@ai-ecoverse/slicc-agent 6.18.8 → 6.18.9

package/dist/browser/guard.js

@@ -11,6 +11,7 @@ const SCHEMED = /^[a-z][a-z0-9+.-]*:/i;
 const EMBEDDED = /[a-z][a-z0-9+.-]*:\/\/[^\s'"`<>(){}\\]+/gi;
 const RELATIVE = /(?<![:\w/])\/\/[^\s'"`<>(){}\\/]+/g;
 const PREFIX = /^(?:[A-Za-z_][A-Za-z0-9_]*|-{1,2}[A-Za-z0-9-]+)=/;
+const HOSTLIKE = /^[^\s/?#]*(?:\.|%2e|%e3%80%82|%ef%bc%8e|%ef%bd%a1|[\u3002\uff0e\uff61])[^\s/?#]*(?:[/?#]\S*)?$/i;
 function parse(url) {
   try {
     return new URL(url);
@@ -26,8 +27,8 @@ function foreignKernel(url) {
   const host = parsed.hostname.replace(/\.+$/, "");
   return kernelHost(host) && !ownKernelServer(host);
 }
-function forbidden(url, matcher) {
-  return matcher.url(url) || foreignKernel(url);
+function forbidden(url, matcher, lenient = false) {
+  return matcher.url(url, { readOnly: lenient }) || foreignKernel(url);
 }
 function candidates(raw) {
   const word = raw.replace(/[\t\n\r]/g, "").replace(/^[\0- ]+|[\0- ]+$/g, "");
@@ -37,11 +38,11 @@ function candidates(raw) {
     value,
     ...value.match(EMBEDDED) ?? [],
     ...(value.match(RELATIVE) ?? []).map((relative) => `https:${relative}`)
-  ];
+  ].map((url) => ({ url, lenient: false }));
   if (!/^[/.~-]/.test(value) && !/^[a-z][a-z0-9+.-]*:\/\//i.test(value))
-    found.push(`https://${value}`);
-  if (value.startsWith("//")) found.push(`https:${value}`);
-  return found.filter((each) => SCHEMED.test(each));
+    found.push({ url: `https://${value}`, lenient: !HOSTLIKE.test(value) });
+  if (value.startsWith("//")) found.push({ url: `https:${value}`, lenient: false });
+  return found.filter((each) => SCHEMED.test(each.url));
 }
 function browserCommand(word) {
   return BROWSER.has(word.slice(word.lastIndexOf("/") + 1));
@@ -49,7 +50,9 @@ function browserCommand(word) {
 function refused(command, matcher) {
   const all = words(command);
   if (!all.some(browserCommand)) return false;
-  return all.some((word) => candidates(word).some((url) => forbidden(url, matcher)));
+  return all.some(
+    (word) => candidates(word).some(({ url, lenient }) => forbidden(url, matcher, lenient))
+  );
 }
 function commandOf(args) {
   const command = args?.command;

package/dist/browser/guard.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/browser/guard.ts"],
-  "sourcesContent": ["import { defineExtension, type Extension, hook, ToolTask } from '@earendil-works/pi-durable';\nimport { FACADE_PORT, kernelHost, ownKernelServer } from '../kernel/loopback.ts';\nimport { PROTECTED_RULES, type ProtectedMatcher, protectedMatcher } from './origins.ts';\nimport { words } from './shell.ts';\n\nexport const BROWSER_GUARD = 'slicc-browser-guard';\nexport const REFUSAL = \"SLICC's own pages can't be opened or driven from the browser tools.\";\nexport { FACADE_PORT, ownKernelServer };\n\nconst BROWSER = new Set(['playwright-cli', 'curlwright']);\nconst WEB = new Set(['http:', 'https:', 'ws:', 'wss:']);\nconst INNER = new Set(PROTECTED_RULES.innerSchemes.map((scheme) => `${scheme}:`));\nconst SCHEMED = /^[a-z][a-z0-9+.