@ai-ecoverse/slicc-browsers 1.12.0 → 1.13.1

package/README.md

@@ -67,6 +67,8 @@ Every feature builds for `wasm32-wasip1`.
 
 `protected.mjs` is the reference matcher for [protected origins](#protected-origins): `import { protectedOrigins } from '@ai-ecoverse/slicc-browsers/protected.mjs'`, then `protectedOrigins(catalog.protectedOrigins, extraOrigins)` returns `{ url(text), target({ url, previous, opener, type, documentURL, unreachableURL, navigating }), cookieDomain(domain), storageKey(key), unparseable(text) }`, each a boolean. `url(text)` uses the load/loaded-URL fail-closed rule; `url(text, { readOnly: true })` preserves the old parse-failure result for read-only keys and value redaction, and `storageKey(key)` uses that mode internally. `unparseable(text)` identifies parse or unwrap failures without changing whether a parsed origin is protected. It needs only the WHATWG `URL`, so it runs in Node and in a browser. `protected.mjs` and `seven.mjs` import nothing and re-export nothing, so an extension or service worker can ship either file alone; `npm run validate` (through `scripts/self-contained.mjs`) evaluates each as a module in a fresh `node:vm` context that has only `URL`, with no linker resolution allowed.
 
+The complete static import graph of `guard-runner.mjs` is browser-safe too: it uses ordinary browser globals (`URL`, timers, `fetch`, `atob`/`btoa`, `Uint8Array`, `TextEncoder` and `TextDecoder`), never `Buffer`, `process`, `require` or `node:` imports. Base64 bodies and postData are decoded with `atob` and UTF-8 bytes rather than a Node shim. `npm run validate` loads and executes that graph in a fresh `node:vm` browser-like context, including an encoded-body exercise and a drivable page row. The separate host-side `./fixture` server intentionally uses Node HTTP/TLS APIs and is not imported by the browser runner.
+
 ## `catalog.json`
 
 `"schema": 1`. A minor release only adds fields; a field that changes meaning or goes away needs schema 2 and a major release. Relative paths are arrays of path segments, joined with the platform's separator. Top-level fields:
@@ -169,6 +171,8 @@ A same-site frame shares its parent's process and has no target of its own. Ever
 
 **Storage keys** (`Storage`, `IndexedDB`, `CacheStorage` and `FileSystem` in CDP): a key is protected when its origin (up to the first `^`) or its top-level site (a part after `^0`) is a protected URL.
 
+**Redirect secrets.** An allowed response can name a protected destination without becoming a protected document itself. Every protected URL in a nested delivered string or object key is redacted in place to its origin, including embedded `Location`, `Content-Location`, `Refresh` and `Link` values, raw `headersText` lines, `redirectResponse`, Page URL/history/error fields, console/exception text and Audits issues. Percent-encoded representations must not retain the tail. A separate `urlFragment` alongside a protected `url` is cleared too. The event remains delivered so Network ExtraInfo pairing survives; dropping an ExtraInfo event fails these vectors. A request whose response names a protected URL has its response body refused (`slicc: refused:`), through both Fetch and Network, even though the request started at an ordinary URL. Body reads, replay and URL overrides must not follow an ordinary redirect into protected content or send its cookies. Ordinary redirect headers and bodies stay readable.
+
 **Refusals** carry the text in `refusal`, `slicc: refused: target is on seven's origin`.
 
 **`protected.json`** (schema `schema/protected.schema.json`): `errorPage` (the committed-error previous-decision and origin-redaction rule), `unparseable` (`protected`) and `unparseableRefusal`, in step with the catalog; `origins`, the extra origins every vector runs with; `urls` (`url`, `protected`); `targets` (`url`, `documentURL?` and `unreachableURL?` for validated main-frame error-commit evidence, `navigating?` for a main-frame navigation in flight; `type?`, the target's `TargetInfo.type`; `previous?`, whether the target was protected before; `opener?`, `protected`, `unprotected` or `unknown`, and no `opener` for a target without one; `protected`); `cookieDomains` (`domain`, `protected`); `storageKeys` (`key`, `protected`). `npm run validate` runs every vector through `protected.mjs`, and no vector uses a port from 9222 to 9229.
@@ -186,6 +190,10 @@ The `C9` foreign extension isolated-world family requires `extensionWorld`: a br
 
 The integration launcher loads shared-web 1.25.2’s harness extension exactly once through `Extensions.loadUnpacked` (`ankmbodmgimjemnojmeddfcdlbocolob`), whose content script runs on HTTP(S) pages. shared-web 1.25.2 also loads it by default in its own harness. A transport unable to host a foreign content-script extension omits `extensionWorld` and reports `not-supported:extensionWorld`; an advertised capability with no observed world fails, rather than silently skipping.
 
