@ai-ecoverse/slicc 1.49.8 → 1.49.9

package/README.md

@@ -843,6 +843,9 @@ Only browsers the user named are listed: the one seven runs in, `--cdp` and `--c
   - If the page asked for `waitForDebuggerOnStart`, the node runs `Runtime.runIfWaitingForDebugger` on it itself.
   - Once the target has a URL (`Target.targetInfoChanged`), a protected target's session is detached without the page seeing it. Otherwise the page gets `attachedToTarget` with the current `targetInfo` and `waitingForDebugger: false`. The target has already started, so a script the page adds for new documents in such a frame or popup misses its first one.
   - A target that has no URL after 10 s is treated as protected. A session that the node does forward makes the target touched (see above).
+- **Session-wide settings are refused on every relay session, including ordinary pages.** `Network.setExtraHTTPHeaders`, `Network.setUserAgentOverride`, `Emulation.setUserAgentOverride`, `Emulation.setLocaleOverride`, `Emulation.setTimezoneOverride`, `Network.setCacheDisabled`, `Network.emulateNetworkConditions`, `Network.emulateNetworkConditionsByRule`, `Network.overrideNetworkState`, `Network.setBlockedURLs`, and every method matching `/^Emulation\.(set|add|update|remove)[A-Z]/` receive `slicc: refused: settings for a whole session (headers, user agent, locale, time zone, cache, network conditions, blocked URLs, emulation) could reach seven’s pages or the vault, so the guard doesn’t allow them; change a request through Fetch instead`. These calls are never forwarded or answered with fake success.
+- **Browser-side inheriting navigation is refused.** `Page.navigate` to any `about:` URL, including `about:blank` and `about:srcdoc`, receives `slicc: refused: a browser-side navigation to about: gives the page the origin of whatever drives the browser, so the guard doesn’t send it; open a new tab on about:blank instead`. An absent or unparseable navigation URL receives the same error. Creating a fresh tab with `Target.createTarget` on `about:blank` remains available.
+
 - **Listing.** `Target.getTargets`, `Target.getTargetInfo`, `Target.targetCreated` and `Target.targetInfoChanged` still show protected targets, so seven knows its tab exists, but their `url` and `title` are only the origin (`https://seven.sliccy.ai`, `chrome://settings`, `chrome-extension://<id>`, or `about:blank`), or only the scheme for a URL without a host (`file:`). A target whose URL slicc can't parse isn't listed at all, since it has no origin to show: `Target.getTargets` leaves it out, and its `targetCreated` and `targetInfoChanged` are dropped. A target of a `targetTypes` type (`browser_ui`) is never shown: `Target.getTargets` leaves it out, its `targetCreated`, `targetInfoChanged`, `targetDestroyed` and `targetCrashed` are dropped, and `Target.getTargetInfo` on its id is refused like any other command that names it. Service worker registrations and versions on a protected origin are left out of `ServiceWorker` events, and `Storage`, `DOMStorage` and `BackgroundService` events that name a protected origin are dropped.
 - **Protected URLs in what the page gets.** In every event and result the page gets, a URL field that holds a protected URL is cut to its origin, at any depth: every key ending in `url`, `urls`, `origin` or `origins` (any case, so `documentURL`, `unreachableUrl` and `securityOrigin` too), `referrer`, `location`, `href` and `src`, and every header value in `headers`, `requestHeaders` and `responseHeaders`. That covers `Page.frameRequestedNavigation`, `Page.frameNavigated`, `Network.requestWillBeSent`, `Page.windowOpen`, `Page.getFrameTree` and the rest. Every other string (header values such as `Link` and `Refresh`, `headersText` and `requestHeadersText`, cookie and storage values, DOM attributes) keeps its text, but each protected URL inside it (a `scheme://` run up to whitespace, a quote, `<` or `>`, a URL that doesn't parse included, and a run whose `://` is percent-encoded in whole or in part, such as `scheme%3A%2F%2F` or `scheme%3A//`, up to those or a raw `&`, decoded once; a doubly encoded one isn't decoded) is cut to its origin, and next to a protected URL field every field ending in `Fragment` (`urlFragment` of a request or frame) is blanked to `""`, while ordinary URLs keep theirs, so a redirect from an ordinary page to seven's `/auth/callback?code=…` shows the page only seven's origin, wherever it names that URL. Unprotected URLs stay intact. Everything inside a `value`, `preview`, `customPreview`, `arguments` or `returnValue` (evaluation results and their previews) is left alone.
 - **Limits.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc",
-  "version": "1.49.8",
+  "version": "1.49.9",
   "description": "SLICC's command line for seven: links a machine's network, compute and browsers to seven over WebRTC",
   "license": "Apache-2.0",
   "repository": {
@@ -18,12 +18,12 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@ai-ecoverse/slicc-darwin-arm64": "1.49.8",
-    "@ai-ecoverse/slicc-darwin-amd64": "1.49.8",
-    "@ai-ecoverse/slicc-linux-arm64": "1.49.8",
-    "@ai-ecoverse/slicc-linux-amd64": "1.49.8",
-    "@ai-ecoverse/slicc-windows-arm64": "1.49.8",
-    "@ai-ecoverse/slicc-windows-amd64": "1.49.8",
+    "@ai-ecoverse/slicc-darwin-arm64": "1.49.9",
+    "@ai-ecoverse/slicc-darwin-amd64": "1.49.9",
+    "@ai-ecoverse/slicc-linux-arm64": "1.49.9",
+    "@ai-ecoverse/slicc-linux-amd64": "1.49.9",
+    "@ai-ecoverse/slicc-windows-arm64": "1.49.9",
+    "@ai-ecoverse/slicc-windows-amd64": "1.49.9",
     "@ai-ecoverse/slicc-jerk": "^1.2.3"
   }
 }