@ai-ecoverse/slicc-browsers 1.12.0 → 1.13.1

package/observer-target.mjs

@@ -0,0 +1,23 @@
+import { outcome } from './guard-driver.mjs';
+
+export async function createObserverTarget(reader, params, notes = []) {
+  const result = await reader.send('Target.createTarget', { ...params, newWindow: true });
+  try {
+    const { targetInfo } = await reader.send('Target.getTargetInfo', { targetId: result.targetId });
+    if (!targetInfo || Object.hasOwn(targetInfo, 'openerId'))
+      throw new Error('observer target must have no openerId');
+    notes.push(`observer target ${result.targetId}: newWindow=true, openerId absent`);
+    return result;
+  } catch (error) {
+    await outcome(reader.send('Target.closeTarget', { targetId: result.targetId }));
+    throw error;
+  }
+}
+
+export function discoveryViolation(events, declared) {
+  if (declared) return null;
+  const event = events.find((entry) =>
+    ['Target.targetCreated', 'Target.targetInfoChanged'].includes(entry.method)
+  );
+  return event ? `discovery not declared, but transport delivered ${event.method}` : null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.12.0",
+  "version": "1.13.1",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -38,7 +38,8 @@
     "./package.json": "./package.json",
     "./guard-runner.mjs": "./guard-runner.mjs",
     "./guard-runner": "./guard-runner.mjs",
-    "./fixture": "./fixture-server.mjs"
+    "./fixture": "./fixture-server.mjs",
+    "./fixture-client": "./fixture-client.mjs"
   },
   "files": [
     "catalog.json",
@@ -53,7 +54,11 @@
     "fixture-server.mjs",
     "extension-world.mjs",
     "unparseable-url.mjs",
-    "protected-error-page.mjs"
+    "protected-error-page.mjs",
+    "redirect-secret.mjs",
+    "redirect-fragments.mjs",
+    "observer-target.mjs",
+    "fixture-client.mjs"
   ],
   "scripts": {
     "prepare": "lefthook install",
@@ -61,21 +66,22 @@
     "validate": "node scripts/validate.mjs",
     "lint": "slicc-lint && test -z \"$(gofmt -l .)\" && go mod tidy -diff && go vet ./... && golangci-lint run && cargo fmt --check && cargo clippy --all-features --all-targets -- -D warnings",
     "format": "biome check --write . && gofmt -w . && cargo fmt",
-    "test": "npm run validate && node --test test/integration/self-contained.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
+    "test": "npm run validate && node --test test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
     "test:unit": "go test -race -cover ./...",
     "build": "go build ./... && cargo build --all-features && cargo build --target wasm32-wasip1 --all-features && npm pack --dry-run",
     "trust": "npx fledgling sync -y --skip-publish",
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish",
     "release": "semantic-release",
     "test:guard": "npm run test:guard-integration && npm run test:guard-sweep",
-    "test:guard-integration": "node --test --test-concurrency=2 test/integration/guard-lifecycle.test.mjs test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-worlds.test.mjs test/integration/guard-world-discovery.test.mjs test/integration/guard-world-guesses.test.mjs test/integration/guard-unparseable.test.mjs test/integration/guard-error-page.test.mjs test/integration/guard-scales.test.mjs test/integration/guard-shared-log.test.mjs test/integration/guard-pre-beacon.test.mjs test/integration/guard-world-pause.test.mjs test/integration/self-contained.test.mjs",
+    "test:guard-integration": "node --test --test-concurrency=2 test/integration/guard-lifecycle.test.mjs test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-worlds.test.mjs test/integration/guard-world-discovery.test.mjs test/integration/guard-world-guesses.test.mjs test/integration/guard-unparseable.test.mjs test/integration/guard-redirect-secret.test.mjs test/integration/guard-error-page.test.mjs test/integration/guard-discovery.test.mjs test/integration/guard-browser-page.test.mjs test/integration/guard-scales.test.mjs test/integration/guard-shared-log.test.mjs test/integration/guard-pre-beacon.test.mjs test/integration/guard-world-pause.test.mjs test/integration/self-contained.test.mjs",