+`C2.redirect-secret` probes ordinary fixture 302s to seven’s `/auth/callback?code=…&state=…` and vault’s `/oauth/mcp-callback?code=…`, plus `#access_token=…` variants of both. It navigates with Page and scripted `location.href`, fetches a subresource and sends an XHR. The 302 carries `Location`, `Content-Location`, `Refresh: 0;url=…` and `Link: <…>; rel=preconnect`. Page, Network (including ExtraInfo), Runtime, Log, Audits and both Fetch stages are enabled. Every received raw message is scanned, including replies, across an eight-second tail, for raw, percent-encoded, JSON-escaped and base64 marker representations. Both response-body APIs are attempted on each hop; guarded bodies need matched refusals. Page frame trees, resource trees and navigation history are read before recovery to catch error-page leftovers. A separate structural check requires every protected `Network.Request.urlFragment` and `Page.Frame.urlFragment` to be empty or absent, even if its value contains no marker; the ordinary `#access_token` control independently requires fragment evidence in request events, frame events, frame-tree replies and resource-tree replies. The ordinary session must survive. The unguarded ordinary redirect control preserves all four headers in `redirectResponse`, ExtraInfo’s headers and `headersText`, and Fetch’s response headers. `C2.redirect-secret-mix` repeats that matrix with 301/303/307/308. The protected leg requires in-place ExtraInfo delivery with origin-only header values, not merely the absence of a marker.
+
+`C2.redirect-body` calls `Network.loadNetworkResource` on an ordinary redirect with `includeCredentials: true`, reads any stream with `IO.read`, replays a redirected XHR, requests Page resource content, and captures Page/MHTML and DOM snapshots after a main-frame redirect. It also captures an ordinary parent containing an iframe redirected to vault, including its error document, and overrides a paused ordinary Fetch request to the allowed redirect URL. No protected marker may appear in any message or body, and no request from those operations may send the independently seeded seven cookie. The ordinary control must return the body, resource content and snapshots, and accept the URL override. Each probe cleans up its redirect registrations, observer session and cookie. The focused Chrome tests use HTTPS with SPKI-pinned fixture trust and default-port protected URLs; host resolver rules route seven and vault to the fixture rather than the public service.
+
 `C8.unparseable` probes both raw and canonical space/U+200D/invalid-punycode URLs through creation and navigation. Every guarded destination needs a matched refusal. Its unguarded controls record `document` or `native-rejection` outcomes, including Chrome builds that reject raw U+200D instead of committing it. Both raw and encoded-space forms must commit real fixture documents, because that is the proven cookie leak. An independent observer loads the encoded-space document and confirms it shares a uniquely seeded `.sliccy.ai` cookie; the guarded client must neither list nor attach to it, read its cookie, query that cookie by URL, nor cause a cookie-bearing destination request. The guard does not erase the observer’s private browser state. The row runs on both browser-session and page-session-only transports, uses the default context, and cleans up its own targets and cookie. Cookie seeding always uses the unguarded observer’s browser session, never the guarded client. Only guarded browser-session target listing requires `browserSession`; without it, `listed` records `not-supported` explicitly in probe and observation evidence, and the result lists that field in `notSupported`. Creation, navigation, attachment and `Network.getCookies` with `urls` still require matched refusals; filtering cookies without refusing fails `cookieRefused`. Fixture URLs omit the colon when the port is empty, and reported URLs are compared after canonicalisation, including Chrome’s WHATWG-unparseable encoded-space hosts. Launchers must resolve the raw/canonical space, U+200D/punycode and invalid-punycode `.sliccy.ai` fixture hosts to the fixture server, including for default-port HTTP or HTTPS origins. The HTTP fixture accepts Chrome’s encoded-space Host header without reparsing it as a WHATWG origin.
 
 `C8.chrome-search` requests `chrome-search://most-visited/` through `Page.navigate` and requires an explicit guard refusal. Its unguarded control requires a CDP response, not a successful document commit: Chrome can answer with `errorText` when that internal data source is unavailable outside an Instant process. Browser-side load failure is not a guard refusal, and merely hiding the target must fail this row.
@@ -203,7 +211,7 @@ A client may register `Fetch.enable` patterns naming a protected origin in eithe
 - `setVersion`: the package version. The release flow stamps it into the npm package and the crate (`scripts/set-crate-version.mjs`). In git, and so in the Go module, it reads `0.0.0`; Go code gets the version from the module.
 - `targets`: the names a runner maps to a scheme, host and port: `seven`, `vault`, `vault-x` (a vault branch preview), `apex`, `own` (the client page's origin, `{client}`), `ordinary`, `ordinary-same-site`, `chrome-newtab`, `chrome-new-tab-page`, `chrome-settings`, `chrome-passwords`, `chrome-search`, `network-error`, `chrome-extension-page` and `file-root`. Each has a `description` and, for the protected ones, a default `host`. `chrome-newtab` (`chrome://newtab/`), `chrome-new-tab-page` (`chrome://new-tab-page/`), `chrome-settings` (`chrome://settings/`), `chrome-passwords` (`chrome://password-manager/`), `chrome-search` (`chrome-search://most-visited/`), `network-error` (`http://nonexistent.invalid/`), `chrome-extension-page` (a page of Chrome's built-in PDF viewer extension) and `file-root` (`file:///`) carry a `url`, which the runner uses unless `targets` maps the name to something else. No other URL in the file is one a runner must use.
 - `variants`: the detach variants in ms. `prompt` and `lagging` are documented; a runner may add others, such as `lagging-8s`, and reports the name it ran.
-- `capabilities`: what a transport may lack. `autoAttach` covers `Target.setAutoAttach`, `children` steps and child sessions; `browserSession` covers calls on the browser session; `browserContexts` covers `Target.createBrowserContext` and `Target.disposeBrowserContext`; `extensionWorld` means it can host a foreign content-script extension isolated world on the ordinary fixture; `chromeUrlsAttach` means the transport can attach to and drive `chrome://` pages. CDP over a DevTools port can; `chrome.debugger` can't, since Chrome refuses it every `chrome://` page, even with `--extensions-on-chrome-urls`.
+- `capabilities`: what a transport may lack. `autoAttach` covers `Target.setAutoAttach`, `children` steps and child sessions; `browserSession` covers calls on the browser session; `browserContexts` covers `Target.createBrowserContext` and `Target.disposeBrowserContext`; `extensionWorld` means it can host a foreign content-script extension isolated world on the ordinary fixture; `discovery` means session-less `Target.setDiscoverTargets` and `Target.targetCreated`/`Target.targetInfoChanged` delivery; `chromeUrlsAttach` means the transport can attach to and drive `chrome://` pages. CDP over a DevTools port can; `chrome.debugger` can't, since Chrome refuses it every `chrome://` page, even with `--extensions-on-chrome-urls`.
 - `placeholders`: every `{name}` used in the vectors, with what it stands for. `{client}` is the client page's origin, which the runner maps.
 
