@ai-ecoverse/slicc 1.29.2 → 1.29.3

package/README.md

@@ -167,7 +167,7 @@ slicc [--browser <id>]... [--cdp <url>]... [--page <url>] [--origin <origin>]...
 - a running endpoint without one: slicc opens `--page` in a new tab (`Target.createTarget`) and attaches;
 - an installed browser: slicc launches it as `slicc launch --url <page>` does, in its SLICC profile (`--profile`, or the one picked with `p`; default: the browser id), with the seven flags and prefs, and `--headless=new` with `--headless`, then attaches.
 
-Without `--browser`, the first row of the ranking that can host seven is chosen, an endpoint slicc didn't launch included. An Electron app can't host seven. Each further browser is an extra: an installed one is launched without a start page, and an endpoint is used as it is. Then the link is set up as for `slicc attach` (see [Local setup](#local-setup-slicc-attach)): over CDP with the browser that hosts seven, the first page tab on an allowed origin.
+Without `--browser`, the first row of the ranking that can host seven is chosen, an endpoint slicc didn't launch included. When that happens without the picker, slicc says so on stderr, for an endpoint that isn't in a SLICC profile and that no `--cdp` named: `slicc: using Google Chrome (profile default) at http://127.0.0.1:9222, which slicc didn't launch; opened a new seven tab. Use --browser or --cdp to choose another.` It says `found a seven tab` when one was open already. The profile is `default` for a browser's default user-data dir, the base name of the user-data dir otherwise, and left out (with its parentheses) when unknown. With `--json` the line comes as the `foreign-browser` event too. Picking a row in the picker, `--browser`, or a `--cdp` for that endpoint means the user chose it, and there is no notice. An Electron app can't host seven. Each further browser is an extra: an installed one is launched without a start page, and an endpoint is used as it is. Then the link is set up as for `slicc attach` (see [Local setup](#local-setup-slicc-attach)): over CDP with the browser that hosts seven, the first page tab on an allowed origin.
 
 **What the link offers:** `net` (tcp, resolve), `http`, and `cdp` with the browser that hosts seven (`seven: true`) and every extra, under the local policy with all of their debugging ports protected; and kernel services on `--kernel-port` (default 80; `--no-kernel` turns them off) when seven offers `kernel-in` (see [Kernel services](#kernel-services)); and `ssh` only with `--runner` (see [SSH server](#ssh-server)); and `fs` with each `--mount` folder (see [Host folders](#host-folders)). seven gets full control of every listed browser, the one it runs in too. The `cdp` list (HELLO `browsers`) has only the browser that hosts seven and the extras picked with `--browser` or in the picker; the other browsers discovery found are never offered.
 
@@ -202,6 +202,7 @@ The cdp list follows the browsers: an extra that stops answering is taken off th
 - `discovered`: `entries`, the ranked list in the shape of `slicc browsers --json` (always a list).
 - `launched`: `browser` (the id), `name`, `version?`, `role` (`seven` or `extra`), `pid`, `profile?`, `profileDir?`, `cdp`, `webSocketDebuggerUrl`.
 - `attached`: `browser`, `name`, `version?`, `role`, `launched?` (`true` when this run launched it), `cdp`, `webSocketDebuggerUrl?`. For `seven` slicc is connected to it over CDP; an `extra` is listed for `cdp`.
+- `foreign-browser`: `browser`, `name`, `profile?`, `cdp`, `openedTab` (`true` when slicc opened the seven tab, `false` when one was open). It follows `attached` when the browser hosting seven is an endpoint slicc didn't launch and the user didn't choose it (see above). The same line goes to stderr.
 - `linked`: `peer?` (the name in seven's HELLO), `tab?` (the seven tab's URL), `caps`, `policy` (the summary).
 - `link-lost`: `reason?` when slicc or seven closed the link (`slicc is exiting`, seven's `bye` reason, `replaced by a new offer`), or `message?` for a failure. seven sets the link up again after a reload, and a new `linked` follows.
 - `browser-gone`, `browser-back`: `browser`, `name`, `role`. A browser stopped answering and left the cdp list, or answers again and is back on it.
@@ -231,7 +232,7 @@ Lists running CDP endpoints and installed browsers, best match first. The browse
 
 Endpoints are merged by host and port. A `DevToolsActivePort` file wins over `--cdp`, which wins over the process list, which wins over the port probe. For each endpoint, `/json/version` gives the name, version and `webSocketDebuggerUrl`, and `/json/list` gives the seven tabs: `page` targets whose origin is `https://<label>.sliccy.ai`, other than `www` (`:443` is the same origin, any other port isn't). An endpoint's `cdp` has its host in lower case, with `localhost` and `::1` written as `127.0.0.1`. A `DevToolsActivePort` whose port is open but serves no `/json/version` (Chrome's opt-in remote debugging of a running browser) is listed as `wsOnly`, with the websocket URL from the file and no tab check.
 
