@ai-ecoverse/slicc-browsers 1.13.0 → 1.13.2

package/README.md

@@ -67,6 +67,8 @@ Every feature builds for `wasm32-wasip1`.
 
 `protected.mjs` is the reference matcher for [protected origins](#protected-origins): `import { protectedOrigins } from '@ai-ecoverse/slicc-browsers/protected.mjs'`, then `protectedOrigins(catalog.protectedOrigins, extraOrigins)` returns `{ url(text), target({ url, previous, opener, type, documentURL, unreachableURL, navigating }), cookieDomain(domain), storageKey(key), unparseable(text) }`, each a boolean. `url(text)` uses the load/loaded-URL fail-closed rule; `url(text, { readOnly: true })` preserves the old parse-failure result for read-only keys and value redaction, and `storageKey(key)` uses that mode internally. `unparseable(text)` identifies parse or unwrap failures without changing whether a parsed origin is protected. It needs only the WHATWG `URL`, so it runs in Node and in a browser. `protected.mjs` and `seven.mjs` import nothing and re-export nothing, so an extension or service worker can ship either file alone; `npm run validate` (through `scripts/self-contained.mjs`) evaluates each as a module in a fresh `node:vm` context that has only `URL`, with no linker resolution allowed.
 
+The complete static import graph of `guard-runner.mjs` is browser-safe too: it uses ordinary browser globals (`URL`, timers, `fetch`, `atob`/`btoa`, `Uint8Array`, `TextEncoder` and `TextDecoder`), never `Buffer`, `process`, `require` or `node:` imports. Base64 bodies and postData are decoded with `atob` and UTF-8 bytes rather than a Node shim. `npm run validate` loads and executes that graph in a fresh `node:vm` browser-like context, including an encoded-body exercise and a drivable page row. The separate host-side `./fixture` server intentionally uses Node HTTP/TLS APIs and is not imported by the browser runner.
+
 ## `catalog.json`
 
 `"schema": 1`. A minor release only adds fields; a field that changes meaning or goes away needs schema 2 and a major release. Relative paths are arrays of path segments, joined with the platform's separator. Top-level fields:
@@ -209,7 +211,7 @@ A client may register `Fetch.enable` patterns naming a protected origin in eithe
 - `setVersion`: the package version. The release flow stamps it into the npm package and the crate (`scripts/set-crate-version.mjs`). In git, and so in the Go module, it reads `0.0.0`; Go code gets the version from the module.
 - `targets`: the names a runner maps to a scheme, host and port: `seven`, `vault`, `vault-x` (a vault branch preview), `apex`, `own` (the client page's origin, `{client}`), `ordinary`, `ordinary-same-site`, `chrome-newtab`, `chrome-new-tab-page`, `chrome-settings`, `chrome-passwords`, `chrome-search`, `network-error`, `chrome-extension-page` and `file-root`. Each has a `description` and, for the protected ones, a default `host`. `chrome-newtab` (`chrome://newtab/`), `chrome-new-tab-page` (`chrome://new-tab-page/`), `chrome-settings` (`chrome://settings/`), `chrome-passwords` (`chrome://password-manager/`), `chrome-search` (`chrome-search://most-visited/`), `network-error` (`http://nonexistent.invalid/`), `chrome-extension-page` (a page of Chrome's built-in PDF viewer extension) and `file-root` (`file:///`) carry a `url`, which the runner uses unless `targets` maps the name to something else. No other URL in the file is one a runner must use.
 - `variants`: the detach variants in ms. `prompt` and `lagging` are documented; a runner may add others, such as `lagging-8s`, and reports the name it ran.
-- `capabilities`: what a transport may lack. `autoAttach` covers `Target.setAutoAttach`, `children` steps and child sessions; `browserSession` covers calls on the browser session; `browserContexts` covers `Target.createBrowserContext` and `Target.disposeBrowserContext`; `extensionWorld` means it can host a foreign content-script extension isolated world on the ordinary fixture; `chromeUrlsAttach` means the transport can attach to and drive `chrome://` pages. CDP over a DevTools port can; `chrome.debugger` can't, since Chrome refuses it every `chrome://` page, even with `--extensions-on-chrome-urls`.
+- `capabilities`: what a transport may lack. `autoAttach` covers `Target.setAutoAttach`, `children` steps and child sessions; `browserSession` covers calls on the browser session; `browserContexts` covers `Target.createBrowserContext` and `Target.disposeBrowserContext`; `extensionWorld` means it can host a foreign content-script extension isolated world on the ordinary fixture; `discovery` means session-less `Target.setDiscoverTargets` and `Target.targetCreated`/`Target.targetInfoChanged` delivery; `chromeUrlsAttach` means the transport can attach to and drive `chrome://` pages. CDP over a DevTools port can; `chrome.debugger` can't, since Chrome refuses it every `chrome://` page, even with `--extensions-on-chrome-urls`.
 - `placeholders`: every `{name}` used in the vectors, with what it stands for. `{client}` is the client page's origin, which the runner maps.
 