 **A vector** has:
@@ -253,7 +261,13 @@ Popups are observed by `Target.targetCreated` with the opener's `openerId`, or b
 
 `{ "extensionWorld": "hidden" | "select" | "debugger" | "drivable", "as": "world", "requires": ["extensionWorld"] }` runs the C9 compound probe on the current ordinary page. The runner attaches an independent observer to discover actual context ids, unique ids and names, and sends probes through the client session. Discovery matches the expected fixture extension’s exact origin, never the first extension world: `run()`’s optional `extensionWorldId` defaults to shared-web’s harness id `ankmbodmgimjemnojmeddfcdlbocolob`. Multiple unrelated content-script worlds are ignored for fixture selection, while guards must still protect foreign worlds. A custom fixture must provide the same content-script marker contract. Object handles are minted and validated on the unguarded control session, then replayed as guesses on the guarded leg; Chrome object handles and DOM node ids are session-local, so observer handles must never be mistaken for client handles. Numeric ids from the control are also replayed alongside fresh observer-discovered selectors, but numeric ids are local to a tab: a control id may name the next tab’s exposed default context, which must work and return no extension marker. The same-tab hidden world’s actual numeric id and every extension unique-id guess still require a matched refusal. Unknown numeric ids and stale object handles (`not exposed`) need explicit refusals rather than Chrome’s invalid-id errors. `guessesRefused` aggregates only required refusals; `guessesReached` must be false on the guarded leg, and `exposedContextsWork` must remain true. Its result contains boolean evidence consumed by ordinary `result` checks. The unguarded leg validates those selectors against Chrome itself before guarded evidence can pass.
 
