@ai-ecoverse/slicc 1.46.2 → 1.46.3

package/README.md

@@ -1692,7 +1692,12 @@ On a [§1.3](#13-local-setup-without-cdp-loopback-signalling) loopback link, `un
     - **Breakpoint conditions** run in whatever world the script belongs to, and a breakpoint by URL outlives reloads. So on those sessions a `Debugger.setBreakpointByUrl` with a `condition` needs a non-empty `url`, which can't name a protected script (see above). One by `urlRegex` or `scriptHash` or with an empty `url` is refused with `slicc: refused: a breakpoint condition that could run in a browser extension's world needs a url naming the page's own script`. Breakpoints without a condition are allowed; a pause they cause in a hidden world is resumed out of sight.
     - **Profiles, coverage, stacks and initiators** can name any script in the isolate. So the node scrubs every message it sends the page, events and command results alike, outside opaque values (`value`, `preview`, `customPreview`, `arguments`, `returnValue`). Any `callFrames` list loses the frames on a protected URL or in a hidden world's script. That covers console, exception, pause, async, node-creation and initiator stacks, whatever the method. A coverage or type-profile list (entries with `scriptId` and `functions` or `entries`) also loses its entries for scripts without a URL. A profile node's `callFrame` in such a script becomes `(program)` and loses its `positionTicks`. An `initiator` on a protected `url` loses that `url` and its position.
     - **Messages without a context:** on page-like sessions, the node drops `Console.messageAdded` whose `url` is empty or protected. It drops `Log.entryAdded` on a protected `url` or with a stack through such a frame. It drops `Profiler.consoleProfileStarted` and `consoleProfileFinished` altogether: they name no context, so the node can't tell whose `console.profile` they are.
-    - **Requests and sockets a hidden world starts:** a `Network.requestWillBeSent`, `webSocketCreated` or `webTransportCreated` whose initiator stack runs through a frame on a protected URL or in a hidden script, or whose initiator `url` is protected, loses those frames and that URL. The node treats it like a request to a protected origin: cookie headers are stripped, and its bodies are refused.
+    - **Requests and sockets a hidden world starts:** a `Network.requestWillBeSent`, `webSocketCreated` or `webTransportCreated` whose initiator stack runs through a frame on a protected URL or in a hidden script, or whose initiator `url` is protected, marks the request as the hidden world's (a WebTransport by its `transportId`). The node learns this on its own guard session as well as on the stream's sessions. Every later message to the page that names that request anywhere in its params or result, by `requestId`, `networkId`, `transportId` or any `…RequestId` (such as `Log`'s `networkRequestId`), is cut as a whole, and a `Log.entryAdded` about it is dropped. That includes extra-info events and nested references such as an `Audits` issue's affected request:
+      - every URL is cut to its origin;
+      - header maps are emptied;
+      - `postData`, `postDataEntries`, `headersText`, `requestHeadersText` and the cookie lists are removed.
+
+      The request is also treated like one to a protected origin on every session of the target, including sessions that missed its start, so its bodies and post data are refused and it can't be replayed. A pause of such a request (`Fetch.requestPaused`/`authRequired`, `Network.requestIntercepted`) is continued by the node and never shown to the page. A `Fetch.authRequired`, which carries no `networkId`, is answered by the node (`Default`) when its Fetch `requestId` belongs to such a pause. A pause whose request (`networkId` for `Fetch`, `requestId` for `Network.requestIntercepted`) the guard session hasn't reported yet waits up to 2 s for it. Past 4096 waiting pauses, the node continues further ones itself instead of showing them. A target with more than 65536 such requests fails closed: every request there is cut.
 
 #### 5.8.1 `browsers` updates (page cap `browsers`), node → page
 - **When:** the browser list changes while a link is up (a browser quits, or the TUI adds one). The node then opens `OPEN { "kind": "browsers", "browsers": [ … ] }` on the control channel, carrying the **full** current list in HELLO's shape. It replaces the previous list; there are no deltas.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc",
-  "version": "1.46.2",
+  "version": "1.46.3",
   "description": "SLICC's command line for seven: links a machine's network, compute and browsers to seven over WebRTC",
   "license": "Apache-2.0",
   "repository": {
@@ -18,12 +18,12 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@ai-ecoverse/slicc-darwin-arm64": "1.46.2",
-    "@ai-ecoverse/slicc-darwin-amd64": "1.46.2",
-    "@ai-ecoverse/slicc-linux-arm64": "1.46.2",
-    "@ai-ecoverse/slicc-linux-amd64": "1.46.2",
-    "@ai-ecoverse/slicc-windows-arm64": "1.46.2",
-    "@ai-ecoverse/slicc-windows-amd64": "1.46.2",
+    "@ai-ecoverse/slicc-darwin-arm64": "1.46.3",
+    "@ai-ecoverse/slicc-darwin-amd64": "1.46.3",
+    "@ai-ecoverse/slicc-linux-arm64": "1.46.3",
+    "@ai-ecoverse/slicc-linux-amd64": "1.46.3",
+    "@ai-ecoverse/slicc-windows-arm64": "1.46.3",
+    "@ai-ecoverse/slicc-windows-amd64": "1.46.3",
     "@ai-ecoverse/slicc-jerk": "^1.0.0"
   }
 }