@ai-ecoverse/slicc 1.47.1 → 1.47.3

package/README.md

@@ -394,7 +394,7 @@ The cdp list follows the browsers: an extra that stops answering is taken off th
 - `launched`: `browser` (the id), `name`, `version?`, `role` (`seven` or `extra`), `pid`, `profile?`, `profileDir?`, `cdp`, `webSocketDebuggerUrl`.
 - `attached`: `browser`, `name`, `version?`, `role`, `launched?` (`true` when this run launched it), `cdp`, `webSocketDebuggerUrl?`. For `seven` slicc is connected to it over CDP; an `extra` is listed for `cdp`.
 - `foreign-browser`: `browser`, `name`, `profile?`, `cdp`, `openedTab` (`true` when slicc opened the seven tab, `false` when one was open). It follows `attached` when the browser hosting seven is an endpoint slicc didn't launch and the user didn't choose it (see above), and always when it is SLICC six's Chrome, with `profile` `six` or `six:<port>`. The same line goes to stderr.
-- `linked`: `peer?` (the name in seven's HELLO), `tab?` (the seven tab's URL), `caps`, `policy` (the summary).
+- `linked`: `peer?` (the name in seven's HELLO), `tab?` (the seven tab's origin, never its path or fragment), `caps`, `policy` (the summary).
 - `link-lost`: `reason?` when slicc or seven closed the link (`slicc is exiting`, `slicc is relinking`, seven's `bye` reason, `replaced by a new offer`), or `message?` for a failure. seven sets the link up again after a reload, and a new `linked` follows.
 - `browser-gone`, `browser-back`: `browser`, `name`, `role`. A browser stopped answering and left the cdp list, or answers again and is back on it.
 - `browser-slow`: `browser`, `name`, `role`, `elapsed` (seconds). A browser slicc launched hasn't written its `DevToolsActivePort` yet, every 10 s from 10 s on (see [`slicc launch`](#slicc-launch---browser-id---profile-name---url-url---headless---no-seven-flags---json)). The dashboard and plain mode show it as `<name> is still starting (slow disk?), <n> s so far`.
@@ -407,7 +407,7 @@ The cdp list follows the browsers: an extra that stops answering is taken off th
 {"schema":1,"event":"discovered","entries":[…]}
 {"schema":1,"event":"launched","browser":"chrome","name":"Google Chrome","version":"154.0.8037.98","role":"seven","pid":4242,"profile":"chrome","profileDir":"…/slicc/seven-profiles/chrome","cdp":"http://127.0.0.1:53211","webSocketDebuggerUrl":"ws://127.0.0.1:53211/devtools/browser/…"}
 {"schema":1,"event":"attached","browser":"chrome","name":"Google Chrome","version":"154.0.8037.98","role":"seven","launched":true,"cdp":"http://127.0.0.1:53211","webSocketDebuggerUrl":"ws://127.0.0.1:53211/devtools/browser/…"}
-{"schema":1,"event":"linked","tab":"https://seven.sliccy.ai/","peer":"seven","caps":["net","http","credentialed","ws","cdp"],"policy":"every public address, this machine, and the local network"}
+{"schema":1,"event":"linked","tab":"https://seven.sliccy.ai","peer":"seven","caps":["net","http","credentialed","ws","cdp"],"policy":"every public address, this machine, and the local network"}
 {"schema":1,"event":"link-lost","reason":"slicc is exiting"}
 {"schema":1,"event":"closed","browsers":["chrome"]}
 ```
@@ -461,7 +461,7 @@ Endpoints are merged by host and port. A `DevToolsActivePort` file wins over `--
         "browser": "chrome",
         "userDataDir": "/Users/me/Library/Application Support/Google/Chrome",
         "sevenOpen": true,
-        "sevenTabs": [{ "id": "…", "url": "https://lars.sliccy.ai/", "title": "seven" }]
+        "sevenTabs": [{ "id": "…", "url": "https://lars.sliccy.ai", "title": "https://lars.sliccy.ai" }]
       }
     },
     {
@@ -488,7 +488,7 @@ Endpoints are merged by host and port. A `DevToolsActivePort` file wins over `--
 ```
 
 - Entry: `id` (an installed id, or `cdp:<host>:<port>`), `kind` (`endpoint` or `installed`), `tier` (1–6), `name`, `version?`, and either `endpoint` or `installed`.
