8G/jqw==}
     engines: {node: '>=24'}
     peerDependencies:
       '@ai-ecoverse/slicc-kernel': '>=1.172.2 <2'
@@ -351,7 +351,7 @@ snapshots:
 
   '@ai-ecoverse/jerk-oauth@1.4.0': {}
 
-  '@ai-ecoverse/slicc-agent@7.16.1(@ai-ecoverse/slicc-kernel@1.174.0)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)':
+  '@ai-ecoverse/slicc-agent@7.18.0(@ai-ecoverse/slicc-kernel@1.174.0)(@aws-sdk/credential-provider-node@3.972.84)(@smithy/signature-v4@5.7.4)':
     dependencies:
       '@ai-ecoverse/slicc-kernel': 1.174.0
       '@ai-ecoverse/slicc-vault': 1.22.0

package/src/packages/package-lock.json

@@ -7,7 +7,7 @@
       "name": "slicc-bios-packages",
       "dependencies": {
         "@ai-ecoverse/slicc-audio": "1.1.6",
-        "@ai-ecoverse/slicc-browsers": "1.19.2",
+        "@ai-ecoverse/slicc-browsers": "1.20.0",
         "@ai-ecoverse/slicc-capture": "1.4.1",
         "@ai-ecoverse/slicc-kernel": "1.174.0",
         "@ai-ecoverse/slicc-spectrum": "1.112.0",
@@ -39,9 +39,9 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-browsers": {
-      "version": "1.19.2",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-browsers/-/slicc-browsers-1.19.2.tgz",
-      "integrity": "sha512-HsyuWWKR4GA06rj4zmVNZWLg/1S4R/bv4pQrsErRgYSFnE8uzPPdKKP3ZP4CKEldwIEWdQkYmgL1yf/10rNvkA==",
+      "version": "1.20.0",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-browsers/-/slicc-browsers-1.20.0.tgz",
+      "integrity": "sha512-UZ3dM9hbz9rjr1b3cJ9nCp+K7ueLr869pZLlPjI6VpesutOZN4vn/luibOGyZdqhszL0rDKlnm0zB8udshXRMA==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=24"

package/src/packages/package.json

@@ -4,7 +4,7 @@
   "description": "Packages the BIOS installs from npm into OPFS, pinned by package-lock.json and pnpm-lock.yaml",
   "dependencies": {
     "@ai-ecoverse/slicc-audio": "1.1.6",
-    "@ai-ecoverse/slicc-browsers": "1.19.2",
+    "@ai-ecoverse/slicc-browsers": "1.20.0",
     "@ai-ecoverse/slicc-capture": "1.4.1",
     "@ai-ecoverse/slicc-kernel": "1.174.0",
     "@ai-ecoverse/slicc-spectrum": "1.112.0",

package/src/packages/pnpm-lock.yaml

@@ -12,8 +12,8 @@ importers:
         specifier: 1.1.6
         version: 1.1.6
       '@ai-ecoverse/slicc-browsers':
-        specifier: 1.19.2
-        version: 1.19.2
+        specifier: 1.20.0
+        version: 1.20.0
       '@ai-ecoverse/slicc-capture':
         specifier: 1.4.1
         version: 1.4.1
@@ -49,8 +49,8 @@ packages:
     engines: {node: '>=24', slicc-kernel: '>=1.153.0'}
     hasBin: true
 
-  '@ai-ecoverse/slicc-browsers@1.19.2':
-    resolution: {integrity: sha512-HsyuWWKR4GA06rj4zmVNZWLg/1S4R/bv4pQrsErRgYSFnE8uzPPdKKP3ZP4CKEldwIEWdQkYmgL1yf/10rNvkA==}
+  '@ai-ecoverse/slicc-browsers@1.20.0':
+    resolution: {integrity: sha512-UZ3dM9hbz9rjr1b3cJ9nCp+K7ueLr869pZLlPjI6VpesutOZN4vn/luibOGyZdqhszL0rDKlnm0zB8udshXRMA==}
     engines: {node: '>=24'}
 
   '@ai-ecoverse/slicc-capture@1.4.1':
@@ -248,7 +248,7 @@ snapshots:
       - utf-8-validate
       - webgpu
 
-  '@ai-ecoverse/slicc-browsers@1.19.2': {}
+  '@ai-ecoverse/slicc-browsers@1.20.0': {}
 
   '@ai-ecoverse/slicc-capture@1.4.1': {}