-]*:/i;\nconst EMBEDDED = /[a-z][a-z0-9+.-]*:\\/\\/[^\\s'\"`<>(){}\\\\]+/gi;\nconst RELATIVE = /(?<![:\\w/])\\/\\/[^\\s'\"`<>(){}\\\\/]+/g;\nconst PREFIX = /^(?:[A-Za-z_][A-Za-z0-9_]*|-{1,2}[A-Za-z0-9-]+)=/;\n\nfunction parse(url: string): URL | undefined {\n  try {\n    return new URL(url);\n  } catch {\n    return undefined;\n  }\n}\n\nexport function foreignKernel(url: string): boolean {\n  let parsed = parse(url);\n  for (let depth = 0; parsed && INNER.has(parsed.protocol) && depth < 8; depth++)\n    parsed = parse(parsed.href.slice(parsed.protocol.length));\n  if (!parsed || !WEB.has(parsed.protocol)) return false;\n  const host = parsed.hostname.replace(/\\.+$/, '');\n  return kernelHost(host) && !ownKernelServer(host);\n}\n\nexport function forbidden(url: string, matcher: ProtectedMatcher): boolean {\n  return matcher.url(url) || foreignKernel(url);\n}\n\nexport function candidates(raw: string): string[] {\n  const word = raw.replace(/[\\t\\n\\r]/g, '').replace(/^[\\0- ]+|[\\0- ]+$/g, '');\n  const value = word.replace(PREFIX, '');\n  const found = [\n    word,\n    value,\n    ...(value.match(EMBEDDED) ?? []),\n    ...(value.match(RELATIVE) ?? []).map((relative) => `https:${relative}`),\n  ];\n  if (!/^[/.~-]/.test(value) && !/^[a-z][a-z0-9+.-]*:\\/\\//i.test(value))\n    found.push(`https://${value}`);\n  if (value.startsWith('//')) found.push(`https:${value}`);\n  return found.filter((each) => SCHEMED.test(each));\n}\n\nfunction browserCommand(word: string): boolean {\n  return BROWSER.has(word.slice(word.lastIndexOf('/') + 1));\n}\n\nexport function refused(command: string, matcher: ProtectedMatcher): boolean {\n  const all = words(command);\n  if (!all.some(browserCommand)) return false;\n  return all.some((word) => candidates(word).some((url) => forbidden(url, matcher)));\n}\n\nfunction commandOf(args: unknown): string {\n  const command = (args as { command?: unknown } | undefined)?.command;\n  return typeof command === 'string' ? command : '';\n}\n\nexport function browserGuard(origins: readonly string[]): Extension {\n  const matcher = protectedMatcher(origins);\n  return defineExtension({\n    name: BROWSER_GUARD,\n    hooks: [\n      hook(ToolTask, {\n        beforeTool: (call) =>\n          call.name === 'bash' && refused(commandOf(call.arguments), matcher)\n            ? { block: REFUSAL }\n            : undefined,\n      }),\n    ],\n  });\n}\n"],
-  "mappings": "AAAA,SAAS,iBAAiC,MAAM,gBAAgB;AAChE,SAAS,aAAa,YAAY,uBAAuB;AACzD,SAAS,iBAAwC,wBAAwB;AACzE,SAAS,aAAa;AAEf,MAAM,gBAAgB;AACtB,MAAM,UAAU;AAGvB,MAAM,UAAU,oBAAI,IAAI,CAAC,kBAAkB,YAAY,CAAC;AACxD,MAAM,MAAM,oBAAI,IAAI,CAAC,SAAS,UAAU,OAAO,MAAM,CAAC;AACtD,MAAM,QAAQ,IAAI,IAAI,gBAAgB,aAAa,IAAI,CAAC,WAAW,GAAG,MAAM,GAAG,CAAC;AAChF,MAAM,UAAU;AAChB,MAAM,WAAW;AACjB,MAAM,WAAW;AACjB,MAAM,SAAS;AAEf,SAAS,MAAM,KAA8B;AAC3C,MAAI;AACF,WAAO,IAAI,IAAI,GAAG;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,cAAc,KAAsB;AAClD,MAAI,SAAS,MAAM,GAAG;AACtB,WAAS,