esoul-sdk 0.19.0 → 0.19.1

package/dist/machine/program-manager.js

@@ -524,7 +524,19 @@ export function createProgramManager(opts) {
                     slots.delete(linkId);
                 }
                 else {
-                    slot.link = l; // grants may have changed; the next start uses them
+                    // What the app may reach here can change without a new version (the owner picks "Whole
+                    // computer" after assigning, or narrows it). The program was started — or refused, with
+                    // no sandbox — under the OLD reach, so a change restarts it under the new one; the old
+                    // slot goes quiet like a replaced version (its late "stopped" must not land on top).
+                    const before = JSON.stringify(reach(slot));
+                    slot.link = l;
+                    if (JSON.stringify(reach(slot)) !== before) {
+                        if (slot.reportTimer)
+                            clearTimeout(slot.reportTimer);
+                        slot.silenced = true;
+                        stop(slot, "what the app may reach on this computer changed");
+                        slots.delete(linkId);
+                    }
                 }
             }
             for (const l of Object.values(links)) {

package/docs/18-your-computer.md

@@ -303,7 +303,9 @@ The rules that keep it safe and quiet:
   system, writes only `p.dataDir` (its own folder, kept across versions) and
   the folder the owner granted (`p.workspaceRoot`); its home and `/tmp` are
   private scratch space. With no sandbox on the computer it is refused and
-  the card says why.
+  the card says why. Changing what the app may reach there (the owner picks
+  another choice on the card) restarts the program under the new reach —
+  widened, narrowed, or out of a refusal.
 - **Supervised.** A resident program that exits is restarted with backoff;
   five exits in five minutes and it stops, `failed`, with the last log lines
   on the card. Its environment is scrubbed (PATH, LANG, TZ, HOME): the

package/llms-full.txt

@@ -3245,7 +3245,9 @@ The rules that keep it safe and quiet:
   system, writes only `p.dataDir` (its own folder, kept across versions) and
   the folder the owner granted (`p.workspaceRoot`); its home and `/tmp` are
   private scratch space. With no sandbox on the computer it is refused and
-  the card says why.
+  the card says why. Changing what the app may reach there (the owner picks
+  another choice on the card) restarts the program under the new reach —
+  widened, narrowed, or out of a refusal.
 - **Supervised.** A resident program that exits is restarted with backoff;
   five exits in five minutes and it stops, `failed`, with the last log lines
   on the card. Its environment is scrubbed (PATH, LANG, TZ, HOME): the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "esoul-sdk",
-  "version": "0.19.0",
+  "version": "0.19.1",
   "description": "Build a full product on ExternalSoul: your own tables with per-person rules, a viewer on every seam, app roles, access levels, realtime with audiences, durable tasks, and bindings to other apps.",
   "license": "UNLICENSED",
   "type": "module",