     "test:guard-sweep": "node scripts/test-guards.mjs",
     "test:gates": "node --test test/integration/gates.test.mjs",
     "test:guard-target": "node --test test/integration/guard-runner.test.mjs",
-    "test:unit:guard": "node --experimental-test-coverage --test --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-lines=100 test/unit/guard-*.test.mjs"
+    "test:unit:redirect": "mkdir -p coverage/unit && node --experimental-test-coverage --test --test-coverage-include=redirect-secret.mjs --test-coverage-include=redirect-fragments.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/redirect.lcov test/unit/guard-redirect-*.test.mjs && slicc-diff-cover coverage/unit/redirect.lcov",
+    "test:unit:guard": "mkdir -p coverage/unit && node --experimental-vm-modules --no-warnings --experimental-test-coverage --test --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-include=fixture-client.mjs --test-coverage-include=observer-target.mjs --test-coverage-include=protected-error-page.mjs --test-coverage-include=unparseable-url.mjs --test-coverage-include=scripts/browser-runner.mjs --test-coverage-include=scripts/validate.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/guard.lcov test/unit/guard-*.test.mjs && slicc-diff-cover coverage/unit/guard.lcov"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-shared-web": "1.29.1",
+    "@ai-ecoverse/slicc-shared-web": "2.0.2",
     "@biomejs/biome": "2.5.15",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",

package/protected-error-page.mjs

@@ -1,4 +1,5 @@
 import { outcome } from './guard-driver.mjs';
+import { createObserverTarget } from './observer-target.mjs';
 
 const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 const refused = (out) => !out.ok && /^slicc: refused:/.test(out.error?.message ?? '');
@@ -43,7 +44,15 @@ async function lockChecks({ client, session, targetId, result }) {
   result.closeRefused = refused(await outcome(client.send('Target.closeTarget', { targetId })));
 }
 
-async function redaction({ client, targetId, failedURL, protectedOrigin, start, result }) {
+async function redaction({
+  client,
+  targetId,
+  failedURL,
+  protectedOrigin,
+  start,
+  result,
+  discovery,
+}) {
   const info = await outcome(client.send('Target.getTargetInfo', { targetId }));
   const list = await outcome(client.send('Target.getTargets'));
   const before = client.events.length;
@@ -71,11 +80,13 @@ async function redaction({ client, targetId, failedURL, protectedOrigin, start,
     .slice(start)
     .filter(
       (e) =>
+        ['Target.targetCreated', 'Target.targetInfoChanged'].includes(e.method) &&
         e.params?.targetInfo?.targetId === targetId &&
         e.params.targetInfo.url.includes(new URL(protectedOrigin).host)
     );
-  result.eventsRedacted =
-    targetEvents.length > 0 && targetEvents.every((e) => only(e.params.targetInfo));
+  result.eventsRedacted = discovery
+    ? targetEvents.length > 0 && targetEvents.every((e) => only(e.params.targetInfo))
+    : 'not-supported';
 }
 
 const secrets = {
@@ -94,12 +105,19 @@ export async function protectedErrorPage({
   side,
   internalSessions = new Set(),
   secret = 'all',
+  discovery = true,
+  notes = [],
 }) {
   const initial = `${protectedOrigin}/doc?n=${tag}-history`;
   const failedURL = `${protectedOrigin}${secrets[secret](tag)}`;
   const result = {};
+  if (!discovery) notes.push('eventsRedacted: not-supported:discovery');
   const start = client.events.length;
-  const { targetId } = await reader.send('Target.createTarget', { url: initial, background: true });
+  const { targetId } = await createObserverTarget(
+    reader,
+    { url: initial, background: true },
+    notes
+  );
   let session;
   let observer;
   let failing = false;
@@ -142,7 +160,7 @@ export async function protectedErrorPage({
     if (!session) return { live: false, attached: false };
     await client.send('Page.enable', {}, session);
     await client.send('Runtime.enable', {}, session);
-    await client.send('Target.setDiscoverTargets', { discover: true });
+    if (discovery) await client.send('Target.setDiscoverTargets', { discover: true });