QAAQ,GAAG,UAAU,MAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ,GAAG;AACrE,aAAS,MAAM,OAAO,KAAK,MAAM,OAAO,SAAS,MAAM,CAAC;AAC1D,MAAI,CAAC,UAAU,CAAC,IAAI,IAAI,OAAO,QAAQ,EAAG,QAAO;AACjD,QAAM,OAAO,OAAO,SAAS,QAAQ,QAAQ,EAAE;AAC/C,SAAO,WAAW,IAAI,KAAK,CAAC,gBAAgB,IAAI;AAClD;AAEO,SAAS,UAAU,KAAa,SAAoC;AACzE,SAAO,QAAQ,IAAI,GAAG,KAAK,cAAc,GAAG;AAC9C;AAEO,SAAS,WAAW,KAAuB;AAChD,QAAM,OAAO,IAAI,QAAQ,aAAa,EAAE,EAAE,QAAQ,sBAAsB,EAAE;AAC1E,QAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE;AACrC,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,GAAI,MAAM,MAAM,QAAQ,KAAK,CAAC;AAAA,IAC9B,IAAI,MAAM,MAAM,QAAQ,KAAK,CAAC,GAAG,IAAI,CAAC,aAAa,SAAS,QAAQ,EAAE;AAAA,EACxE;AACA,MAAI,CAAC,UAAU,KAAK,KAAK,KAAK,CAAC,2BAA2B,KAAK,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,EAAE;AAC/B,MAAI,MAAM,WAAW,IAAI,EAAG,OAAM,KAAK,SAAS,KAAK,EAAE;AACvD,SAAO,MAAM,OAAO,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC;AAClD;AAEA,SAAS,eAAe,MAAuB;AAC7C,SAAO,QAAQ,IAAI,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,CAAC;AAC1D;AAEO,SAAS,QAAQ,SAAiB,SAAoC;AAC3E,QAAM,MAAM,MAAM,OAAO;AACzB,MAAI,CAAC,IAAI,KAAK,cAAc,EAAG,QAAO;AACtC,SAAO,IAAI,KAAK,CAAC,SAAS,WAAW,IAAI,EAAE,KAAK,CAAC,QAAQ,UAAU,KAAK,OAAO,CAAC,CAAC;AACnF;AAEA,SAAS,UAAU,MAAuB;AACxC,QAAM,UAAW,MAA4C;AAC7D,SAAO,OAAO,YAAY,WAAW,UAAU;AACjD;AAEO,SAAS,aAAa,SAAuC;AAClE,QAAM,UAAU,iBAAiB,OAAO;AACxC,SAAO,gBAAgB;AAAA,IACrB,MAAM;AAAA,IACN,OAAO;AAAA,MACL,KAAK,UAAU;AAAA,QACb,YAAY,CAAC,SACX,KAAK,SAAS,UAAU,QAAQ,UAAU,KAAK,SAAS,GAAG,OAAO,IAC9D,EAAE,OAAO,QAAQ,IACjB;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;",
+  "sourcesContent": ["import { defineExtension, type Extension, hook, ToolTask } from '@earendil-works/pi-durable';\nimport { FACADE_PORT, kernelHost, ownKernelServer } from '../kernel/loopback.ts';\nimport { PROTECTED_RULES, type ProtectedMatcher, protectedMatcher } from './origins.ts';\nimport { words } from './shell.ts';\n\nexport const BROWSER_GUARD = 'slicc-browser-guard';\nexport const REFUSAL = \"SLICC's own pages can't be opened or driven from the browser tools.\";\nexport { FACADE_PORT, ownKernelServer };\n\nconst BROWSER = new Set(['playwright-cli', 'curlwright']);\nconst WEB = new Set(['http:', 'https:', 'ws:', 'wss:']);\nconst INNER = new Set(PROTECTED_RULES.innerSchemes.map((scheme) => `${scheme}:`));\nconst SCHEMED = /^[a-z][a-z0-9+.-]*:/i;\nconst EMBEDDED = /[a-z][a-z0-9+.-]*:\\/\\/[^\\s'\"`<>(){}\\\\]+/gi;\nconst RELATIVE = /(?<![:\\w/])\\/\\/[^\\s'\"`<>(){}\\\\/]+/g;\nconst PREFIX = /^(?:[A-Za-z_][A-Za-z0-9_]*|-{1,2}[A-Za-z0-9-]+)=/;\nconst HOSTLIKE =\n  /^[^\\s/?#]*(?:\\.|%2e|%e3%80%82|%ef%bc%8e|%ef%bd%a1|[\\u3002\\uff0e\\uff61])[^\\s/?#]*(?:[/?#]\\S*)?$/i;\n\nexport interface Candidate {\n  url: string;\n  lenient: boolean;\n}\n\nfunction parse(url: string): URL | undefined {\n  try {\n    return new URL(url);\n  } catch {\n    return undefined;\n  }\n}\n\nexport function foreignKernel(url: string): boolean {\n  let parsed = parse(url);\n  for (let depth = 0; parsed && INNER.has(parsed.protocol) && depth < 8; depth++)\n    parsed = parse(parsed.href.slice(parsed.protocol.length));\n  if (!parsed || !WEB.has(parsed.protocol)) return false;\n  const host = parsed.hostname.replace(/\\.