-- `endpoint`: `cdp` (the HTTP base URL), `webSocketDebuggerUrl`, `name`, `version?`, `product?` and `userAgent?` (from `/json/version`), `source` (`devtools-active-port`, `flag`, `process` or `probe`), `browser?` (the installed id whose user-data dir held the file), `userDataDir?` (the dir that held the file, or a process's `--user-data-dir`), `profile?` (the SLICC profile name), `wsOnly?`, `six?` (`true` for SLICC six's Chrome), `sevenOpen`, `sevenTabs` (always a list).
+- `endpoint`: `cdp` (the HTTP base URL), `webSocketDebuggerUrl`, `name`, `version?`, `product?` and `userAgent?` (from `/json/version`), `source` (`devtools-active-port`, `flag`, `process` or `probe`), `browser?` (the installed id whose user-data dir held the file), `userDataDir?` (the dir that held the file, or a process's `--user-data-dir`), `profile?` (the SLICC profile name), `wsOnly?`, `six?` (`true` for SLICC six's Chrome), `sevenOpen`, `sevenTabs` (always a list; each tab's `url` and `title` are its origin, as the CDP relay shows them).
 - `installed`: `id`, `name`, `engine` (`chromium` or `electron`), `channel?`, `version?`, `path` (the `.app`, executable or flatpak dir), `executable` (for a flatpak, the `flatpak` binary), `bundleId?`, `via?` (`snap` or `flatpak`), `package?` (the snap or flatpak id), `userDataDir?` (the browser's default), `debugSupport` (`supported`, `disabled` or `unknown`), `debugBuild?`.
 
 Without `--json`, the same list is a table: id, name, version, state and where. The state of six's Chrome ends with `SLICC six's profile`.
@@ -813,6 +813,7 @@ Only browsers the user named are listed: the one seven runs in, `--cdp` and `--c
   - A target the stream attached to (`Target.attachToTarget`, or auto-attach that reached the page) or created (`Target.createTarget`) is *touched*, for as long as the stream is open, even after the page detached. That includes every tab the browser opens while the stream auto-attaches to new tabs.
   - On each touched page, iframe, background page or webview target the node attaches a session of its own, which the page never sees. On it, the node enables `Fetch` for document requests to protected hosts (`resourceType: Document`, request stage), and `Network` with `Network.setBypassServiceWorker`, so a service worker can't hand out a document without a request.
   - The node fails each such request into a protected origin with `Fetch.failRequest` (`BlockedByClient`), and the target shows Chrome's error page instead. Every other request continues untouched. So a touched target never loads a protected document, and nothing the stream installed on it (`Page.addScriptToEvaluateOnNewDocument`, `Fetch`, `Network`, `Page.setBypassCSP`, emulation, overrides) ever runs there.
+  - Before admitting content commands on a touched tab, the node reads fresh navigation history and target info on its own sessions. An uninitialized new tab also needs a fresh current-frame decision and a history retry. Missing evidence fails closed. If the tab's history has held a protected entry during this CDP stream, content commands stay refused, even after navigation away or a history reset. A blocked main-document request quarantines the tab before the node fails it. This includes script, DOM, input, screenshots, accessibility and target-session IO. Clean tabs keep their normal command path. CDP navigation still works; open a new tab to resume content commands. This conservative rule also applies to protected URLs that failed to load and to authorization flows that redirect through a protected callback.
