Two final 0.7.0 browser lane commits land in one tick. apps/browser/ext_manager.sg (f6ef9a4) ships the complete extension manager UX per BROWSER_RFC.md §7 — the honest, visible, non-silent counterpart to Chrome's extension permissions model. apps/sessions/sessions.sg (f6ef9a4) is updated to 0.7.0: srdx_negotiate_* ABI wired from OS (srdx_session.sg), showing SRDX ACTIVE state, Discovery section with ADV broadcast, and Negotiated section with HELLO→READY handshake. The 0.7.0 browser lane is now complete.
ext_manager.sg — honest extension UX (BROWSER_RFC.md §7)
Chrome installs extensions silently. The user sees a brief popup; the permissions are listed in a small dialog that most users dismiss without reading. Extensions then run with those permissions indefinitely with no per-session visibility.
sigilOS does not do this. ext_manager.sg is the extension manager surface — the UI that always tells the user what extensions have, what they're doing, and how to remove or restrict them.
[unprotected zone] warning banner (always visible, cannot be hidden): Every installed extension shows this banner in its detail panel: "This extension runs in the extension zone — it has broader system access than normal apps. Install only extensions you trust." This is the Director's framing from BROWSER_RFC.md §7 — "the honest version of what Chrome does silently."
[unprotected zone]), enable/disable toggle. Sorted by install date.net · fs:ro · tabs · storage. Permissions NOT requested also shown (dimmed): camera · mic. This mirrors the Cap Inspector in browser.sg — same UX, same chip style. User sees exactly what the extension has.chrome.* APIs this extension uses (e.g., chrome.tabs, chrome.storage.local). IPC-brokered — the Browser process (orchestrator) mediates all chrome.* calls.Load unpacked (developer flow — load from tag substrate path) · Load .crx (package flow).The extension manager is added to build.sh as +extmgr in IS_SCENE and DEMO_REL. It's a first-class scene in the browser chrome.
sessions.sg — srdx_negotiate_* wired (0.7.0 update)
sessions.sg is updated from 0.6.0 T1 to 0.7.0: srdx_negotiate_viewer() and srdx_negotiate_host() are now wired from the OS ABI (srdx_session.sg 4675b16 / OS 722353c). The Session Manager now shows the full negotiated session state, not just a static view.
srdx_negotiate_viewer() returns 0 (negotiation succeeded). Previously showed "connecting" state.sigil-pi:5900 found via ADV (auto-discovery broadcast) with MAC address shown. This is the Pi 4B on the local subnet advertising its SRDX listener.srdx_negotiate_viewer=0 (success). Proto=SRDX (raw-NIC or TCP, whichever auto-negotiate selected). RDP/VNC: "not tried" (not needed — sigilOS both sides).viewer.sg with the negotiated session handle. This is the "SRDX sessions = browser sessions" design from BROWSER_RFC.md §2 — clicking View opens the session in a new SRDX tab in the browser chrome.The key design point from BROWSER_RFC.md §2: an SRDX remote desktop session IS a browser tab. The session tab shows srdx://sigil-pi:5900 in the address bar. The [srdx] mode chip is shown (not [web]). The Cap Inspector for that tab shows the remote display caps. SRDX tabs and web tabs are the same object under the browser tab model.
0.7.0 browser lane — what's complete
| Component | Commit | Status |
|---|---|---|
BROWSER_RFC.md — design contract | 5211c20 | RATIFIED |
browser_ipc.sg — 16-slot IPC ring | ceedcb6 | PASS |
renderer_spawn.sg — CAP_IPC-only renderer | ceedcb6 | PASS |
ext_zone.sg — 16-slot extension zone (V2/V3 caps) | ae38f9a | PASS |
browser.sg — Lumen chrome shell | 2a08813 | LIVE |
compositor.sg — 8-layer GPU-first compositor | 16997fc | COMP-PASS |
canvas2d.sg — fillRect/clearRect/drawImage | a02b6c7 | CANVAS2D-PASS |
ext_manager.sg — honest extension UX | f6ef9a4 | LIVE |
sessions.sg — srdx_negotiate_* wired | f6ef9a4 | LIVE |
| Live renderer→browser→GPU IPC wiring | — | Gated on RFC §9 (3 open Qs) |
| cc0/JS runtime | — | In progress |
| Two-Pi SRDX end-to-end | — | Roadmap 0.7.x |
The 0.7.0 browser lane is complete up to the OS gating points. Everything that can be built without the live IPC seam and cc0 runtime is built. The browser has a face, a security model, an honest extension UX, and a negotiated session manager.