     if (side === 'control') {
       failing = true;
       await reader.send(
@@ -172,7 +190,7 @@ export async function protectedErrorPage({
       throw new Error(
         `protected-error-page: missing error commit ${JSON.stringify(result.evidence)}`
       );
-    await redaction({ client, targetId, failedURL, protectedOrigin, start, result });
+    await redaction({ client, targetId, failedURL, protectedOrigin, start, result, discovery });
     const beforeReload = (await frame()).loaderId;
     result.reload = (await outcome(client.send('Page.reload', {}, session))).ok;
     if (result.reload) {

package/redirect-fragments.mjs

@@ -0,0 +1,38 @@
+const fields = (value) => {
+  if (!value || typeof value !== 'object') return [];
+  return [
+    ...(typeof value.urlFragment === 'string' ? [value] : []),
+    ...Object.values(value).flatMap(fields),
+  ];
+};
+
+export function redirectFragments({ messages, events, replies, protectedOrigins, contains }) {
+  const protectedURL = (text) => {
+    try {
+      return protectedOrigins.includes(new URL(text).origin);
+    } catch {
+      return false;
+    }
+  };
+  const visible = (value) =>
+    fields(value).some((field) => field.urlFragment !== '' && contains(field.urlFragment));
+  const reply = (method) =>
+    replies.filter((entry) => entry.method === method).map((entry) => entry.result);
+  return {
+    fragmentsHidden: messages
+      .flatMap((message) => fields(JSON.parse(message)))
+      .every(
+        (field) =>
+          (!protectedURL(field.url) && !protectedURL(field.unreachableUrl)) ||
+          field.urlFragment === ''
+      ),
+    networkFragmentVisible: events.some(
+      (event) => event.method === 'Network.requestWillBeSent' && visible(event.params.request)
+    ),
+    frameFragmentVisible: events.some(
+      (event) => event.method === 'Page.frameNavigated' && visible(event.params.frame)
+    ),
+    frameTreeFragmentVisible: visible(reply('Page.getFrameTree')),
+    resourceTreeFragmentVisible: visible(reply('Page.getResourceTree')),
+  };
+}

package/redirect-secret.mjs

@@ -0,0 +1,482 @@
+import { load, outcome } from './guard-driver.mjs';
+import { redirectFragments } from './redirect-fragments.mjs';
+
+const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const decodeBase64 = (text) =>
+  new TextDecoder().decode(Uint8Array.from(atob(text), (char) => char.charCodeAt(0)));
+const base64Slices = (value) => {
+  const normalized = value.replaceAll('-', '+').replaceAll('_', '/').replace(/=+$/, '');
+  const candidates = [];
+  for (let offset = 0; offset < 4; offset++) {
+    const part = normalized.slice(offset);
+    const usable = part.slice(0, part.length - (part.length % 4 === 1 ? 1 : 0));
+    candidates.push(usable.padEnd(Math.ceil(usable.length / 4) * 4, '='));
+    candidates.push(part.slice(0, Math.floor(part.length / 4) * 4));
+  }
+  return [...new Set(candidates)].filter(Boolean);
+};
+const decodedBase64 = (value) =>
+  [...value.matchAll(/[A-Za-z0-9+/_-]{12,}={0,2}/g)].flatMap(([text]) =>
+    base64Slices(text).map(decodeBase64)
+  );
+const refused = (out) => !out.ok && /^slicc: refused:/.test(out.error?.message ?? '');
+const redirects = [301, 302, 303, 307, 308];
+const redirectHeaders = (to) => ({
+  location: to,
+  'content-location': to,
+  refresh: `0;url=${to}`,
+  link: `<${to}>; rel=preconnect`,
+});
+const headersMatch = (headers, to) => {
+  const map = Object.fromEntries(
+    (Array.isArray(headers)
+      ? headers.map(({ name, value }) => [name, value])
+      : Object.entries(headers ?? {})
+    ).map(([name, value]) => [name.toLowerCase(), value])
+  );
+  return Object.entries(redirectHeaders(to)).every(([name, value]) => map[name] === value);
+};
+const headersTextMatch = (text, to) =>
+  Object.entries(redirectHeaders(to)).every(([name, value]) =>
+    text
+      ?.split('\r\n')
+      .some(
+        (line) =>
+          line.slice(0, name.length + 2).toLowerCase() === `${name}: ` &&
+          line.slice(name.length + 2) === value
+      )
+  );
+
+export function containsSecret(value, marker) {
+  const visit = (value, depth = 0) => {
