@ai-ecoverse/slicc-bios 1.55.1 → 1.55.3

package/README.md

@@ -427,13 +427,15 @@ An older extension, or one that cannot report a supported release version, refus
 
 - **Known limit:** extensions that refuse `Target.setAutoAttach` leave an ordinary page with a cross-site iframe locked for paint, DOM, CSS, accessibility and input. The guard fails closed when it cannot place the child.
 
-**Sign-in tabs are held for life (#754).** A sign-in popup shows its token or code in its URL and on the IdP's pages, and the guard can't scrub a page's own content. So the owner tab holds every sign-in tab from the moment it opens. A held tab is never listed, attached, auto-attached or reported to a program on any origin, until it closes. Its events, `urlFragment` included, never reach the program.
+**Sign-in tabs are held for life (#754).** A sign-in popup shows its token or code in its URL and on the IdP's pages, and the guard cannot scrub a page's own content. The owner holds it before sign-in starts. A held tab and its descendants are not listed, attached, auto-attached or reported to a program on any origin until they close.
 - **Seven's own sign-in:** the popup opens on `about:blank#slicc-sign-in-<nonce>`. bios asks the owner over the `slicc-held` BroadcastChannel to hold it. The owner finds that target by its marker URL on each browser host (slicc-extension, a DevTools port), holds it, and only then is the popup sent to the IdP. The owner answers `held` once it has held the tab on every listed host, `none` when no host is listed, and `unheld` otherwise, including when a listed host can't be opened. On `unheld`, on `none` while bios sees a host, or on no answer within 6 s while a host is connected, the sign-in stops before the IdP and says so; it never goes on unheld. On `none`, the sign-in goes on, and the owner keeps it as in flight for 11 minutes (in `localStorage`, `slicc-os.sign-in-flight`, so a reload keeps it). Before any program gets a browser connection, the owner sweeps every host: it holds sign-in tabs still on `about:blank`, and while a sign-in is in flight, every page a protected page opened. So a host that connects in the middle of a sign-in never sees its tab.
-- **The guard decides by itself, too:** a page that a held tab opened is held, on any URL, and so are its own popups in turn, and so are the frames and workers of a held tab (`parentId`). A page seven (or another protected page) opened with opener access (`canAccessOpener`), or that is still on `about:blank`, is held the first time any guard sees it.
-- **Other sign-in tabs:** a watcher in the owner tab holds every page that a protected page (seven or the vault) opened and that is still on `about:blank`, and a popup that a held tab opens, such as the IdP's own. It goes through slicc-extension and only polls every 250 ms once a program or a sign-in needs the browser, and the extension reports no opener access, so only marked popups are held reliably there: an unmarked popup that leaves `about:blank` before the next poll can be missed, and a program could then list it, URL and fragment included (a known gap). Seven's own Adobe sign-in carries the marker. The agent's MCP OAuth and device-code popups carry it from slicc-agent 6.19.15 (#550), which seven pins: they ask on `slicc-held` and navigate only on `held` or `none`, so they are held before they leave `about:blank`, and with no holder answering the agent's sign-in fails.
+- **The guard decides by itself, too:** every child of a held opener stays held, whatever its origin, including the frames and workers of a held tab (`parentId`). The cross-origin exception applies only to an opener that is itself an unheld HTTP(S) page on seven's or the vault's protected origin, including seven's runtime origin. A settled ordinary HTTP(S) child of that page can remain drivable when fresh, consistent child and opener metadata proves their origins differ and the opener has no held ancestry after applying the opener rules to each fresh ancestor in its opener and parent chains. Same-origin and inherited `about:blank` or `about:srcdoc` children stay held. An initial empty target explicitly reporting no opener access is not made permanently held merely by that empty metadata; its eventual document is checked before use. Empty targets with opener access remain held.
+- **Other sign-in tabs:** the owner watcher holds children of held tabs on every origin. For unheld protected-origin openers, outside sign-in flight it holds children with opener access and inherited about:blank or about:srcdoc children, while skipping other children without opener access; the guard still checks them at attach time. It retains earlier target observations to establish holds, including standalone blank-child events. Its cross-origin exception requires both targets in the same fresh batch; a retained opener URL cannot waive a hold. While sign-in is in flight, the sweep still holds cross-origin children of a protected opener. The watcher connects through slicc-extension and polls every 250 ms once a program or sign-in needs the browser. Only marked popups are held reliably there: an unmarked popup that leaves its initial inherited document before it is observed can be missed (a known gap). Seven's Adobe sign-in and the agent's MCP OAuth and device-code popups carry the hold marker before navigating; without a required holder's answer, sign-in fails.
 - **Kept:** held tab ids are kept in `localStorage` (`slicc-os.held-targets`, the 32 most recently held or seen again), so a reload of the owner keeps them.
 - **The watcher's connections:** it connects to slicc-extension only once a program or a sign-in needs the browser. Before any program gets a browser connection, the owner sweeps every host; if that listing fails, the program gets no connection, and no host connection is opened for it.
-- **A tab only lent seven's protection** is one that seven opened with no opener access, or that inherited it only from about:blank. It becomes drivable once it commits an ordinary `http:`, `https:` or `data:` page, whether the program saw it at creation or later. Real protected origins stay protected for life, a `blob:` of seven's origin included.
+- **Ordinary cross-origin HTTPS children** of seven's or the vault's own unheld pages are no longer held merely by the opener rules when fresh settled metadata proves the difference. A blank-first or inherited empty child, such as `window.open('')` followed by a location assignment, stays held for the tab's life after navigating or losing its opener. An existing hold, including a bare target id stored by an older version, is never released merely because opener metadata disappears or no sign-in is in flight.
+- **Fresh session checks:** before a command on a page session is forwarded, fresh target metadata and opener ancestry are checked, including CSS, session Fetch and Runtime or DOM metadata commands, except Page.handleJavaScriptDialog when the existing dialog prelude admits it without reading the page. A page reporting opener access without an opener id is refused as unknown.
+- **Cross-origin opener handles** can still send messages, navigate where browser rules permit, focus or blur the window, close a script-closable window, inspect `closed` and `length`, and expose `frames` or indexed window references. They do not permit cross-origin DOM reads.
 
 A tab a program creates through the guard opens in the background, behind seven, unless it passes `background: false`. A program that needs seven to keep rendering should open tabs, the default, and not `newWindow`: even unfocused, a new window can cover seven's window, and Chrome then throttles seven ([slicc-extension#105](https://github.com/ai-ecoverse/slicc-extension/issues/105)).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.55.1",
+  "version": "1.55.3",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",
@@ -49,7 +49,7 @@
     "format": "biome check --write ."
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc": "1.61.0",
+    "@ai-ecoverse/slicc": "1.61.5",
     "@ai-ecoverse/slicc-browsers": "1.19.0",
     "@ai-ecoverse/slicc-cdp": "1.45.0",
     "@ai-ecoverse/slicc-kernel": "1.173.3",