+$/, '');\n  return kernelHost(host) && !ownKernelServer(host);\n}\n\nexport function forbidden(url: string, matcher: ProtectedMatcher, lenient = false): boolean {\n  return matcher.url(url, { readOnly: lenient }) || foreignKernel(url);\n}\n\nexport function candidates(raw: string): Candidate[] {\n  const word = raw.replace(/[\\t\\n\\r]/g, '').replace(/^[\\0- ]+|[\\0- ]+$/g, '');\n  const value = word.replace(PREFIX, '');\n  const found = [\n    word,\n    value,\n    ...(value.match(EMBEDDED) ?? []),\n    ...(value.match(RELATIVE) ?? []).map((relative) => `https:${relative}`),\n  ].map((url) => ({ url, lenient: false }));\n  if (!/^[/.~-]/.test(value) && !/^[a-z][a-z0-9+.-]*:\\/\\//i.test(value))\n    found.push({ url: `https://${value}`, lenient: !HOSTLIKE.test(value) });\n  if (value.startsWith('//')) found.push({ url: `https:${value}`, lenient: false });\n  return found.filter((each) => SCHEMED.test(each.url));\n}\n\nfunction browserCommand(word: string): boolean {\n  return BROWSER.has(word.slice(word.lastIndexOf('/') + 1));\n}\n\nexport function refused(command: string, matcher: ProtectedMatcher): boolean {\n  const all = words(command);\n  if (!all.some(browserCommand)) return false;\n  return all.some((word) =>\n    candidates(word).some(({ url, lenient }) => forbidden(url, matcher, lenient))\n  );\n}\n\nfunction commandOf(args: unknown): string {\n  const command = (args as { command?: unknown } | undefined)?.command;\n  return typeof command === 'string' ? command : '';\n}\n\nexport function browserGuard(origins: readonly string[]): Extension {\n  const matcher = protectedMatcher(origins);\n  return defineExtension({\n    name: BROWSER_GUARD,\n    hooks: [\n      hook(ToolTask, {\n        beforeTool: (call) =>\n          call.name === 'bash' && refused(commandOf(call.arguments), matcher)\n            ? { block: REFUSAL }\n            : undefined,\n      }),\n    ],\n  });\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiC,MAAM,gBAAgB;AAChE,SAAS,aAAa,YAAY,uBAAuB;AACzD,SAAS,iBAAwC,wBAAwB;AACzE,SAAS,aAAa;AAEf,MAAM,gBAAgB;AACtB,MAAM,UAAU;AAGvB,MAAM,UAAU,oBAAI,IAAI,CAAC,kBAAkB,YAAY,CAAC;AACxD,MAAM,MAAM,oBAAI,IAAI,CAAC,SAAS,UAAU,OAAO,MAAM,CAAC;AACtD,MAAM,QAAQ,IAAI,IAAI,gBAAgB,aAAa,IAAI,CAAC,WAAW,GAAG,MAAM,GAAG,CAAC;AAChF,MAAM,UAAU;AAChB,MAAM,WAAW;AACjB,MAAM,WAAW;AACjB,MAAM,SAAS;AACf,MAAM,WACJ;AAOF,SAAS,MAAM,KAA8B;AAC3C,MAAI;AACF,WAAO,IAAI,IAAI,GAAG;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,cAAc,KAAsB;AAClD,MAAI,SAAS,MAAM,GAAG;AACtB,WAAS,QAAQ,GAAG,UAAU,MAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ,GAAG;AACrE,aAAS,MAAM,OAAO,KAAK,MAAM,OAAO,SAAS,MAAM,CAAC;AAC1D,MAAI,CAAC,UAAU,CAAC,IAAI,IAAI,OAAO,QAAQ,EAAG,QAAO;AACjD,QAAM,OAAO,OAAO,SAAS,QAAQ,QAAQ,EAAE;AAC/C,SAAO,WAAW,IAAI,KAAK,CAAC,gBAAgB,IAAI;AAClD;AAEO,SAAS,UAAU,KAAa,SAA2B,UAAU,OAAgB;AAC1