@ai-ecoverse/slicc-bios 1.52.3 → 1.53.0

package/README.md

@@ -399,7 +399,15 @@ Programs in the kernel drive a browser over the Chrome DevTools Protocol: `playw
 
 1. **[slicc-extension](https://github.com/ai-ecoverse/slicc-extension):** browser automation through the extension requires **7.10.0 or later**. When a supported extension defines `sliccExtension.cdp`, its `chrome.debugger` bridge drives the Chrome that seven runs in. Every program connection shares the page's one extension port. The hook gives each connection only the answers to its own commands and the events of the sessions it attached, and on close it detaches every session the connection attached.
 
-2. **The browser's own DevTools port:** a browser can offer a page of an origin it allows a CDP endpoint, as `crestDevTools.webSocketDebuggerUrl` (Crest does, on iOS and the Mac), and announce it with the `crestdevtools` event when it arrives after the page started. Seven reads the endpoint each time it connects, because it changes when the port reopens, and opens one socket per program connection, with flat sessions. It says `Slicc.action` first, which tells the browser this client dispatches its own input when none lands, so nothing is delivered twice. A port whose pages can't report child frames answers `Target.setAutoAttach` with *not found*. Seven passes that to the guard as the extension's refusal, so a page whose iframe the port reports stays locked for paint, DOM and input, and a page without one works. **Known limit:** a frame in a closed shadow root is listed in the frame tree but has no document node, so the guard reads it as an ordinary child frame. Its URL is still checked: a protected one refuses the whole tab, and a frame that moves to one cuts the session. An unprotected one isn't locked, and `Page.captureScreenshot` and `Page.printToPDF` show its pixels. Such a browser also leaves seven's own pages out of its listing and refuses navigation into them. The guard still runs on every connection, so the rules below hold whatever the browser does.
+2. **The browser's own DevTools port:** a browser can offer a page of an origin it allows a CDP endpoint, as `crestDevTools.webSocketDebuggerUrl` (Crest does, on iOS and the Mac), and announce it with the `crestdevtools` event when it arrives after the page started. Seven reads the endpoint each time it connects, because it changes when the port reopens, and opens one socket per program connection, with flat sessions. It says `Slicc.action` first, which tells the browser this client dispatches its own input when none lands, so nothing is delivered twice. A port whose pages can't report child frames answers `Target.setAutoAttach` with *not found*. Seven passes that to the guard as the extension's refusal, so a page whose iframe the port reports stays locked for paint, DOM and input, and a page without one works.
+
+A browser can vouch for more. When `Fetch.enable` answers `holdsDocuments: true`, it promises that every document in any frame waits for an answer, and that nothing reaches into a child frame (Crest lists the promises in `DevToolsPort.md`). Then a child frame doesn't lock a page by being there, as long as every frame listed, one in a closed shadow root included, has an `http:` or `https:` address the guard doesn't protect, or is `about:blank` or `about:srcdoc`, same-origin or not. The guard reads the frame tree again at each paint, DOM or input command, so a frame that moved can't slip through, and a tree it can't read refuses the command. A protected frame refuses the tab. `blob:`, `data:` and a frame with no address keep the lock, because their origin isn't known. Without that answer nothing changes, so Chrome's path is the same.
+
+**Known limits on such a browser:**
+- A screenshot or PDF gives the program what the page renders, including third-party iframes and what a page wrote into a blank frame. Crest answers `Page.printToPDF` with a native WebKit PDF, so that can include text and links, not only an image. This is accepted.
+- **A frame the browser doesn't list is invisible to the guard.** Crest records a frame's address from when its port opens, so a page already loaded by then can hide a frame nested inside a cross-origin frame until it reloads. A protected document nested that way, if it can be framed, can be captured as rendered screenshot and PDF content, potentially with PDF text and links. Its DOM, cookies, storage and vault keys stay out of reach. Protected origins include `sliccy.ai` and every subdomain, so the `www.sliccy.ai` homepage, `sliccy.ai`, `www.sliccy.ai/auth/callback`, a guarded sign-in page and a signed-in SLICC 6 page that can be framed are all in scope. Seven and the vault are out of scope only because they send `frame-ancestors`, which refuses ordinary sites: the hosting holds that line, not the guard. This is accepted.
+
+Such a browser also leaves seven's own pages out of its listing and refuses navigation into them. The guard still runs on every connection, so the rules below hold whatever the browser does.
 
 An older extension, or one that cannot report a supported release version, refuses browser automation with `slicc: refused: Update slicc-extension to use browser automation in seven. Reload this tab after updating.` Fetch and sign-in remain available.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.52.3",
+  "version": "1.53.0",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",
@@ -49,7 +49,7 @@
     "format": "biome check --write ."
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc": "1.49.38",
+    "@ai-ecoverse/slicc": "1.50.2",
     "@ai-ecoverse/slicc-browsers": "1.18.21",
     "@ai-ecoverse/slicc-cdp": "1.44.1",
     "@ai-ecoverse/slicc-kernel": "1.172.2",