@ai-ecoverse/slicc-browsers 1.3.0 → 1.4.0

package/README.md

@@ -89,7 +89,7 @@ Every feature builds for `wasm32-wasip1`.
   - `discardExceptions`: where the site pattern and the extra origins' hosts go, as a `list` of strings or as a `chrome-time-map`, a map from site to the time it was added (microseconds since 1601-01-01 UTC, as a decimal string);
   - `cleanExit`: values that mark the last exit clean;
   - `form` says where a key comes from: `six` (SLICC six's keys) or `chrome-154` (what Chrome 154 reads).
-- `protectedOrigins`: what browser control must never reach, see [Protected origins](#protected-origins). `domains` (`sliccy.ai`), `schemes` (`https`, `http`), `innerSchemes` (`blob`, `filesystem`, `view-source`), `anySchemes` (`devtools`), `inheriting` (`about:blank`, `about:srcdoc`), and `refusal`, the text of a refusal.
+- `protectedOrigins`: what browser control must never reach, see [Protected origins](#protected-origins). `domains` (`sliccy.ai`), `hosts` (`vault.sliccy.ai`), `schemes` (`https`, `http`), `innerSchemes` (`blob`, `filesystem`, `view-source`), `anySchemes` (`devtools`), `inheriting` (`about:blank`, `about:srcdoc`), and `refusal`, the text of a refusal.
 - `profiles`: SLICC profiles live in `<config dir>/<root>/<name>`, and a snap's in `~/snap/<snap>/common/<snapRoot>/<name>`. `legacyRoot` is the old root, never scanned; on macOS's case-insensitive volume it is SLICC six's root too. `sixProfilePattern` matches six's profile names, case-insensitively. `namePattern` is a valid profile name. `six` describes SLICC six's Chrome profiles (see [SLICC six's profiles](#slicc-sixs-profiles)):
   - `roots`: six's profile root per OS (`macos`, `linux`, `windows`), a `base` location followed by the `path` segments. The base is its `env` when that is set and not empty (any value, as six takes it), else `home` under the home dir.
   - `defaultName` (`browser-coding-agent-chrome`), `defaultPort` (5710) and `portSuffix` (`-{port}`): six's profile for its serve port `<port>` is `<root>/<defaultName>`, with `portSuffix` added for any port other than `defaultPort`.
@@ -104,16 +104,18 @@ Browser control must never navigate to, open or attach to a target on seven's ow
 **URLs.** A URL is parsed the way the WHATWG URL Standard (and so the browser) parses it, so `https:\\seven.sliccy.ai`, a tab or newline inside the URL, `%2E`, `。` and full-width letters all reach seven. In Go and Rust that takes a WHATWG parser, not `net/url`. A URL that doesn't parse isn't protected; the browser doesn't load it either. Then:
 1. While its scheme is one of `innerSchemes`, the rest of the URL after `<scheme>:` takes its place, at most 8 times: `blob:https://seven.sliccy.ai/<uuid>` is `https://seven.sliccy.ai/<uuid>`.
 2. A scheme in `anySchemes` is protected whatever follows: a DevTools front end (`devtools://`) can be inspecting seven.
-3. A scheme in `schemes` is protected when its host is one of `domains` or under one, at any depth and on any port. The host is lower-cased, and one trailing dot is dropped.
+3. A scheme in `schemes` is protected when its host is one of `hosts`, or one of `domains` or under one, at any depth and on any port. The host is lower-cased, and one trailing dot is dropped.
 4. Any other URL is protected when its origin is one of the program's **extra origins**: the seven origins it accepts besides `sliccy.ai` (slicc-cli's `--origin` and `--page` origins), compared as `scheme://host[:port]` without the scheme's default port, with the host as in 3.
 
 This is wider than the rule for finding seven (`seven.originHostPattern`, which leaves out `www`). Every `sliccy.ai` host shares the `sliccy.ai` cookies, and cookies ignore the port and, without `Secure`, the scheme. SLICC six lives on `www.sliccy.ai` and the apex, and its cookies matter. `*.kernel.localhost` is not protected: each port is its own origin, and the agent's own servers live there. An extra origin is matched exactly, so `http://127.0.0.1:5710` doesn't protect `http://127.0.0.1:5711`.
 
+**The vault.** `vault.sliccy.ai` is in `hosts` by name. `sliccy.ai` already covers it, but it must stay protected even if `domains` ever changes: the vault must never be a CDP target for agent tools. The one exception is slicc-cli's own pairing attach for the vault, which is the CLI's own connection and not browser control handed to the agent.
+
 **Targets.** A target's effective origin is its URL's (`TargetInfo.url`), except when the URL inherits the origin of whoever made the document: the empty URL, and `inheriting` with any query or fragment. Such a target is protected when it was protected before this URL (a seven tab that went to `about:blank` keeps seven's origin), or when its opener (`openerId`, else `openerFrameId`) is protected or unknown, for an opener closed before the program saw it. The URL, `openerFrameId` and `browserContextId` alone can't tell: a blank popup that seven opens has seven's origin and the URL `about:blank`. A program that holds a session to the target also has the document's real origin: the main frame's `securityOrigin` in `Page.frameNavigated`, and the default context's `origin` in `Runtime.executionContextCreated`. When one of those is protected, the target is protected too, until a URL with an origin of its own replaces it.
 