-`{ "errorPage": "recover", "secret"?: "all" | "query" | "fragment", "as": "errorPage" }` (also modes `restore` and `sticky`; `secret` defaults to `all`) runs the protected-error-page compound probe with independent commit evidence, discovery redaction and recovery or sticky-lock checks. The unguarded observer seeds the protected history and failed commit, so the rows run on page-session-only transports too. The guarded client uses only `Target.getTargetInfo` with a `targetId`, `Target.getTargets`, `Target.setDiscoverTargets`, `Target.attachToTarget`, `Target.detachFromTarget` and `Target.closeTarget` without a session, which page-session transports answer themselves, and everything else on its page session; the rows require no capability. The runner leaves this probe’s independent Fetch sessions to the probe rather than answering their pauses itself.
+`{ "errorPage": "recover", "secret"?: "all" | "query" | "fragment", "as": "errorPage" }` (also modes `restore` and `sticky`; `secret` defaults to `all`) runs the protected-error-page compound probe with independent commit evidence, discovery redaction and recovery or sticky-lock checks. The unguarded observer seeds the protected history and failed commit, so the rows run on page-session-only transports too. The guarded client uses only `Target.getTargetInfo` with a `targetId`, `Target.getTargets`, `Target.setDiscoverTargets`, `Target.attachToTarget`, `Target.detachFromTarget` and `Target.closeTarget` without a session, which page-session transports answer themselves, and everything else on its page session; the rows require no whole-vector capability. Only `eventsRedacted` requires `discovery`: without it the probe does not call `Target.setDiscoverTargets`, that one field is `not-supported` in both legs, and the notes say `not-supported:discovery`; info, list, attach, recovery and lock checks still run. Discovery absence is structural: a guarded transport delivering either `Target.targetCreated` or `Target.targetInfoChanged` during such a row without declaring `discovery` fails the row, even when the event names an ordinary target. `Target.attachedToTarget` remains independently checked by `attachRedacted`. The runner leaves this probe’s independent Fetch sessions to the probe rather than answering their pauses itself.
+
+`{ "redirectSecret": "headers" | "mix" | "body", "as": "redirect" }` runs a C2 compound probe and owns its Fetch pauses. The client must expose `messages`, an append-only array of every raw received CDP text frame, recorded before parsing; an events-only or reply-only tap fails `rawRecorded`. Whenever a run includes a `C2.redirect-*` row or a `redirectSecret` step, `run()` retains an explicit `fixture.redirectSecret` hook or automatically installs a fetch-only `POST /redirect` bridge. Its base is `fixtureBase`, then `fixture.origin`, then `targets.ordinary`; a browser-page alias or reverse proxy must forward that endpoint to the bundled fixture. The bundled `fixtureServer()` always supplies both its direct hook and HTTP control endpoint, so no custom registration method is needed. Missing, unreachable or non-successful registration is an explicit row/summary error containing `redirectSecret fixture registration required`, never a pass or a skipped observation. Fixture logs must include headers for the cookie check. The guard’s events and raw messages must represent the same delivered stream.
+
+**Host-harness requirements for every guard.** Host Node processes may use `fixtureServer()` from `./fixture`; browser pages must import only the browser-safe runner graph, served with JavaScript MIME types, and need no Node-global shim. All guards supply a guarded client, an independent unguarded observer, mapped fixture origins and the relevant advertised capabilities. C2 clients additionally record every received raw CDP frame in `client.messages` before parsing. Route protected seven/vault hosts to the fixture with `--host-resolver-rules`, including default-port callback URLs; a live protected-body negative needs HTTPS fixture trust (the reference harness pins its SPKI).
+
+For remote/page harnesses, `fixtureClient(base)` is exported by `./guard-runner` and `./fixture-client`, or `run(set, { fixtureBase: base, ... })` constructs it. The bundled server serves CORS-safe `GET /log?since=N` as `{ from: N, entries: [...] }`, with an append-only history unaffected by `fixture.reset()`, and `POST /redirect` with a JSON-encoded string body (a simple text/plain request, without a preflight). Control requests do not appear in the log. Registration descriptors are `{ path, host?, search?, to?, code?, body, remove? }`: `path` starts with `/`, `host` selects the callback hostname, `search` distinguishes query-bearing callbacks, `to` creates a redirect with the four Location/Content-Location/Refresh/Link headers, `code` defaults to 302, an omitted `to` serves the callback body, and `remove: true` unregisters it. The bundled endpoint returns 204; custom servers must acknowledge with a successful status and actually serve the registered routes. Custom fixtures may instead supply an async `fixture.redirectSecret` hook directly; a separate log/control server can implement the same `GET /log` and `POST /redirect` contract. A Node harness using browser-only DNS aliases should pass a reachable `fixtureBase` or its direct hook.
 
 `{ "unparseable": true, "as": "unparseable" }` runs the C8 malformed-URL compound probe on the current ordinary page: independent browser ground truth, raw/canonical destination commands, discovery/attach and cookie checks. Boolean evidence is consumed by ordinary `result` checks, with native Chrome outcomes retained in its diagnostics.
 
@@ -366,6 +380,8 @@ every alternative of an `any`, or a required (`all`, `not` or plain) check, need
 selects one variant or an array; omission selects all. `parallel` defaults to 1.
 With the `browserContexts` capability each leg runs in its own browser context. A `Target.createBrowserContext` that fails with a timeout is retried once, and the row's `notes` records it; any other failure fails the row.
 
+Every target created by the runner’s own unguarded observer uses `Target.createTarget` with `newWindow: true`, then verifies through `Target.getTargetInfo` that `openerId` is absent. A supplied opener or missing target evidence fails and cleans up that target, rather than inheriting the active client tab (which could be seven). This includes ordinary control setup, storage canaries, protected-error history seeds and the malformed-URL observer. The row notes record `newWindow=true, openerId absent`. Intentional guarded-client creation commands and popup/opener tests keep their original parameters.
+
 `settleScale` (default 1) multiplies the bounds of waits for events the leg expects to happen: settles (beacon, served, title and load) on the control leg and `required` settles on either leg, `paused` on the control leg, page and child loads, the wait for a background step's `as` result (`<as> did not complete within <ms>ms`), the wait for the pre-action beacons, the C9 control's `Debugger.paused`, and the wait for an observation the leg expects to be `true`. Adopters on slow hosts can set 3 or 4. Every wait polls and returns as soon as its event arrives, so a larger bound only costs time when something is really missing, and each timeout error names the bound it used. An observation read from the fixture (`observer: "fixture"`, such as a beacon or a served request) that the leg expects to be `true` is polled for up to 5000 ms (scaled) instead of read once. One that the leg expects to be `false` is still read once.
 