F,SAAO,QAAQ,IAAI,KAAK,EAAE,UAAU,QAAQ,CAAC,KAAK,cAAc,GAAG;AACrE;AAEO,SAAS,WAAW,KAA0B;AACnD,QAAM,OAAO,IAAI,QAAQ,aAAa,EAAE,EAAE,QAAQ,sBAAsB,EAAE;AAC1E,QAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE;AACrC,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,GAAI,MAAM,MAAM,QAAQ,KAAK,CAAC;AAAA,IAC9B,IAAI,MAAM,MAAM,QAAQ,KAAK,CAAC,GAAG,IAAI,CAAC,aAAa,SAAS,QAAQ,EAAE;AAAA,EACxE,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,SAAS,MAAM,EAAE;AACxC,MAAI,CAAC,UAAU,KAAK,KAAK,KAAK,CAAC,2BAA2B,KAAK,KAAK;AAClE,UAAM,KAAK,EAAE,KAAK,WAAW,KAAK,IAAI,SAAS,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;AACxE,MAAI,MAAM,WAAW,IAAI,EAAG,OAAM,KAAK,EAAE,KAAK,SAAS,KAAK,IAAI,SAAS,MAAM,CAAC;AAChF,SAAO,MAAM,OAAO,CAAC,SAAS,QAAQ,KAAK,KAAK,GAAG,CAAC;AACtD;AAEA,SAAS,eAAe,MAAuB;AAC7C,SAAO,QAAQ,IAAI,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,CAAC;AAC1D;AAEO,SAAS,QAAQ,SAAiB,SAAoC;AAC3E,QAAM,MAAM,MAAM,OAAO;AACzB,MAAI,CAAC,IAAI,KAAK,cAAc,EAAG,QAAO;AACtC,SAAO,IAAI;AAAA,IAAK,CAAC,SACf,WAAW,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,QAAQ,MAAM,UAAU,KAAK,SAAS,OAAO,CAAC;AAAA,EAC9E;AACF;AAEA,SAAS,UAAU,MAAuB;AACxC,QAAM,UAAW,MAA4C;AAC7D,SAAO,OAAO,YAAY,WAAW,UAAU;AACjD;AAEO,SAAS,aAAa,SAAuC;AAClE,QAAM,UAAU,iBAAiB,OAAO;AACxC,SAAO,gBAAgB;AAAA,IACrB,MAAM;AAAA,IACN,OAAO;AAAA,MACL,KAAK,UAAU;AAAA,QACb,YAAY,CAAC,SACX,KAAK,SAAS,UAAU,QAAQ,UAAU,KAAK,SAAS,GAAG,OAAO,IAC9D,EAAE,OAAO,QAAQ,IACjB;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;",
   "names": []
 }

package/dist/browser/origins.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/browser/origins.ts"],
-  "sourcesContent": ["import catalog from '@ai-ecoverse/slicc-browsers/catalog.json' with { type: 'json' };\nimport { protectedOrigins } from '@ai-ecoverse/slicc-browsers/protected.mjs';\n\nexport const PROTECTED_RULES = catalog.protectedOrigins;\n\nexport interface ProtectedMatcher {\n  url(text: string): boolean;\n  target(target: { url: string; previous?: boolean; opener?: string }): boolean;\n  cookieDomain(domain: string): boolean;\n  storageKey(key: string): boolean;\n}\n\nexport function protectedMatcher(extra: readonly string[] = []): ProtectedMatcher {\n  return protectedOrigins(PROTECTED_RULES, [...extra]);\n}\n"],
+  "sourcesContent": ["import catalog from '@ai-ecoverse/slicc-browsers/catalog.json' with { type: 'json' };\nimport { protectedOrigins } from '@ai-ecoverse/slicc-browsers/protected.mjs';\n\nexport const PROTECTED_RULES = catalog.protectedOrigins;\n\nexport interface ProtectedMatcher {\n  url(text: string, options?: { readOnly?: boolean }): boolean;\n  target(target: { url: string; previous?: boolean; opener?: string }): boolean;\n  cookieDomain(domain: string): boolean;\n  storageKey(key: string): boolean;\n}\n\nexport function protectedMatcher(extra: readonly string[] = []): ProtectedMatcher {\n  return protectedOrigins(PROTECTED_RULES, [...extra]);\n}\n"],
   "mappings": "AAAA,OAAO,aAAa,2CAA2C,KAAK,EAAE,MAAM,OAAO;AACnF,SAAS,wBAAwB;AAE1B,MAAM,kBAAkB,QAAQ;AAShC,SAAS,iBAAiB,QAA2B,CAAC,GAAqB;AAChF,SAAO,iBAAiB,iBAAiB,CAAC,GAAG,KAAK,CAAC;AACrD;",