 A same-site frame shares its parent's process and has no target of its own. Every `sliccy.ai` host is protected, and site isolation gives a seven frame inside any other site its own target, so this only matters for an extra origin whose site has other origins (another port of `127.0.0.1`, say).
 
-**Cookies.** A cookie domain, lower-cased and without a leading or trailing dot, is protected when it is one of `domains` or under one, or when it is the host of a protected domain or an extra origin, or a parent of one: a cookie on `.example.test` reaches `https://seven.example.test`.
+**Cookies.** A cookie domain, lower-cased and without a leading or trailing dot, is protected when it is one of `domains` or under one, or when it is one of `hosts`, the host of a protected domain or an extra origin, or a parent of one: a cookie on `.example.test` reaches `https://seven.example.test`.
 
 **Storage keys** (`Storage`, `IndexedDB`, `CacheStorage` and `FileSystem` in CDP): a key is protected when its origin (up to the first `^`) or its top-level site (a part after `^0`) is a protected URL.
 

package/catalog.json

@@ -703,6 +703,7 @@
   },
   "protectedOrigins": {
     "domains": ["sliccy.ai"],
+    "hosts": ["vault.sliccy.ai"],
     "schemes": ["https", "http"],
     "innerSchemes": ["blob", "filesystem", "view-source"],
     "anySchemes": ["devtools"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",

package/protected.json

@@ -11,6 +11,12 @@
     { "url": "http://seven.sliccy.ai/", "protected": true },
     { "url": "https://main--seven.sliccy.ai/", "protected": true },
     { "url": "https://www.sliccy.ai/", "protected": true },
+    { "url": "https://vault.sliccy.ai/", "protected": true },
+    { "url": "https://VAULT.sliccy.ai:443/unlock?x=1", "protected": true },
+    { "url": "http://vault.sliccy.ai./", "protected": true },
+    { "url": "blob:https://vault.sliccy.ai/0b9e0f6c", "protected": true },
+    { "url": "https://vault.sliccy.ai.example/", "protected": false },
+    { "url": "https://vault-sliccy.ai/", "protected": false },
     { "url": "https://sliccy.ai/", "protected": true },
     { "url": "https://a.b.sliccy.ai/", "protected": true },
     { "url": "https://seven.sliccy.ai./", "protected": true },
@@ -82,6 +88,8 @@
   ],
   "targets": [
     { "url": "https://seven.sliccy.ai/", "protected": true },
+    { "url": "https://vault.sliccy.ai/", "protected": true },
+    { "url": "about:blank", "opener": "protected", "protected": true },
     { "url": "https://example.com/", "protected": false },
     { "url": "https://example.com/", "previous": true, "protected": false },
     { "url": "https://example.com/", "opener": "protected", "protected": false },
@@ -108,6 +116,7 @@
     { "domain": "sliccy.ai", "protected": true },
     { "domain": ".sliccy.ai", "protected": true },
     { "domain": "seven.sliccy.ai", "protected": true },
+    { "domain": "vault.sliccy.ai", "protected": true },
     { "domain": ".www.sliccy.ai", "protected": true },
     { "domain": "SLICCY.AI", "protected": true },
     { "domain": "sliccy.ai.", "protected": true },
@@ -128,6 +137,7 @@
   "storageKeys": [
     { "key": "https://seven.sliccy.ai/", "protected": true },
     { "key": "https://sliccy.ai/", "protected": true },
+    { "key": "https://vault.sliccy.ai/", "protected": true },
     { "key": "http://127.0.0.1:5710/", "protected": true },
     { "key": "https://widget.example/^0https://sliccy.ai", "protected": true },
     { "key": "https://seven.sliccy.ai/^31", "protected": true },

package/protected.mjs

@@ -39,6 +39,7 @@ export function protectedOrigins(rules, extraOrigins = []) {
     if (!u) return false;
     const s = scheme(u);
     if (rules.anySchemes.includes(s)) return true;
+    if (rules.schemes.includes(s) && rules.hosts.includes(hostOf(u))) return true;
     if (rules.schemes.includes(s) && rules.domains.some((d) => under(hostOf(u), d))) return true;
     const o = originOf(u);
     return o !== null && extra.includes(o);
@@ -65,7 +66,7 @@ export function protectedOrigins(rules, extraOrigins = []) {
     if (d.endsWith('.')) d = d.slice(0, -1);
     if (d === '') return false;
     if (rules.domains.some((x) => under(d, x))) return true;
-    return [...rules.domains, ...extraHosts].some((h) => under(h, d));
+    return [...rules.domains, ...rules.hosts, ...extraHosts].some((h) => under(h, d));
   };
 
   const storageKey = (key) => {

package/schema/catalog.schema.json

@@ -173,7 +173,15 @@
     "protectedOrigins": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["domains", "schemes", "innerSchemes", "anySchemes", "inheriting", "refusal"],
+      "required": [
+        "domains",
+        "hosts",
+        "schemes",
+        "innerSchemes",
+        "anySchemes",
+        "inheriting",
+        "refusal"
+      ],
       "properties": {
         "domains": {
           "type": "array",
@@ -184,6 +192,14 @@
             "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$"
           }
         },
+        "hosts": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$"
+          }
+        },
         "schemes": { "$ref": "#/$defs/schemes", "type": "array", "minItems": 1 },
         "innerSchemes": { "$ref": "#/$defs/schemes" },
         "anySchemes": { "$ref": "#/$defs/schemes" },