+    if (typeof value === 'string') {
+      if (value.includes(marker)) return true;
+      if (depth >= 8) return false;
+      const decoded = [];
+      try {
+        decoded.push(decodeURIComponent(value));
+      } catch {}
+      try {
+        decoded.push(JSON.parse(value));
+      } catch {}
+      try {
+        decoded.push(JSON.parse(`"${value}"`));
+      } catch {}
+      decoded.push(...decodedBase64(value));
+      return decoded.some((text) => text !== value && visit(text, depth + 1));
+    }
+    if (value && typeof value === 'object')
+      return Object.values(value).some((v) => visit(v, depth));
+    return false;
+  };
+  return visit(value);
+}
+
+class RedirectProbe {
+  constructor(options) {
+    Object.assign(this, options);
+    this.marker = `${this.tag}-secret/+"token`;
+    this.cookie = `redirect-secret-${this.tag}`;
+    this.messagesStart = this.client.messages?.length;
+    this.eventsStart = this.client.events.length;
+    this.cursor = this.eventsStart;
+    this.responses = [];
+    this.attempts = [];
+    this.jobs = new Set();
+    this.networkBodies = new Set();
+    this.registrations = [];
+    this.protectedURLs = [
+      `https://seven.sliccy.ai/auth/callback?code=${encodeURIComponent(this.marker)}&state=${encodeURIComponent(this.marker)}`,
+      `https://vault.sliccy.ai/oauth/mcp-callback?code=${encodeURIComponent(this.marker)}`,
+      `https://seven.sliccy.ai/auth/callback#access_token=${encodeURIComponent(this.marker)}&state=${encodeURIComponent(this.marker)}`,
+      `https://vault.sliccy.ai/oauth/mcp-callback#access_token=${encodeURIComponent(this.marker)}`,
+    ];
+    this.plainURL = `${this.ordinary}/redirect-secret-body/${this.tag}-plain?code=${encodeURIComponent(this.marker)}`;
+    this.destinations =
+      this.side === 'control'
+        ? this.protectedURLs.map((url) => `${this.plainURL}${new URL(url).hash}`)
+        : this.protectedURLs;
+  }
+
+  async send(method, params = {}) {
+    const out = await outcome(this.client.send(method, params, this.session));
+    this.responses.push({ method, ...out });
+    return out;
+  }
+
+  track(job) {
+    this.jobs.add(job);
+    job.finally(() => this.jobs.delete(job));
+  }
+
+  async fetchPause(event) {
+    if (redirects.includes(event.params.responseStatusCode)) {
+      const out = await this.send('Fetch.getResponseBody', { requestId: event.params.requestId });
+      this.attempts.push({ method: 'Fetch.getResponseBody', ...out });
+    }
+    if (
+      this.holdURL &&
+      event.params.request.url === this.holdURL &&
+      !event.params.responseStatusCode
+    ) {
+      this.held = event;
+      return;
+    }
+    await this.send('Fetch.continueRequest', { requestId: event.params.requestId });
+  }
+
+  async watch() {
+    while (!this.stopped) {
+      for (const event of this.client.events.slice(this.cursor)) {
+        this.cursor++;
+        if (event.sessionId !== this.session) continue;
+        if (event.method === 'Fetch.requestPaused') this.track(this.fetchPause(event));
+        const response = event.params?.redirectResponse ?? event.params?.response;
+        if (!response || !redirects.includes(response.status)) continue;
+        const requestId = event.params.requestId;
+        if (this.networkBodies.has(requestId)) continue;
+        this.networkBodies.add(requestId);
+        this.track(
+          this.send('Network.getResponseBody', { requestId }).then((out) => {
+            this.attempts.push({ method: 'Network.getResponseBody', ...out });
+          })
+        );
+      }
+      await pause(5);
+    }
+  }
+
+  async register(key, to, code = 302) {
+    const url = `${this.ordinary}/redirect-secret/${this.tag}-${key}`;
+    const path = new URL(url).pathname;
+    await this.fixture.redirectSecret({ path, to, code, body: this.marker });
+    this.registrations.push({ path });
+    return url;
+  }
+
+  async reset(suffix = 'reset') {
+    await load(this.reader, this.observer, `${this.ordinary}/doc?n=${this.tag}-${suffix}`);
+  }
+
+  async setup() {
+    this.observer = (
+      await this.reader.send('Target.attachToTarget', { targetId: this.targetId, flatten: true })