   - Seven's own tab and its vault frame are never touched, because attaching to them is refused.
   - Page commands on a touched target's session wait, in order, until the node's own session there is ready; commands on other sessions of the stream don't wait. No page command on that session reaches the browser before the node's session is ready. The node's `Network.enable` and `Network.setBypassServiceWorker` answer only once the target's renderer does, which a loaded host can take a minute or more to start, so the wait has no fixed length. It fails closed on no progress, or at an outer bound:
     - **Progress** for a target whose setup is under way is the answer to the node's attach to it, or any answer or event on the node's own guard session for that target. Answers and events on the page's sessions, and on other targets, don't count, so a guard that stays silent fails at the 30 s bound even while the browser and the page stay busy. The node checks the bounds every quarter of the shorter one (7.5 s by default).
@@ -836,7 +837,7 @@ Only browsers the user named are listed: the one seven runs in, `--cdp` and `--c
     - enable or disable the `Page`, `Runtime`, `Target`, `Inspector`, `Network`, `Log` and `Fetch` domains, and settle its own interceptions (`Fetch.continueRequest`, `continueResponse`, `failRequest`, `fulfillRequest`, `continueWithAuth`, `Network.continueInterceptedRequest`), so a navigation away that the page intercepts never hangs;
     - and use `Target.setAutoAttach`, `detachFromTarget`, `closeTarget`, `getTargetInfo` and `activateTarget`.
 
-    Anything else (`Runtime.evaluate`, `DOM.*`, snapshots, screenshots and so on) is refused with `slicc: refused: the target shows Chrome's error page for a protected URL, which names it; slicc only lets a page navigate, reload or close it`. Events on its sessions are filtered too: only `Target.*`, `Inspector.*`, `Network.*`, `Fetch.*`, the `Runtime` execution-context events and the `Page` navigation, loading, frame, lifecycle, window, download and interstitial events reach the page. So console messages, exceptions, `Log` entries, `DOM`, `CSS`, `Overlay` and `Debugger` events, and `Page.screencastFrame` (a screencast the page started before the tab failed would show the error page) are dropped. The node also remembers the last 16 protected URLs a target's error pages failed to load, and replaces each of them, as is and in its percent-encoded and decoded forms, with its origin in every string of every message on that target's sessions, opaque values (`value`, `preview`, `arguments`, `returnValue`) included. A command the page sent on the target's sessions before such a commit, other than the allowed ones above, can't answer from the error page either: if its answer arrives after the commit, the page gets `slicc: refused: the target committed Chrome's error page for a protected URL while this command ran, so slicc dropped its answer` instead (a screenshot, PDF or evaluation in flight would otherwise show the error page). Its URL and title are still redacted to the origin in listings and target events. Chrome's error pages for other URLs stay fully readable. The node tracks each touched target's main frame on its guard session (`Page.enable`): the last different-document commit (`Page.frameNavigated`) was an error page when it has an `unreachableUrl`, and that holds only while the target reports exactly that URL and no navigation is under way (`Page.frameStartedNavigating`, other than same-document, until its `Page.frameNavigated`, its document request's `Network.loadingFailed`, or the frame's `Page.frameStoppedLoading`, which also ends any doubt from an event the node couldn't read or from more than 64 navigations in flight, since nothing is in flight once the frame stops loading). Otherwise, or before the guard is ready, a protected URL locks the target as above. An error page neither locks nor unlocks: a target that was already protected stays so. An error page for a URL slicc can't parse is never exempt: it locks, as the unparseable rule says.