 `refusalScale` (default 1) multiplies the bounds of waits for what the guarded leg expects to be absent, the beacon, request, title or navigation that the guard should block: settles that are not `required`, and `paused`, on the guarded leg. Such a wait runs to its full bound whenever the guard works, so `settleScale` leaves it alone. The trade-off: a larger `refusalScale` gives more sensitivity to a leak that arrives late on a slow host, because the observations after the wait see it, at the cost of that much more time per guarded row. Adopters should keep `refusalScale` at 1 or higher, never below 1; the runner refuses a `refusalScale` below 1 with `refusalScale must be a number of at least 1`.
@@ -491,6 +507,7 @@ const capabilities = {
   browserSession: true,
   browserContexts: true,
   chromeUrlsAttach: true,
+  discovery: true,
 };
 const execution = await run(set, {
   clientFactory: (metadata) => connectGuardAndObserver(metadata),
@@ -544,7 +561,7 @@ A six endpoint has tier `six`, whatever its seven tabs. **A program never choose
 
 ## Output schema 1
 
-`schema/browsers.schema.json` describes `slicc browsers --json`, which `playwright-cli list --json` also prints. [slicc-cli's README](https://github.com/ai-ecoverse/slicc-cli#slicc-browsers---json---cdp-url---no-bundle-scan) is the authoritative spec for it; this schema is a copy and follows it. Fields can be added; `source` is one of `devtools-active-port`, `flag`, `probe` and `process`. `tier` is 1 to 6, and `six: true` marks an endpoint in SLICC six's profile (tier 6). An endpoint may carry `tabs`: every page target except those on protected origins. Seven's own tabs are protected, so they are in `sevenTabs` only, never in `tabs`. `playwright-cli list --json` prints it, and a corpus case that checks it needs `tabs`.
+`schema/browsers.schema.json` describes `slicc browsers --json`, which `playwright-cli list --json` also prints. [slicc-cli's README](https://github.com/ai-ecoverse/slicc-cli#slicc-browsers---json---cdp-url---no-bundle-scan) is the authoritative spec for it; this schema is a copy and follows it. Fields can be added; `source` is one of `devtools-active-port`, `flag`, `probe` and `process`. `tier` is 1 to 6, and `six: true` marks an endpoint in SLICC six's profile (tier 6). An endpoint may carry `tabs`: every page target except those on protected origins. Seven's own tabs are protected, so they are in `sevenTabs` only, never in `tabs`. In `sevenTabs`, `url` and `title` are the origin only, never a path, query, fragment or document title, including configured extra seven origins and default-port normalization. `playwright-cli list --json` prints it, and a corpus case that checks it needs `tabs`.
 
