@ai-ecoverse/slicc-bios 1.55.3 → 1.55.5

package/README.md

@@ -143,7 +143,7 @@ The kernel runs with users on (slicc-kernel ≥ 1.81.0): files have owners and m
   - **Global packages** (`pnpm add -g` into `/usr/local/share/pnpm`) aren't protected and run untagged.
   - **A remembered mount** (`slicc-os.mounts`) at, under or above a protected path is dropped at boot under `'enforce'`, with a notice, *A remembered folder wasn’t mounted*.
 - **Sudo approvals through the agent** (slicc-agent ≥ 5.9.0): while the agent runs, the kernel's `approve` hook hands each request to the agent's `owner.approve(req, { signal, where })`. It becomes a `sudo` item in the agent's approvals, which every owner device answers with the same powers: this tab, other tabs, and linked followers with or without Control, *Always allow* included where bios offered it. bios sets `req.always` from the checks below, and turns an *Always* it didn't offer into *Allow once*. A request from a follower's shell names that device (`where`, "on <device>"), and each linked device's agent port is opened with `owner.port({ device })`, so the item records which device answered. The tab hands its own approvals port to `createAgentModel(connection, { approvals })`, so `model.approvals` lists both sets. When the agent can't take a request (it rejects with `EAGAIN`: released, restarting or an older worker) or isn't running, bios's own dialog below asks instead.
-- **Sudo approvals in bios's dialog:** the kernel's `approve` hook feeds `model.approvals`, spectrum's sudo dialog. It shows the resolved path and arguments, shell-quoted, the directory, the requester mapped from the tag, the target and *Always allow*. Every tab shows the request (`BroadcastChannel('slicc-approvals')`), and the first decision wins; the other tabs see *Answered in another tab*. *Always allow* is offered only for a command bios trusts to run the same way every time: the kernel's resolved path, whose real path and every directory above it are root's and not group- or other-writable (checked by a root `stat` when the request comes), that isn't a shell, interpreter or wrapper (`bash`, `python*`, `node`, `env`, `xargs`, `sudo`, `timeout`, `find -exec` and the like), doesn't write named files (`tee`, `cp`, `mv`, `chmod`, `dd`, `sed -i`, `tar -x`, `git`, `pnpm` and the like), whose operands are all absolute, inside none of `/tmp`, `/var/tmp`, `/home`, `/mnt`, `/scoops` and `/dev/shm`, and not user-writable (a file that isn't root's or is group- or other-writable, a directory above that is, or a missing path whose parent is), with no shell metacharacter in any argument, and which may not change the secret rules. Everything else gets *Allow once* only. A request that may change the secret rules never offers *Always allow* either. bios decides that at least as broadly as spectrum's dialog: it runs the dialog's own classifier (spectrum's exported `secretRules`; without it every command counts as one that may change them), its own path check (`/etc/fnox`, `/etc/slicc/secrets-policy.toml`, and for a command that isn't read-only `/`, `/etc`, `/etc/slicc`, a name with `fnox` or `secrets-policy`, a glob or `..`), and treats any `$`, backtick, quote or backslash in an argument, and any quoting or `cd` inside a `-c` script, as a possible change. For such a request bios sends `always: false`, and answers an `always` for it, from any tab, as `once`, so no `NOPASSWD` line is written for it.
+- **Sudo approvals in bios's dialog:** the kernel's `approve` hook feeds `model.approvals`, spectrum's sudo dialog. It shows the resolved path and arguments, shell-quoted, the directory, the requester mapped from the tag, the target and *Always allow*. Every tab shows the request (`BroadcastChannel('slicc-approvals')`), and the first decision wins; the other tabs see *Answered in another tab*. *Always allow* is offered only for a command bios trusts to run the same way every time: the kernel's resolved path, whose real path and every directory above it are root's and not group- or other-writable (checked by a root `stat` when the request comes), that isn't a shell, interpreter or wrapper (`bash`, `python*`, `node`, `env`, `xargs`, `sudo`, `timeout`, `find -exec` and the like), doesn't write named files (`tee`, `cp`, `mv`, `chmod`, `dd`, `sed -i`, `tar -x`, `git`, `pnpm` and the like), whose operands are all absolute, inside none of `/tmp`, `/var/tmp`, `/home`, `/mnt`, `/scoops` and `/dev/shm`, and not user-writable (a file that isn't root's or is group- or other-writable, a directory above that is, or a missing path whose parent is), with no shell metacharacter in any argument, and which may not change the secret rules. Everything else gets *Allow once* only. A request that may change the secret rules never offers *Always allow* either. bios decides that at least as broadly as spectrum's dialog: it runs the dialog's own classifier (spectrum's exported `secretRules`, where `certain`, `maybe` and `once` all count; `once` is `xargs` running a program whose write flags spectrum gates, such as `xargs sort`, which may get a write flag from its input; without it every command counts as one that may change them), its own path check (`/etc/fnox`, `/etc/slicc/secrets-policy.toml`, and for a command that isn't read-only `/`, `/etc`, `/etc/slicc`, a name with `fnox` or `secrets-policy`, a glob or `..`), and treats any `$`, backtick, quote or backslash in an argument, and any quoting or `cd` inside a `-c` script, as a possible change. For such a request bios sends `always: false`, and answers an `always` for it, from any tab, as `once`, so no `NOPASSWD` line is written for it.
 - **Denials:** denials under `'report'` and `'enforce'` go to `/var/log/slicc/denials.log`, one JSON line per distinct `(uid, tag, op, path, errno)` with its `count`, `first` and last `time`, plus `user`, `tag` (the process's tag, `null` for an untagged one) and `mode`. They're written within a quarter of a second, at every 100 distinct denials, and when the page is hidden (`visibilitychange`). When the page goes away (`pagehide`), the ones not yet written are kept in `localStorage` (`slicc.denials.spool.*`), and the next page writes them once its kernel is up. The log rotates to `denials.log.1` at 1 MiB. `slicc-denials` (in `/usr/local/bin`) sums up the log and its `.1`: the total and time span, then counts by tag kind (`agent`, `user`, `untagged`), op, errno and path prefix; `--json` prints the same as one object.
 - **Schedules** (slicc-agent ≥ 5.9.0, slicc-kernel ≥ 1.110.0): each user's kernel crontab (`/var/spool/cron/crontabs/<user>`, `crontab -l`) holds them, and the kernel runs a due job as its user. A job that runs `agent send <target> '<message>'` comes back as a cron lick. The agent moves an older agent's `~/.slicc/crontab` lines into the file owner's crontab (as `# name: <name>` and `<schedule> agent send …`) and keeps the file as `~/.slicc/crontab.migrated`.
 - **Not a boundary:** the kernel's loopback (`<port>.kernel.localhost`) isn't one between users (N2). A server any user starts is reachable by every process and by seven's pages.
@@ -172,6 +172,8 @@ A local folder can be mounted into seven as on Linux ([#73](https://github.com/a
 2. **Once it's installed,** the page imports `page.js` and `spectrum/index.js` from `/opt/agent/node_modules/@ai-ecoverse/slicc-agent/dist/`. `startAgent` takes the Web Lock `slicc-agent`, starts `agent-worker.js` from there as a module worker and hands it a port to the page's kernel, so the agent's `bash`, `read`, `write` and `edit` run on the same kernel and files as the terminal. The page swaps in `createAgentModel()` when the worker connects. On later loads the agent starts at once, before any network check, so chat works offline. If another tab owns the agent, this tab has terminals and files only.
 3. **The conversation** is kept in SQLite in OPFS (`/.slicc/agent/`).
 