+    Anything else (`Runtime.evaluate`, `DOM.*`, snapshots, screenshots and so on) is refused with `slicc: refused: the target shows Chrome's error page for a protected URL, which names it; slicc only lets a page navigate, reload or close it`. Events on its sessions are filtered too: only `Target.*`, `Inspector.*`, `Network.*`, `Fetch.*`, the `Runtime` execution-context events and the `Page` navigation, loading, frame, lifecycle, window, download and interstitial events reach the page. So console messages, exceptions, `Log` entries, `DOM`, `CSS`, `Overlay` and `Debugger` events, and `Page.screencastFrame` (a screencast the page started before the tab failed would show the error page) are dropped. The node also remembers the last 16 protected URLs a target's error pages failed to load, and replaces each of them, as is and in its percent-encoded and decoded forms, with its origin in every string of every message on that target's sessions, opaque values (`value`, `preview`, `arguments`, `returnValue`) included. A command the page sent on the target's sessions before such a commit, other than the allowed ones above, can't answer from the error page either: if its answer arrives after the commit, the page gets `slicc: refused: the target committed Chrome's error page for a protected URL while this command ran, so slicc dropped its answer` instead (a screenshot, PDF or evaluation in flight would otherwise show the error page). Its URL and title are still redacted to the origin in listings and target events. Chrome's error pages for other URLs stay fully readable. The node tracks each touched target's main frame on its guard session (`Page.enable`): the last different-document commit (`Page.frameNavigated`) was an error page when its document is `chrome-error://chromewebdata/` (slicc-browsers' `errorPage.url`, whose `target` is `previous`) and it has an `unreachableUrl`, and that holds only while the target reports exactly that URL and no navigation is under way (`Page.frameStartedNavigating`, other than same-document, until its `Page.frameNavigated`, its document request's `Network.loadingFailed`, or the frame's `Page.frameStoppedLoading`, which also ends any doubt from an event the node couldn't read or from more than 64 navigations in flight, since nothing is in flight once the frame stops loading). Otherwise, or before the guard is ready, a protected URL locks the target as above. An error page neither locks nor unlocks: a target that was already protected stays so. An error page for a URL slicc can't parse is never exempt: it locks, as the unparseable rule says. That's stricter than slicc-browsers' `errorPage` rule, which exempts any URL's error page (nothing loaded there, so the unparseable case opens no hole the parseable one doesn't). slicc-browsers accepts it as over-protection, and no shared vector forces either answer.
 - **Auto-attach of targets without a URL.** A cross-site iframe can attach before its URL is known (`url: ""`, which stays empty while it waits for the debugger), and so can a `window.open` popup. So when an auto-attached session (one that doesn't answer the page's own `Target.attachToTarget`) is to a page or iframe target with an empty URL, the node holds it:
   - The page doesn't get its `attachedToTarget` yet, its events are dropped, and page commands on it are refused.
   - If the page asked for `waitForDebuggerOnStart`, the node runs `Runtime.runIfWaitingForDebugger` on it itself.
@@ -846,7 +847,7 @@ Only browsers the user named are listed: the one seven runs in, `--cdp` and `--c
 - **Protected URLs in what the page gets.** In every event and result the page gets, a URL field that holds a protected URL is cut to its origin, at any depth: every key ending in `url`, `urls`, `origin` or `origins` (any case, so `documentURL`, `unreachableUrl` and `securityOrigin` too), `referrer`, `location`, `href` and `src`, and every header value in `headers`, `requestHeaders` and `responseHeaders`. That covers `Page.frameRequestedNavigation`, `Page.frameNavigated`, `Network.requestWillBeSent`, `Page.windowOpen`, `Page.getFrameTree` and the rest. Every other string (header values such as `Link` and `Refresh`, `headersText` and `requestHeadersText`, cookie and storage values, DOM attributes) keeps its text, but each protected URL inside it (a `scheme://` run up to whitespace, a quote, `<` or `>`, a URL that doesn't parse included, and a run whose `://` is percent-encoded in whole or in part, such as `scheme%3A%2F%2F` or `scheme%3A//`, up to those or a raw `&`, decoded once; a doubly encoded one isn't decoded) is cut to its origin, and next to a protected URL field every field ending in `Fragment` (`urlFragment` of a request or frame) is blanked to `""`, while ordinary URLs keep theirs, so a redirect from an ordinary page to seven's `/auth/callback?code=…` shows the page only seven's origin, wherever it names that URL. Unprotected URLs stay intact. Everything inside a `value`, `preview`, `customPreview`, `arguments` or `returnValue` (evaluation results and their previews) is left alone.