+    ).sessionId;
+    this.watching = this.watch();
+    await this.reader.send('Page.enable', {}, this.observer);
+    await this.reader.send('Storage.setCookies', {
+      cookies: [
+        {
+          name: this.cookie,
+          value: 'secret-cookie',
+          domain: 'seven.sliccy.ai',
+          path: '/',
+          secure: true,
+          sameSite: 'None',
+        },
+      ],
+    });
+    for (const domain of ['Page', 'Network', 'Runtime', 'Log', 'Audits'])
+      await this.send(`${domain}.enable`);
+    await this.send('Fetch.enable', {
+      patterns: [
+        { urlPattern: '*', requestStage: 'Request' },
+        { urlPattern: '*', requestStage: 'Response' },
+      ],
+    });
+    for (const to of [...this.protectedURLs, this.plainURL]) {
+      const url = new URL(to);
+      if (url.hash) continue;
+      const registration = { path: url.pathname, host: url.hostname, search: url.search };
+      await this.fixture.redirectSecret({ ...registration, body: `protected-body-${this.marker}` });
+      this.registrations.push(registration);
+    }
+  }
+
+  async headers() {
+    for (const [index, to] of this.destinations.entries()) {
+      for (const kind of ['navigate', 'href', 'fetch', 'xhr']) {
+        const code = this.mode === 'mix' ? [301, 303, 307, 308][index] : 302;
+        const url = await this.register(`${index}-${kind}`, to, code);
+        if (kind === 'navigate') await this.send('Page.navigate', { url });
+        else {
+          await this.reset();
+          const expression =
+            kind === 'href'
+              ? `location.href=${JSON.stringify(url)};void 0`
+              : kind === 'fetch'
+                ? `fetch(${JSON.stringify(url)}).catch(()=>{});void 0`
+                : this.xhrExpression(url);
+          await this.send('Runtime.evaluate', { expression });
+        }
+        await pause(250);
+        await this.send('Page.getFrameTree');
+        await this.send('Page.getResourceTree');
+        await this.send('Page.getNavigationHistory');
+        await this.reset();
+      }
+    }
+  }
+
+  xhrExpression(url) {
+    return `(()=>{const x=new XMLHttpRequest();x.open('GET',${JSON.stringify(url)});x.send()})();void 0`;
+  }
+
+  async stream(handle) {
+    let text = '';
+    if (!handle) return text;
+    for (let i = 0; i < 32; i++) {
+      const read = await this.send('IO.read', { handle });
+      text += read.result?.base64Encoded
+        ? decodeBase64(read.result.data)
+        : (read.result?.data ?? '');
+      if (!read.ok || read.result.eof) break;
+    }
+    await this.send('IO.close', { handle });
+    return text;
+  }
+
+  async snapshots(url, to, frameId) {
+    const navigate = await this.send('Page.navigate', { url });
+    await pause(500);
+    const resource = await this.send('Page.getResourceContent', {
+      frameId: navigate.result?.frameId ?? frameId,
+      url: to,
+    });
+    const snapshot = await this.send('Page.captureSnapshot', { format: 'mhtml' });
+    const dom = await this.send('DOMSnapshot.captureSnapshot', { computedStyles: [] });
+    this.responses.push({
+      resourceContentAttempted: true,
+      snapshotAttempted: true,
+      domSnapshotAttempted: true,
+      ordinaryResource: containsSecret(resource, this.marker),
+      ordinarySnapshot: containsSecret(snapshot, this.marker),
+      ordinaryDOM: containsSecret(dom, this.marker),
+    });
+  }
+
+  async override(url) {
+    await this.reset('override');
+    this.holdURL = `${this.ordinary}/data?n=${this.tag}-override`;
+    this.held = undefined;
+    await this.send('Runtime.evaluate', {
+      expression: `fetch(${JSON.stringify(this.holdURL)}).catch(()=>{});void 0`,
+    });
+    const deadline = Date.now() + 5000;
+    while (!this.held && Date.now() < deadline) await pause(10);
+    if (!this.held) throw new Error('redirect body: Fetch override pause missing');
+    const requestId = this.held.params.requestId;
+    const out = await this.send('Fetch.continueRequest', { requestId, url });
+    this.responses.push({
+      overrideMethod: 'Fetch.continueRequest',