 ## The corpus
 

package/corpus.json

@@ -761,8 +761,8 @@
               "sevenTabs": [
                 {
                   "id": "P1",
-                  "url": "https://lars.sliccy.ai/",
-                  "title": "seven"
+                  "url": "https://lars.sliccy.ai",
+                  "title": "https://lars.sliccy.ai"
                 }
               ],
               "tabs": [
@@ -854,13 +854,13 @@
               "sevenTabs": [
                 {
                   "id": "O1",
-                  "url": "https://dev.example.test/app",
-                  "title": "dev"
+                  "url": "https://dev.example.test",
+                  "title": "https://dev.example.test"
                 },
                 {
                   "id": "O3",
-                  "url": "https://dev.example.test:443/other",
-                  "title": "dev again"
+                  "url": "https://dev.example.test",
+                  "title": "https://dev.example.test"
                 }
               ]
             }
@@ -1298,8 +1298,8 @@
               "sevenTabs": [
                 {
                   "id": "P1",
-                  "url": "https://lars.sliccy.ai/",
-                  "title": "seven"
+                  "url": "https://lars.sliccy.ai",
+                  "title": "https://lars.sliccy.ai"
                 }
               ]
             }
@@ -1713,8 +1713,8 @@
               "sevenTabs": [
                 {
                   "id": "S1",
-                  "url": "https://b.sliccy.ai/",
-                  "title": "seven b"
+                  "url": "https://b.sliccy.ai",
+                  "title": "https://b.sliccy.ai"
                 }
               ]
             }
@@ -1737,8 +1737,8 @@
               "sevenTabs": [
                 {
                   "id": "S2",
-                  "url": "https://a.sliccy.ai/",
-                  "title": "seven a"
+                  "url": "https://a.sliccy.ai",
+                  "title": "https://a.sliccy.ai"
                 }
               ]
             }
@@ -2012,8 +2012,8 @@
               "sevenTabs": [
                 {
                   "id": "D1",
-                  "url": "https://seven.sliccy.ai:443/",
-                  "title": "seven"
+                  "url": "https://seven.sliccy.ai",
+                  "title": "https://seven.sliccy.ai"
                 }
               ]
             }
@@ -2039,6 +2039,69 @@
         ]
       }
     },
+    {
+      "name": "seven-tab-origin-redaction",
+      "case": {
+        "description": "sevenTabs URL and title reveal only the origin, never a secret path, query, fragment or document title",
+        "needs": [
+          "flag"
+        ],
+        "cdp": [
+          "127.0.0.1:9531"
+        ],
+        "http": {
+          "127.0.0.1:9531": {
+            "version": {
+              "Browser": "Chrome/154.0.8037.98",
+              "Protocol-Version": "1.3",
+              "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.8037.98 Safari/537.36",
+              "V8-Version": "15.4.79.1",
+              "WebKit-Version": "537.36 (@a1b2c3)",
+              "webSocketDebuggerUrl": "ws://127.0.0.1:9531/devtools/browser/d1"
+            },
+            "list": [
+              {
+                "id": "D1",
+                "type": "page",
+                "url": "https://seven.sliccy.ai/auth/secret-path-marker?code=secret-query-marker#access_token=secret-fragment-marker",
+                "title": "secret-title-marker",
+                "webSocketDebuggerUrl": "ws://127.0.0.1/devtools/page/D1"
+              }
+            ]
+          }
+        }
+      },
+      "expected": {
+        "schema": 1,
+        "minChromium": 116,
+        "entries": [
+          {
+            "id": "cdp:127.0.0.1:9531",
+            "kind": "endpoint",
+            "tier": 1,
+            "name": "Chrome",
+            "version": "154.0.8037.98",
+            "endpoint": {
+              "cdp": "http://127.0.0.1:9531",
+              "webSocketDebuggerUrl": "ws://127.0.0.1:9531/devtools/browser/d1",
+              "name": "Chrome",
+              "version": "154.0.8037.98",
+              "product": "Chrome/154.0.8037.98",
+              "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.8037.98 Safari/537.36",
+              "source": "flag",
+              "sevenOpen": true,
+              "sevenTabs": [
+                {
+                  "id": "D1",
+                  "url": "https://seven.sliccy.ai",
+                  "title": "https://seven.sliccy.ai"
+                }
+              ]
+            }
+          }
+        ]
+      }
+    },
     {
       "name": "seven-tabs",
       "case": {
@@ -2189,13 +2252,13 @@
               "sevenTabs": [
                 {
                   "id": "T1",
-                  "url": "https://lars.sliccy.ai/",
-                  "title": "seven"
+                  "url": "https://lars.sliccy.ai",
+                  "title": "https://lars.sliccy.ai"
                 },
                 {
                   "id": "T6",
-                  "url": "https://seven.sliccy.ai/?x=1#top",
-                  "title": "seven too"
+                  "url": "https://seven.sliccy.ai",
+                  "title": "https://seven.sliccy.ai"
                 }
               ]
             }
@@ -2218,8 +2281,8 @@
               "sevenTabs": [
                 {
                   "id": "V1",
-                  "url": "https://team-7.sliccy.ai/workspace",
-                  "title": "seven"
+                  "url": "https://team-7.sliccy.ai",
+                  "title": "https://team-7.sliccy.ai"
                 }
               ]
             }
@@ -2400,8 +2463,8 @@
               "sevenTabs": [
                 {
                   "id": "S1",
-                  "url": "https://lars.sliccy.ai/",
-                  "title": "seven"
+                  "url": "https://lars.sliccy.ai",
+                  "title": "https://lars.sliccy.ai"
                 }
               ]
             }
@@ -2522,8 +2585,8 @@
               "sevenTabs": [
                 {
                   "id": "S1",
-                  "url": "https://lars.sliccy.ai/",
-                  "title": "seven"
+                  "url": "https://lars.sliccy.ai",
+                  "title": "https://lars.sliccy.ai"
                 }
               ]
             }
@@ -2674,8 +2737,8 @@
               "sevenTabs": [
                 {
                   "id": "S1",
-                  "url": "https://lars.sliccy.ai/",
-                  "title": "seven"
+                  "url": "https://lars.sliccy.ai",
+                  "title": "https://lars.sliccy.ai"
                 }
               ]
             }
@@ -2775,8 +2838,8 @@
               "sevenTabs": [
                 {
                   "id": "S1",
-                  "url": "https://lars.sliccy.ai/",
-                  "title": "seven"
+                  "url": "https://lars.sliccy.ai",
+                  "title": "https://lars.sliccy.ai"
                 }
               ]
             }

package/fixture-client.mjs

@@ -0,0 +1,51 @@
+export function fixtureClient(base, { fetch: request = globalThis.fetch } = {}) {
+  const entries = [];
+  let pending;
+  return {
+    log: async () => {
+      if (!pending)
+        pending = (async () => {
+          const response = await request(new URL(`/log?since=${entries.length}`, base));
+          if (!response.ok) throw new Error(`fixture.log: HTTP ${response.status}`);
+          const batch = await response.json();
+          if (batch.from !== entries.length || !Array.isArray(batch.entries))
+            throw new Error('fixture.log: invalid append-only log response');
+          entries.push(...batch.entries);
+          return [...entries];
+        })().finally(() => {
+          pending = undefined;
+        });
+      return pending;
+    },
+    redirectSecret: async (registration) => {
+      try {
+        const response = await request(new URL('/redirect', base), {
+          method: 'POST',
+          body: JSON.stringify(registration),
+        });
+        if (!response.ok) throw new Error(`HTTP ${response.status}`);
+      } catch (error) {
+        throw new Error(
+          `redirectSecret fixture registration required: POST /redirect failed: ${error.message}`
+        );
+      }
+    },
+  };
+}
+
+export function prepareFixture(set, options) {
+  const fixture =
+    options.fixture ?? (options.fixtureBase ? fixtureClient(options.fixtureBase) : undefined);
+  const needsRedirect = set.vectors.some(
+    (vector) =>
+      vector.id.startsWith('C2.redirect') || vector.trigger?.some((step) => step.redirectSecret)
+  );
+  if (!needsRedirect || typeof fixture?.redirectSecret === 'function' || !fixture?.log)
+    return fixture;
+  const control = fixtureClient(options.fixtureBase ?? fixture.origin ?? options.targets?.ordinary);
+  return {
+    ...fixture,
+    log: (...args) => fixture.log(...args),
+    redirectSecret: control.redirectSecret,
+  };
+}