+CI checks the agent lockfile used by both beta checks and owner-pin updates against npm publish times, requiring third-party dependencies to exceed the workspace's `minimumReleaseAge` by one hour before a bump can ship.
+
 **The `panel` command** (slicc-agent ≥ 3.43.0, spectrum ≥ 1.60.0) lets the agent arrange seven's panels. Every local tab, the one that owns the agent and the tabs that follow it in the same browser, gives `createAgentModel()` a `page` bridge with its tab id, and the bridge runs spectrum's `panelCommand(app, argv, caller)` on that tab. A page that follows seven over a link never gets one. So `panel open monitor left`, `panel reset` and the other verbs in the agent's `bash` act on the tab showing the caller's cone, `panel tabs` lists the tabs, and `--tab <id>` picks one. Each terminal a tab opens has `SLICC_TAB` set to that tab's id, so `panel` typed in it acts on that tab.
 
 Under users `'off'` and `'report'`, `/opt/agent` is an ordinary pnpm project, so `cd /opt/agent && pnpm upgrade` updates the agent in place, and the pin survives seven's updates ([Your packages](#your-packages)), and the service worker drops its resolution cache when `/opt/agent`'s lockfile or `.modules.yaml` changes. When an update installs a new `/opt/agent` while the agent runs, the **Agent** row says *Ready to apply* and offers **Restart agent** (D16). It waits until the agent is idle, then stops the agent worker, imports the newly installed `page.js` and `spectrum/index.js` again and starts the new `agent-worker.js` with them; durable resumes the conversation from SQLite, and the page reconnects and swaps in the new connection and the new adapter's `createAgentModel()`, closing the old connection. The kernel, terminals and the page itself keep running. The page holds one module instance per URL, so each restart, and each retry after a failed import (Chrome keeps a module's failure under its URL too), imports the adapter as `page.js?run=<n>` with a new `n`; the service worker ignores `run` when it reads the file and adds the same `run` to every import that resolves inside `/opt/agent`, so the adapter's own files and dependencies load from the new install while the base set's modules stay shared. If the restart fails, no agent worker is left running and the row offers **Retry**, which starts the installed agent.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.55.3",
+  "version": "1.55.5",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",
@@ -54,7 +54,7 @@
     "@ai-ecoverse/slicc-cdp": "1.45.0",
     "@ai-ecoverse/slicc-kernel": "1.173.3",
     "@ai-ecoverse/slicc-shared-web": "2.13.10",
-    "@ai-ecoverse/slicc-spectrum": "1.111.0",
+    "@ai-ecoverse/slicc-spectrum": "1.111.2",
     "@ai-ecoverse/slicc-vault": "1.22.0",
     "@biomejs/biome": "2.6.3",
     "aws4fetch": "1.0.20",