+      overrideRefused: refused(out),
+      overrideWorked: out.ok,
+    });
+    this.holdURL = undefined;
+    if (!out.ok) await this.send('Fetch.continueRequest', { requestId });
+    await pause(500);
+  }
+
+  async body() {
+    const to = this.destinations[0];
+    const url = await this.register('body', to);
+    const tree = await this.send('Page.getFrameTree');
+    const frameId = tree.result?.frameTree.frame.id;
+    const start = (await this.fixture.log()).length;
+    const resource = await this.send('Network.loadNetworkResource', {
+      frameId,
+      url,
+      options: { disableCache: true, includeCredentials: true },
+    });
+    const text = await this.stream(resource.result?.resource?.stream);
+    this.responses.push({
+      protectedBody: this.side !== 'control' && text.includes(this.marker),
+      ordinaryBody: this.side === 'control' && text.includes(this.marker),
+    });
+    const before = this.client.events.length;
+    await this.send('Runtime.evaluate', { expression: this.xhrExpression(url) });
+    await pause(500);
+    const xhr = this.client.events
+      .slice(before)
+      .find(
+        (event) =>
+          event.method === 'Network.requestWillBeSent' &&
+          event.params.type === 'XHR' &&
+          event.params.request.url === url
+      );
+    if (!xhr) throw new Error('redirect body: XHR request was not observed');
+    await this.send('Network.replayXHR', { requestId: xhr.params.requestId });
+    this.responses.push({ replayAttempted: true });
+    await pause(500);
+    await this.snapshots(url, to, frameId);
+    await this.iframe();
+    await this.override(url);
+    this.responses.push({
+      cookieSent: (await this.fixture.log())
+        .slice(start)
+        .some((entry) => entry.headers.cookie?.includes(`${this.cookie}=`)),
+    });
+  }
+
+  async iframe() {
+    await this.reset('iframe');
+    const url = await this.register('iframe', this.destinations[1]);
+    await this.send('Runtime.evaluate', {
+      expression: `(()=>{const f=document.createElement('iframe');f.src=${JSON.stringify(url)};document.body.append(f)})();void 0`,
+    });
+    await pause(500);
+    await this.send('Page.getFrameTree');
+    const snapshot = await this.send('Page.captureSnapshot', { format: 'mhtml' });
+    const dom = await this.send('DOMSnapshot.captureSnapshot', { computedStyles: [] });
+    this.responses.push({
+      iframeSnapshotAttempted: true,
+      ordinaryIframeSnapshot: containsSecret(snapshot, this.marker),
+      ordinaryIframeDOM: containsSecret(dom, this.marker),
+    });
+  }
+
+  async evidence() {
+    await pause(8000);
+    await this.send('Fetch.disable');
+    await this.reset('survive');
+    const survives = await this.send('Runtime.evaluate', {
+      expression: 'document.title',
+      returnByValue: true,
+    });
+    const events = this.client.events.slice(this.eventsStart);
+    const messages = this.client.messages?.slice(this.messagesStart) ?? [];
+    const ordinaryEvents = events.filter(
+      (event) =>
+        containsSecret(event, this.marker) &&
+        JSON.stringify(event).includes(new URL(this.plainURL).host)
+    );
+    const extra = events.filter(
+      (event) =>
+        event.sessionId === this.session &&
+        event.method === 'Network.responseReceivedExtraInfo' &&
+        redirects.includes(event.params.statusCode)
+    );
+    const extraInPlace =
+      extra.length >= this.destinations.length * 4 &&
+      extra.every((event) => {
+        const headers = event.params.headers;
+        const origin = headers.location ?? headers.Location;
+        return (
+          this.protectedURLs.some((url) => new URL(url).origin === origin) &&
+          headersMatch(headers, origin) &&
+          headersTextMatch(event.params.headersText, origin)
+        );
+      });
+    const found = (key) => this.responses.some((entry) => entry[key]);
+    const attempted = (method) => this.attempts.some((entry) => entry.method === method);
+    const bodyRefused = (method) =>
+      this.attempts.filter((entry) => entry.method === method).length > 0 &&