 - **Limits.**
   - The filter relies on Chrome's site isolation. A seven frame inside a page of another site is a target of its own (`iframe`), which the node protects. A page the stream never touched can still frame seven, though, and once the stream touches that page, a screenshot of it shows the frame. A same-site frame shares its parent's process and isn't a target. Every `sliccy.ai` host is protected, so this only matters for an extra origin, such as one port of `127.0.0.1` framed by a page on another.
-  - A document that arrives without a request isn't failed: a page restored from the back/forward cache, and a `blob:` or `filesystem:` URL of a protected origin (which only that origin can make). The node detaches after the commit, as above, and commands that were already on their way may still have run in the new page.
+  - A document that arrives without a request isn't failed: a page restored from the back/forward cache, and a `blob:` or `filesystem:` URL of a protected origin (which only that origin can make). Targets with protected history are content-locked before commands can race a restore, regardless of delayed commit events. The node still detaches after a protected commit. Navigation initiated outside the stream after fresh evidence, including loads already in flight before the guard was installed, remains a limit; this does not authorize content commands on a quarantined target.
   - The network guard fails only `http` and `https` documents. Chrome itself keeps a web page from navigating to `chrome:`, `chrome-untrusted:`, `devtools:` and `file:` URLs, but not to an extension's web-accessible pages. A touched page that sends itself to one with a script or a link is detached after the commit, as above.
   - If the node loses its own session (`ECONNRESET: slicc lost track of the browser's targets`), it refuses every command and resets the stream unless the browser closes within 2 s.
   - The node's own setup connection (see [Local setup](#local-setup-slicc-attach)) is not a `cdp` stream and isn't filtered.
@@ -2156,7 +2157,7 @@ semantic-release cuts releases from `main` in `.github/workflows/release.yml`. T
 2. `scripts/package.sh <version>` builds `darwin`, `linux` and `windows` × `amd64`, `arm64` with `CGO_ENABLED=0`, `-trimpath`, `-buildvcs=false` and `-X main.version=<version>`, and `slicc-wasip1-wasm.wasm` (`GOOS=wasip1 GOARCH=wasm`) the same way, with the Go toolchain `go.mod` names (see [Reproducing a release](#reproducing-a-release)). It signs and notarizes the darwin binaries and writes `SHA256SUMS`. The windows and linux binaries are not signed. Without the Apple signing secrets (forks, pull requests) it warns and leaves the darwin binaries unsigned.
 3. (still in `build`) `scripts/npm-stage.mjs` stages `@ai-ecoverse/slicc` and the six platform packages into `dist/npm/`. It also stages the same launcher as `sliccy` (with two bins, `sliccy` and `slicc`, and a short preview README) into `dist/npm-next/`, as version `7.0.0-next.<version>`, with exact `optionalDependencies` on this release's platform packages. `npx sliccy@next` runs the bin named after the package, `sliccy`, and both bins run the same launcher. `--bin <name>` (repeatable) overrides the bins of any staged launcher. `--wasi` also stages `@ai-ecoverse/wasi-slicc` into `dist/npm/wasi-slicc/` from `slicc-wasip1-wasm.wasm` and `npm/wasi-slicc/host/slicc-host.mjs`, with README.md's [Inside seven](#inside-seven) section as its README; `--wasi-only` stages only that package.
 4. The `release` job unpacks the build, checking its `dist/VERSION` against the planned version, and `actions/attest-build-provenance` attests every binary, the `.wasm` included, through `SHA256SUMS`.