package/fixture-server.mjs

@@ -26,7 +26,20 @@ function trigger(p) {
   return `<p>trigger</p><button onclick="go()">Go</button>${frame}<script>const to=${JSON.stringify(to)};function go(){const k=${JSON.stringify(kind)};if(k==='href'||k==='deferred')location.href=to;if(k==='replace')location.replace(to);if(k==='popup')window.open(to);if(k==='form'){const u=new URL(to);const f=document.createElement('form');f.action=u.origin+u.pathname;for(const [name,value] of u.searchParams){const i=document.createElement('input');i.type='hidden';i.name=name;i.value=value;f.append(i);}document.body.append(f);f.submit();}return 'went';}${kind === 'deferred' ? `setTimeout(go,${Number(p.get('defer') ?? 3000)});` : ''}</script>`;
 }
 
-function route(req, url, send, html) {
+function route(req, url, send, html, redirects) {
+  const secret =
+    redirects.get(`${url.hostname}${url.pathname}${url.search ?? ''}`) ??
+    redirects.get(`${url.hostname}${url.pathname}`) ??
+    redirects.get(url.pathname);
+  if (secret) {
+    if (!secret.to) return send(200, secret.body, 'text/plain');
+    return send(secret.code ?? 302, secret.body, 'text/plain', {
+      location: secret.to,
+      'content-location': secret.to,
+      refresh: `0;url=${secret.to}`,
+      link: `<${secret.to}>; rel=preconnect`,
+    });
+  }
   const p = url.searchParams;
   const routes = {
     '/beacon': () => send(204, ''),
@@ -95,15 +108,22 @@ function requestURL(req, scheme) {
 
 export async function fixtureServer({ host = '127.0.0.1', port = 0, tls, latency } = {}) {
   let entries = [];
+  const history = [];
+  const redirects = new Map();
+  const redirectSecret = async ({ path, host = '', search = '', remove, ...value }) => {
+    if (
+      typeof path !== 'string' ||
+      !path.startsWith('/') ||
+      (!remove && typeof value.body !== 'string')
+    )
+      throw new Error('invalid redirect registration');
+    const key = `${host}${path}${search}`;
+    if (remove) redirects.delete(key);
+    else redirects.set(key, value);
+  };
   const scheme = tls ? 'https' : 'http';
-  const handler = (req, res) => {
+  const handler = async (req, res) => {
     const url = requestURL(req, scheme);
-    entries.push({
-      url: url.href,
-      method: req.method,
-      headers: { ...req.headers },
-      time: Date.now(),
-    });
     const p = url.searchParams;
     const cors = {
       'access-control-allow-origin': req.headers.origin ?? '*',
@@ -122,9 +142,33 @@ export async function fixtureServer({ host = '127.0.0.1', port = 0, tls, latency
         'text/html',
         headers
       );
+    if (req.method === 'GET' && url.pathname === '/log') {
+      const from = Number(p.get('since') ?? 0);
+      if (!Number.isInteger(from) || from < 0 || from > history.length)
+        return send(400, 'invalid log cursor', 'text/plain');
+      return send(200, JSON.stringify({ from, entries: history.slice(from) }), 'application/json');
+    }
+    if (req.method === 'POST' && url.pathname === '/redirect') {
+      try {
+        const chunks = [];
+        for await (const chunk of req) chunks.push(chunk);
+        await redirectSecret(JSON.parse(Buffer.concat(chunks).toString('utf8')));
+        return send(204, '', 'text/plain');
+      } catch {
+        return send(400, 'invalid redirect registration', 'text/plain');
+      }
+    }
+    const entry = {
+      url: url.href,
+      method: req.method,
+      headers: { ...req.headers },
+      time: Date.now(),
+    };
+    entries.push(entry);
+    history.push(entry);
     const wait = latency?.(url) ?? 0;
-    if (wait > 0) setTimeout(() => route(req, url, send, html), wait);
-    else route(req, url, send, html);
+    if (wait > 0) setTimeout(() => route(req, url, send, html, redirects), wait);
+    else route(req, url, send, html, redirects);
   };
   const server = tls ? createSecureServer(tls, handler) : createServer(handler);
   await new Promise((resolve, reject) => {
@@ -133,6 +177,8 @@ export async function fixtureServer({ host = '127.0.0.1', port = 0, tls, latency
   });
   const address = server.address();
   return {
+    redirects,
+    redirectSecret,
     port: address.port,
     origin: `${scheme}://${host}:${address.port}`,
     log: () => structuredClone(entries),

package/guard-runner.mjs

@@ -1,3 +1,7 @@
+import { fixtureClient, prepareFixture } from './fixture-client.mjs';
+
+export { fixtureClient };
+
 import { extensionWorld } from './extension-world.mjs';
 import {
   beacon,
@@ -13,7 +17,9 @@ import {
   result,
   steps,
 } from './guard-driver.mjs';
+import { createObserverTarget, discoveryViolation } from './observer-target.mjs';
 import { protectedErrorPage } from './protected-error-page.mjs';
+import { redirectSecret } from './redirect-secret.mjs';
 import { canonicalURL, unparseableURLs } from './unparseable-url.mjs';
 