package/src/packages/package-lock.json

@@ -10,7 +10,7 @@
         "@ai-ecoverse/slicc-browsers": "1.19.0",
         "@ai-ecoverse/slicc-capture": "1.4.1",
         "@ai-ecoverse/slicc-kernel": "1.173.3",
-        "@ai-ecoverse/slicc-spectrum": "1.111.0",
+        "@ai-ecoverse/slicc-spectrum": "1.111.2",
         "@ai-ecoverse/wasi-fnox": "1.43.0-1",
         "@ai-ecoverse/wasi-pnpm": "12.9.1-21",
         "@ai-ecoverse/wasm-bash": "5.3.0-23",
@@ -146,9 +146,9 @@
       }
     },
     "node_modules/@ai-ecoverse/slicc-spectrum": {
-      "version": "1.111.0",
-      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-spectrum/-/slicc-spectrum-1.111.0.tgz",
-      "integrity": "sha512-ic+Fu4UvgT8KeOUPymP4p1eJsVpJsnqxc6/V+qjDIQo1nurZ+w3n8LTEMMyYRrzDxM/MkcT1ZmtCiLk/Wn3L2g==",
+      "version": "1.111.2",
+      "resolved": "https://registry.npmjs.org/@ai-ecoverse/slicc-spectrum/-/slicc-spectrum-1.111.2.tgz",
+      "integrity": "sha512-cwuPI7+KEzw09SyfVguXc2QJdeXtihjGOPpkXzbzcEHWlHbLitaCzdQ9SBYf/yQntuejqPcNaxGrWWq+yrOcRA==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=24"

package/src/packages/package.json

@@ -7,7 +7,7 @@
     "@ai-ecoverse/slicc-browsers": "1.19.0",
     "@ai-ecoverse/slicc-capture": "1.4.1",
     "@ai-ecoverse/slicc-kernel": "1.173.3",
-    "@ai-ecoverse/slicc-spectrum": "1.111.0",
+    "@ai-ecoverse/slicc-spectrum": "1.111.2",
     "@ai-ecoverse/wasi-fnox": "1.43.0-1",
     "@ai-ecoverse/wasi-pnpm": "12.9.1-21",
     "@ai-ecoverse/wasm-bash": "5.3.0-23",

package/src/packages/pnpm-lock.yaml

@@ -21,8 +21,8 @@ importers:
         specifier: 1.173.3
         version: 1.173.3
       '@ai-ecoverse/slicc-spectrum':
-        specifier: 1.111.0
-        version: 1.111.0
+        specifier: 1.111.2
+        version: 1.111.2
       '@ai-ecoverse/wasi-fnox':
         specifier: 1.43.0-1
         version: 1.43.0-1
@@ -105,8 +105,8 @@ packages:
       webgpu:
         optional: true
 
-  '@ai-ecoverse/slicc-spectrum@1.111.0':
-    resolution: {integrity: sha512-ic+Fu4UvgT8KeOUPymP4p1eJsVpJsnqxc6/V+qjDIQo1nurZ+w3n8LTEMMyYRrzDxM/MkcT1ZmtCiLk/Wn3L2g==}
+  '@ai-ecoverse/slicc-spectrum@1.111.2':
+    resolution: {integrity: sha512-cwuPI7+KEzw09SyfVguXc2QJdeXtihjGOPpkXzbzcEHWlHbLitaCzdQ9SBYf/yQntuejqPcNaxGrWWq+yrOcRA==}
     engines: {node: '>=24'}
 
   '@ai-ecoverse/wasi-fnox@1.43.0-1':
@@ -270,7 +270,7 @@ snapshots:
       - utf-8-validate
     optional: true
 
-  '@ai-ecoverse/slicc-spectrum@1.111.0': {}
+  '@ai-ecoverse/slicc-spectrum@1.111.2': {}
 
   '@ai-ecoverse/wasi-fnox@1.43.0-1': {}