@ai-ecoverse/slicc 1.47.2 → 1.47.3

package/README.md

@@ -813,6 +813,7 @@ Only browsers the user named are listed: the one seven runs in, `--cdp` and `--c
   - A target the stream attached to (`Target.attachToTarget`, or auto-attach that reached the page) or created (`Target.createTarget`) is *touched*, for as long as the stream is open, even after the page detached. That includes every tab the browser opens while the stream auto-attaches to new tabs.
   - On each touched page, iframe, background page or webview target the node attaches a session of its own, which the page never sees. On it, the node enables `Fetch` for document requests to protected hosts (`resourceType: Document`, request stage), and `Network` with `Network.setBypassServiceWorker`, so a service worker can't hand out a document without a request.
   - The node fails each such request into a protected origin with `Fetch.failRequest` (`BlockedByClient`), and the target shows Chrome's error page instead. Every other request continues untouched. So a touched target never loads a protected document, and nothing the stream installed on it (`Page.addScriptToEvaluateOnNewDocument`, `Fetch`, `Network`, `Page.setBypassCSP`, emulation, overrides) ever runs there.
+  - Before admitting content commands on a touched tab, the node reads fresh navigation history and target info on its own sessions. An uninitialized new tab also needs a fresh current-frame decision and a history retry. Missing evidence fails closed. If the tab's history has held a protected entry during this CDP stream, content commands stay refused, even after navigation away or a history reset. A blocked main-document request quarantines the tab before the node fails it. This includes script, DOM, input, screenshots, accessibility and target-session IO. Clean tabs keep their normal command path. CDP navigation still works; open a new tab to resume content commands. This conservative rule also applies to protected URLs that failed to load and to authorization flows that redirect through a protected callback.
   - Seven's own tab and its vault frame are never touched, because attaching to them is refused.
   - Page commands on a touched target's session wait, in order, until the node's own session there is ready; commands on other sessions of the stream don't wait. No page command on that session reaches the browser before the node's session is ready. The node's `Network.enable` and `Network.setBypassServiceWorker` answer only once the target's renderer does, which a loaded host can take a minute or more to start, so the wait has no fixed length. It fails closed on no progress, or at an outer bound:
     - **Progress** for a target whose setup is under way is the answer to the node's attach to it, or any answer or event on the node's own guard session for that target. Answers and events on the page's sessions, and on other targets, don't count, so a guard that stays silent fails at the 30 s bound even while the browser and the page stay busy. The node checks the bounds every quarter of the shorter one (7.5 s by default).
@@ -846,7 +847,7 @@ Only browsers the user named are listed: the one seven runs in, `--cdp` and `--c
 - **Protected URLs in what the page gets.** In every event and result the page gets, a URL field that holds a protected URL is cut to its origin, at any depth: every key ending in `url`, `urls`, `origin` or `origins` (any case, so `documentURL`, `unreachableUrl` and `securityOrigin` too), `referrer`, `location`, `href` and `src`, and every header value in `headers`, `requestHeaders` and `responseHeaders`. That covers `Page.frameRequestedNavigation`, `Page.frameNavigated`, `Network.requestWillBeSent`, `Page.windowOpen`, `Page.getFrameTree` and the rest. Every other string (header values such as `Link` and `Refresh`, `headersText` and `requestHeadersText`, cookie and storage values, DOM attributes) keeps its text, but each protected URL inside it (a `scheme://` run up to whitespace, a quote, `<` or `>`, a URL that doesn't parse included, and a run whose `://` is percent-encoded in whole or in part, such as `scheme%3A%2F%2F` or `scheme%3A//`, up to those or a raw `&`, decoded once; a doubly encoded one isn't decoded) is cut to its origin, and next to a protected URL field every field ending in `Fragment` (`urlFragment` of a request or frame) is blanked to `""`, while ordinary URLs keep theirs, so a redirect from an ordinary page to seven's `/auth/callback?code=…` shows the page only seven's origin, wherever it names that URL. Unprotected URLs stay intact. Everything inside a `value`, `preview`, `customPreview`, `arguments` or `returnValue` (evaluation results and their previews) is left alone.
 - **Limits.**
   - The filter relies on Chrome's site isolation. A seven frame inside a page of another site is a target of its own (`iframe`), which the node protects. A page the stream never touched can still frame seven, though, and once the stream touches that page, a screenshot of it shows the frame. A same-site frame shares its parent's process and isn't a target. Every `sliccy.ai` host is protected, so this only matters for an extra origin, such as one port of `127.0.0.1` framed by a page on another.
-  - A document that arrives without a request isn't failed: a page restored from the back/forward cache, and a `blob:` or `filesystem:` URL of a protected origin (which only that origin can make). The node detaches after the commit, as above, and commands that were already on their way may still have run in the new page.
+  - A document that arrives without a request isn't failed: a page restored from the back/forward cache, and a `blob:` or `filesystem:` URL of a protected origin (which only that origin can make). Targets with protected history are content-locked before commands can race a restore, regardless of delayed commit events. The node still detaches after a protected commit. Navigation initiated outside the stream after fresh evidence, including loads already in flight before the guard was installed, remains a limit; this does not authorize content commands on a quarantined target.
   - The network guard fails only `http` and `https` documents. Chrome itself keeps a web page from navigating to `chrome:`, `chrome-untrusted:`, `devtools:` and `file:` URLs, but not to an extension's web-accessible pages. A touched page that sends itself to one with a script or a link is detached after the commit, as above.
   - If the node loses its own session (`ECONNRESET: slicc lost track of the browser's targets`), it refuses every command and resets the stream unless the browser closes within 2 s.
   - The node's own setup connection (see [Local setup](#local-setup-slicc-attach)) is not a `cdp` stream and isn't filtered.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc",
-  "version": "1.47.2",
+  "version": "1.47.3",
   "description": "SLICC's command line for seven: links a machine's network, compute and browsers to seven over WebRTC",
   "license": "Apache-2.0",
   "repository": {
@@ -18,12 +18,12 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@ai-ecoverse/slicc-darwin-arm64": "1.47.2",
-    "@ai-ecoverse/slicc-darwin-amd64": "1.47.2",
-    "@ai-ecoverse/slicc-linux-arm64": "1.47.2",
-    "@ai-ecoverse/slicc-linux-amd64": "1.47.2",
-    "@ai-ecoverse/slicc-windows-arm64": "1.47.2",
-    "@ai-ecoverse/slicc-windows-amd64": "1.47.2",
-    "@ai-ecoverse/slicc-jerk": "^1.2.1"
+    "@ai-ecoverse/slicc-darwin-arm64": "1.47.3",
+    "@ai-ecoverse/slicc-darwin-amd64": "1.47.3",
+    "@ai-ecoverse/slicc-linux-arm64": "1.47.3",
+    "@ai-ecoverse/slicc-linux-amd64": "1.47.3",
+    "@ai-ecoverse/slicc-windows-arm64": "1.47.3",
+    "@ai-ecoverse/slicc-windows-amd64": "1.47.3",
+    "@ai-ecoverse/slicc-jerk": "^1.2.2"
   }
 }