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -152,11 +158,15 @@ class Execution {
   }
 
   async create(url, context = this.vars.context, client = this.client, background = true) {
-    const { targetId } = await client.send('Target.createTarget', {
+    const params = {
       url: 'about:blank',
       background,
       ...(context ? { browserContextId: context } : {}),
-    });
+    };
+    const { targetId } =
+      client === this.reader
+        ? await createObserverTarget(this.reader, params, this.notes)
+        : await client.send('Target.createTarget', params);
     this.targets.push(targetId);
     this.pageTarget = targetId;
     this.vars.pageTarget = targetId;
@@ -199,10 +209,14 @@ class Execution {
       ...(this.vars.context ? { browserContextId: this.vars.context } : {}),
     });
     if (!state.storage) return;
-    const { targetId } = await this.reader.send('Target.createTarget', {
-      url: 'about:blank',
-      ...(this.vars.context ? { browserContextId: this.vars.context } : {}),
-    });
+    const { targetId } = await createObserverTarget(
+      this.reader,
+      {
+        url: 'about:blank',
+        ...(this.vars.context ? { browserContextId: this.vars.context } : {}),
+      },
+      this.notes
+    );
     this.canaryTarget = targetId;
     this.targets.push(targetId);
     const { sessionId } = await this.reader.send('Target.attachToTarget', {
@@ -623,10 +637,10 @@ class Execution {
       );
     if (step.extensionWorld && out.result?.incomplete)
       this.errors.push(`extensionWorld ${step.extensionWorld}: ${out.result.incomplete}`);
-    if ((step.extensionWorld || step.unparseable || step.errorPage) && !out.ok)
-      this.errors.push(
-        `${step.unparseable ? 'unparseable' : step.errorPage ? 'errorPage' : 'extensionWorld'}: ${out.error?.message ?? 'probe failed'}`
-      );
+    const probe = ['redirectSecret', 'unparseable', 'errorPage', 'extensionWorld'].find(
+      (key) => step[key]
+    );
+    if (probe && !out.ok) this.errors.push(`${probe}: ${out.error?.message ?? 'probe failed'}`);
     if (step.as && !out.result?.pending) this.calls[step.as] = out;
     if (step.cdp) (this.calls.$cdp ??= []).push({ method: step.cdp, ...out });
   }
@@ -676,6 +690,26 @@ class Execution {
       await this.settle(step.settle);
       return;
     }
+    if (step.redirectSecret) {
+      this.internalSessions.add(session);
+      try {
+        return await outcome(
+          redirectSecret({
+            client: this.client,
+            reader: this.reader,
+            session,
+            targetId: this.pageTarget,
+            ordinary: this.vars.ordinary,
+            tag: this.vars.tag,
+            fixture: this.options.fixture,
+            mode: step.redirectSecret,
+            side: this.side,
+          })
+        );
+      } finally {
+        this.internalSessions.delete(session);
+      }
+    }
     if (step.errorPage)
       return outcome(
         protectedErrorPage({
@@ -690,6 +724,8 @@ class Execution {
           mode: step.errorPage,
           side: this.side,
           secret: step.secret,
+          discovery: supported(['discovery'], this.options.capabilities),
+          notes: this.notes,
         })
       );
     if (step.unparseable)
@@ -703,6 +739,7 @@ class Execution {
           tag: this.vars.tag,
           fixture: this.options.fixture,
           browserSession: supported(['browserSession'], this.options.capabilities),
+          notes: this.notes,
         })
       );
     if (step.extensionWorld)
@@ -1198,6 +1235,16 @@ class Execution {
           (this.reader ?? this.client).send('Target.disposeBrowserContext', { browserContextId })
         );
       await Promise.allSettled(this.pending);
+      if (
+        this.side === 'guarded' &&
+        this.vector.observe?.eventsRedacted?.requires?.includes('discovery')
+      ) {
+        const violation = discoveryViolation(
+          this.client.events.slice(this.eventStart),
+          supported(['discovery'], this.options.capabilities)
+        );
+        if (violation) this.errors.push(violation);
+      }
     }
   }
 }
@@ -1592,6 +1639,7 @@ export function run(set, options) {
 
 async function runAll(set, options, flights) {
   const opts = { capabilities: {}, variant: Object.keys(set.variants), parallel: 1, ...options };
+  opts.fixture = prepareFixture(set, opts);
   opts.targets = {
     ...Object.fromEntries(
       Object.entries(set.targets ?? {})