   "names": []
 }

package/dist/types/browser/guard.d.ts

@@ -4,8 +4,12 @@ import { type ProtectedMatcher } from './origins.ts';
 export declare const BROWSER_GUARD = "slicc-browser-guard";
 export declare const REFUSAL = "SLICC's own pages can't be opened or driven from the browser tools.";
 export { FACADE_PORT, ownKernelServer };
+export interface Candidate {
+    url: string;
+    lenient: boolean;
+}
 export declare function foreignKernel(url: string): boolean;
-export declare function forbidden(url: string, matcher: ProtectedMatcher): boolean;
-export declare function candidates(raw: string): string[];
+export declare function forbidden(url: string, matcher: ProtectedMatcher, lenient?: boolean): boolean;
+export declare function candidates(raw: string): Candidate[];
 export declare function refused(command: string, matcher: ProtectedMatcher): boolean;
 export declare function browserGuard(origins: readonly string[]): Extension;

package/dist/types/browser/origins.d.ts

@@ -9,10 +9,19 @@ export declare const PROTECTED_RULES: {
     aboutScheme: string;
     targetTypes: string[];
     inheriting: string[];
+    errorPage: {
+        url: string;
+        target: string;
+        redact: string;
+    };
+    unparseable: string;
+    unparseableRefusal: string;
     refusal: string;
 };
 export interface ProtectedMatcher {
-    url(text: string): boolean;
+    url(text: string, options?: {
+        readOnly?: boolean;
+    }): boolean;
     target(target: {
         url: string;
         previous?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-agent",
-  "version": "6.18.8",
+  "version": "6.18.9",
   "description": "SLICC's agent core on pi durable: an agent worker, session storage, remoting and pi extensions",
   "type": "module",
   "license": "Apache-2.0",
@@ -45,7 +45,7 @@
     "packages/vfs-root"
   ],
   "scripts": {
-    "prepare": "lefthook install",
+    "prepare": "slicc-install-hooks",
     "build": "node build.mjs && tsc -p tsconfig.build.json",
     "prepack": "npm run build",
     "start": "npm run build && node test/integration/chrome.mjs",
@@ -65,10 +65,10 @@
     "release": "semantic-release"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-kernel": "1.141.2",
+    "@ai-ecoverse/slicc-kernel": "1.141.3",
     "@ai-ecoverse/slicc-scrub": "1.0.0",
-    "@ai-ecoverse/slicc-shared-web": "1.29.6",
-    "@ai-ecoverse/slicc-spectrum": "1.104.0",
+    "@ai-ecoverse/slicc-shared-web": "1.29.9",
+    "@ai-ecoverse/slicc-spectrum": "1.104.1",
     "@ai-ecoverse/wasi-fnox": "1.39.0-6",
     "@ai-ecoverse/wasm-bash": "5.3.0-22",
     "@ai-ecoverse/wasm-coreutils": "9.12.0-12",
@@ -85,7 +85,7 @@
     "typescript": "7.0.2"
   },
   "dependencies": {
-    "@ai-ecoverse/slicc-browsers": "1.9.2",
+    "@ai-ecoverse/slicc-browsers": "1.13.2",
     "@ai-ecoverse/slicc-vault": "1.15.1",
     "@aws-sdk/middleware-websocket": "^3.972.54",
     "@earendil-works/chord": "1.3.0",