+      this.attempts.filter((entry) => entry.method === method).every(refused);
+    return {
+      live: (await this.fixture.log()).some((entry) =>
+        entry.url.includes(`/redirect-secret/${this.tag}`)
+      ),
+      rawRecorded: this.messagesStart !== undefined && messages.length > events.length,
+      leakChannels: [...messages, ...this.responses]
+        .filter((message) => containsSecret(message, this.marker))
+        .map((message) =>
+          typeof message === 'string'
+            ? (JSON.parse(message).method ?? 'reply')
+            : (message.method ?? 'reply')
+        ),
+      secretHidden: !containsSecret([...messages, ...this.responses], this.marker),
+      sessionSurvives: survives.ok && survives.result?.result?.value === 'doc',
+      fetchBodyAttempted: attempted('Fetch.getResponseBody'),
+      networkBodyAttempted: attempted('Network.getResponseBody'),
+      fetchBodyRefused: bodyRefused('Fetch.getResponseBody'),
+      networkBodyRefused: bodyRefused('Network.getResponseBody'),
+      extraInPlace,
+      ...redirectFragments({
+        messages,
+        events,
+        replies: this.responses,
+        protectedOrigins: this.protectedURLs.map((url) => new URL(url).origin),
+        contains: (value) => containsSecret(value, this.marker),
+      }),
+      redirectLocation: ordinaryEvents.some(
+        (event) =>
+          event.method === 'Network.requestWillBeSent' &&
+          headersMatch(event.params.redirectResponse?.headers, this.plainURL)
+      ),
+      extraLocation:
+        this.side === 'guarded'
+          ? extraInPlace
+          : ordinaryEvents.some(
+              (event) =>
+                event.method === 'Network.responseReceivedExtraInfo' &&
+                headersMatch(event.params.headers, this.plainURL) &&
+                headersTextMatch(event.params.headersText, this.plainURL)
+            ),
+      fetchLocation: ordinaryEvents.some(
+        (event) =>
+          event.method === 'Fetch.requestPaused' &&
+          headersMatch(event.params.responseHeaders, this.plainURL)
+      ),
+      protectedBodyHidden: !found('protectedBody'),
+      cookieHidden: !found('cookieSent'),
+      ...Object.fromEntries(
+        [
+          'ordinaryBody',
+          'replayAttempted',
+          'resourceContentAttempted',
+          'snapshotAttempted',
+          'domSnapshotAttempted',
+          'ordinaryResource',
+          'ordinarySnapshot',
+          'ordinaryDOM',
+          'iframeSnapshotAttempted',
+          'ordinaryIframeSnapshot',
+          'ordinaryIframeDOM',
+        ].map((key) => [key, found(key)])
+      ),
+      overridesRefused:
+        this.responses.some((entry) => entry.overrideMethod) &&
+        this.responses
+          .filter((entry) => entry.overrideMethod)
+          .every((entry) => entry.overrideRefused),
+      overridesWorked:
+        this.responses.some((entry) => entry.overrideMethod) &&
+        this.responses
+          .filter((entry) => entry.overrideMethod)
+          .every((entry) => entry.overrideWorked),
+    };
+  }
+
+  async close() {
+    this.stopped = true;
+    await this.watching;
+    await Promise.allSettled([...this.jobs]);
+    await outcome(this.client.send('Fetch.disable', {}, this.session));
+    if (this.observer) {
+      await outcome(
+        this.reader.send(
+          'Network.deleteCookies',
+          { name: this.cookie, domain: 'seven.sliccy.ai', path: '/' },
+          this.observer
+        )
+      );
+      await outcome(this.reader.send('Target.detachFromTarget', { sessionId: this.observer }));
+    }
+    for (const registration of this.registrations)
+      await this.fixture.redirectSecret({ ...registration, remove: true });
+  }
+}
+
+export async function redirectSecret(options) {
+  if (!options.fixture?.redirectSecret)
+    throw new Error('redirectSecret fixture registration required');
+  const probe = new RedirectProbe(options);
+  try {
+    await probe.setup();
+    if (options.mode === 'body') await probe.body();
+    else await probe.headers();
+    return await probe.evidence();
+  } finally {
+    await probe.close();
+  }
+}