-5. semantic-release checks the version again (`dist/VERSION`, and `scripts/go-major.mjs`, see below), tags, creates the GitHub release with every binary and `SHA256SUMS`, then `scripts/npm-publish.mjs` publishes the platform packages and the launcher through npm trusted publishing (OIDC, with provenance), and then `sliccy` with `--tag next`. Versions already on npm are skipped. Before publishing `sliccy`, the script checks that every exact-pinned `optionalDependencies` version is on the registry, waits up to `SLICC_REGISTRY_WAIT_SECONDS` (default 900) for freshly published ones to appear, and fails otherwise (exit code 3), so a `sliccy` version never points at missing platform packages.
+5. semantic-release checks the version again (`dist/VERSION`, and `scripts/go-major.mjs`, see below), tags, creates the GitHub release with every binary and `SHA256SUMS`, then `scripts/npm-publish.mjs` publishes the platform packages and the launcher through npm trusted publishing (OIDC, with provenance), and then `sliccy` with `--tag next`. Versions already on npm are skipped. Before publishing `sliccy`, the script checks that every exact-pinned `optionalDependencies` version is on the registry, waits up to `SLICC_REGISTRY_WAIT_SECONDS` (default 900) for freshly published ones to appear, and fails otherwise (exit code 3), so a `sliccy` version never points at missing platform packages. Then the `release` job asks `git ls-remote` whether `v<version>` is on `origin` at the commit it built, and only then outputs the version. When semantic-release published nothing (for example because `main` moved on during the full matrix, so the checkout is behind), there is no output: `install-smoke` and `sliccy-next` skip, and the run stays green with no `release-red` issue. An `origin` it can't read fails the job.
 6. `scripts/go-warm.sh <version>`, once the tag is on `origin`, asks `proxy.golang.org` for the module at `v<version>` (`go list -m` with a scratch module cache) and asks `pkg.go.dev` to fetch it. The proxy fetch is retried briefly; the `pkg.go.dev` fetch is one attempt of at most 10 s, since the proxy fetch already gets the version indexed. Both only warn, and the step can't fail the release.
 
 **Certification in the pull request** (`.github/workflows/cert-review-pr.yml`, `tools/cert-review/`). Every same-repo pull request gets the commit status `cert-review` on its head, which the merge queue requires beside `ci`. Fork pull requests get none: only Lars merges one. Every tool runs from the pull request's base commit, main's copy, never from the code under test, which is only built and tested; the review uses `refs/pull/N/merge` and records its first parent and the head.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc",
-  "version": "1.47.1",
+  "version": "1.47.3",
   "description": "SLICC's command line for seven: links a machine's network, compute and browsers to seven over WebRTC",
   "license": "Apache-2.0",
   "repository": {
@@ -18,12 +18,12 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@ai-ecoverse/slicc-darwin-arm64": "1.47.1",
-    "@ai-ecoverse/slicc-darwin-amd64": "1.47.1",
-    "@ai-ecoverse/slicc-linux-arm64": "1.47.1",
-    "@ai-ecoverse/slicc-linux-amd64": "1.47.1",
-    "@ai-ecoverse/slicc-windows-arm64": "1.47.1",
-    "@ai-ecoverse/slicc-windows-amd64": "1.47.1",
-    "@ai-ecoverse/slicc-jerk": "^1.2.1"
+    "@ai-ecoverse/slicc-darwin-arm64": "1.47.3",
+    "@ai-ecoverse/slicc-darwin-amd64": "1.47.3",
+    "@ai-ecoverse/slicc-linux-arm64": "1.47.3",
+    "@ai-ecoverse/slicc-linux-amd64": "1.47.3",
+    "@ai-ecoverse/slicc-windows-arm64": "1.47.3",
+    "@ai-ecoverse/slicc-windows-amd64": "1.47.3",
+    "@ai-ecoverse/slicc-jerk": "^1.2.2"
   }
 }