-**Discovery only reads.** Every source, the port probe included, sends each endpoint `GET /json/version` and `GET /json/list` and nothing else: no WebSocket, no navigation, no new tab. Its HTTP client never follows a redirect (a `3xx` counts as no answer) and never uses a proxy from the environment. A `DevToolsActivePort` or `ws://` `--cdp` URL whose port serves no `/json/version` gets a TCP connect, closed at once, to tell `wsOnly` from stale. The targets in `/json/list` that aren't seven tabs are dropped as soon as the list is parsed: their URLs, titles and ids are never logged (`SLICC_DEBUG=1` included), cached, written to disk, printed (`--json`, the picker, plain mode), sent over the link, or put in telemetry or error messages. Only the seven tabs' `id`, `url` and `title` are kept. Attaching to a browser, and anything else that talks to it over CDP, happens only once a browser has been chosen to host seven (see [The default](#the-default-slicc)).
+**Discovery only reads.** Every source, the port probe included, sends each endpoint `GET /json/version` and `GET /json/list` and nothing else: no WebSocket, no navigation, no new tab. Its HTTP client never follows a redirect (a `3xx` counts as no answer) and never uses a proxy from the environment. The same client does every other read of a CDP endpoint: `/json/version` and the WebSocket handshake when `slicc` and `attach` connect, and the [`cdp`](#cdp-browser-control) capability's `/json/version` and WebSocket for each stream. A `DevToolsActivePort` or `ws://` `--cdp` URL whose port serves no `/json/version` gets a TCP connect, closed at once, to tell `wsOnly` from stale. The targets in `/json/list` that aren't seven tabs are dropped as soon as the list is parsed: their URLs, titles and ids are never logged (`SLICC_DEBUG=1` included), cached, written to disk, printed (`--json`, the picker, plain mode), sent over the link, or put in telemetry or error messages. Only the seven tabs' `id`, `url` and `title` are kept. Attaching to a browser, and anything else that talks to it over CDP, happens only once a browser has been chosen to host seven (see [The default](#the-default-slicc)).
 
 **Installed browsers**, by id: `chrome`, `edge`, `brave`, `opera`, `vivaldi`, `arc`, `atlas`, `dia`, `chrome-beta`, `chrome-dev`, `chrome-canary`, `brave-beta`, `brave-nightly`, `edge-beta`, `edge-dev`, `edge-canary`, `vivaldi-snapshot`, `chrome-for-testing`, `chromium`. Electron apps get `electron:<slug of the name>`, such as `electron:slack`. When a browser is found twice, the first find keeps the id.
 - **macOS:** `/Applications` and `~/Applications`, plus `mdfind` by bundle id. Name, version and executable come from each bundle's `Info.plist`. An app is an Electron app when it has `Contents/Frameworks/Electron Framework.framework` or `MSWebView2.framework`. `~/Applications/<Name> Debug.app` (a Sliccstart debug build) replaces `/Applications/<Name>.app`. Claude and 1Password block remote debugging and are listed with `debugSupport: "disabled"`. With `--no-bundle-scan`, nothing inside an app bundle is read except for debug builds, which avoids macOS App Management prompts: browsers are matched by bundle id or app name, Electron apps by a list of known bundle ids, and versions come from Spotlight (`mdls`). Those Electron apps have `debugSupport: "unknown"`.
@@ -357,6 +358,8 @@ slicc attach --cdp <url> [--cdp-extra <url>]... [--origin <origin>]... [--signal
    - `{ "t": "bye", "nonce", "reason" }`.
 5. slicc sends `answer`, its own `candidate`s and, when it exits, `bye` in the same shapes through `globalThis.sliccLinkReceive?.(message)`, in the same context.
 
+**What setup logs.** Status lines and `SLICC_DEBUG=1` diagnostics name only allowed origins. A context on another origin (an iframe, an extension) is logged as `ignored a context on another origin`, and a seven tab that navigates to another origin as `the seven tab left seven`, without the new origin.
+
 **Rules for incoming setup messages.**
 - A binding call counts only when it comes from that main-frame context and carries its nonce. Calls from iframes, workers, other contexts and other origins, and stale nonces, are ignored.
 - Each offer starts a new link and replaces the current one.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc",
-  "version": "1.29.2",
+  "version": "1.29.3",
   "description": "SLICC's command line for seven: links a machine's network, compute and browsers to seven over WebRTC",
   "license": "Apache-2.0",
   "repository": {
@@ -18,11 +18,11 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@ai-ecoverse/slicc-darwin-arm64": "1.29.2",
-    "@ai-ecoverse/slicc-darwin-amd64": "1.29.2",
-    "@ai-ecoverse/slicc-linux-arm64": "1.29.2",
-    "@ai-ecoverse/slicc-linux-amd64": "1.29.2",
-    "@ai-ecoverse/slicc-windows-arm64": "1.29.2",
-    "@ai-ecoverse/slicc-windows-amd64": "1.29.2"
+    "@ai-ecoverse/slicc-darwin-arm64": "1.29.3",
+    "@ai-ecoverse/slicc-darwin-amd64": "1.29.3",
+    "@ai-ecoverse/slicc-linux-arm64": "1.29.3",
+    "@ai-ecoverse/slicc-linux-amd64": "1.29.3",
+    "@ai-ecoverse/slicc-windows-arm64": "1.29.3",
+    "@ai-ecoverse/slicc-windows-amd64": "1.29.3"
   }
 }