 **A vector** has:
@@ -259,9 +261,13 @@ Popups are observed by `Target.targetCreated` with the opener's `openerId`, or b
 
 `{ "extensionWorld": "hidden" | "select" | "debugger" | "drivable", "as": "world", "requires": ["extensionWorld"] }` runs the C9 compound probe on the current ordinary page. The runner attaches an independent observer to discover actual context ids, unique ids and names, and sends probes through the client session. Discovery matches the expected fixture extension’s exact origin, never the first extension world: `run()`’s optional `extensionWorldId` defaults to shared-web’s harness id `ankmbodmgimjemnojmeddfcdlbocolob`. Multiple unrelated content-script worlds are ignored for fixture selection, while guards must still protect foreign worlds. A custom fixture must provide the same content-script marker contract. Object handles are minted and validated on the unguarded control session, then replayed as guesses on the guarded leg; Chrome object handles and DOM node ids are session-local, so observer handles must never be mistaken for client handles. Numeric ids from the control are also replayed alongside fresh observer-discovered selectors, but numeric ids are local to a tab: a control id may name the next tab’s exposed default context, which must work and return no extension marker. The same-tab hidden world’s actual numeric id and every extension unique-id guess still require a matched refusal. Unknown numeric ids and stale object handles (`not exposed`) need explicit refusals rather than Chrome’s invalid-id errors. `guessesRefused` aggregates only required refusals; `guessesReached` must be false on the guarded leg, and `exposedContextsWork` must remain true. Its result contains boolean evidence consumed by ordinary `result` checks. The unguarded leg validates those selectors against Chrome itself before guarded evidence can pass.
 
-`{ "errorPage": "recover", "secret"?: "all" | "query" | "fragment", "as": "errorPage" }` (also modes `restore` and `sticky`; `secret` defaults to `all`) runs the protected-error-page compound probe with independent commit evidence, discovery redaction and recovery or sticky-lock checks. The unguarded observer seeds the protected history and failed commit, so the rows run on page-session-only transports too. The guarded client uses only `Target.getTargetInfo` with a `targetId`, `Target.getTargets`, `Target.setDiscoverTargets`, `Target.attachToTarget`, `Target.detachFromTarget` and `Target.closeTarget` without a session, which page-session transports answer themselves, and everything else on its page session; the rows require no capability. The runner leaves this probe’s independent Fetch sessions to the probe rather than answering their pauses itself.
+`{ "errorPage": "recover", "secret"?: "all" | "query" | "fragment", "as": "errorPage" }` (also modes `restore` and `sticky`; `secret` defaults to `all`) runs the protected-error-page compound probe with independent commit evidence, discovery redaction and recovery or sticky-lock checks. The unguarded observer seeds the protected history and failed commit, so the rows run on page-session-only transports too. The guarded client uses only `Target.getTargetInfo` with a `targetId`, `Target.getTargets`, `Target.setDiscoverTargets`, `Target.attachToTarget`, `Target.detachFromTarget` and `Target.closeTarget` without a session, which page-session transports answer themselves, and everything else on its page session; the rows require no whole-vector capability. Only `eventsRedacted` requires `discovery`: without it the probe does not call `Target.setDiscoverTargets`, that one field is `not-supported` in both legs, and the notes say `not-supported:discovery`; info, list, attach, recovery and lock checks still run. Discovery absence is structural: a guarded transport delivering either `Target.targetCreated` or `Target.targetInfoChanged` during such a row without declaring `discovery` fails the row, even when the event names an ordinary target. `Target.attachedToTarget` remains independently checked by `attachRedacted`. The runner leaves this probe’s independent Fetch sessions to the probe rather than answering their pauses itself.
+
+`{ "redirectSecret": "headers" | "mix" | "body", "as": "redirect" }` runs a C2 compound probe and owns its Fetch pauses. The client must expose `messages`, an append-only array of every raw received CDP text frame, recorded before parsing; an events-only or reply-only tap fails `rawRecorded`. Whenever a run includes a `C2.redirect-*` row or a `redirectSecret` step, `run()` retains an explicit `fixture.redirectSecret` hook or automatically installs a fetch-only `POST /redirect` bridge. Its base is `fixtureBase`, then `fixture.origin`, then `targets.ordinary`; a browser-page alias or reverse proxy must forward that endpoint to the bundled fixture. The bundled `fixtureServer()` always supplies both its direct hook and HTTP control endpoint, so no custom registration method is needed. Missing, unreachable or non-successful registration is an explicit row/summary error containing `redirectSecret fixture registration required`, never a pass or a skipped observation. Fixture logs must include headers for the cookie check. The guard’s events and raw messages must represent the same delivered stream.
+
+**Host-harness requirements for every guard.** Host Node processes may use `fixtureServer()` from `./fixture`; browser pages must import only the browser-safe runner graph, served with JavaScript MIME types, and need no Node-global shim. All guards supply a guarded client, an independent unguarded observer, mapped fixture origins and the relevant advertised capabilities. C2 clients additionally record every received raw CDP frame in `client.messages` before parsing. Route protected seven/vault hosts to the fixture with `--host-resolver-rules`, including default-port callback URLs; a live protected-body negative needs HTTPS fixture trust (the reference harness pins its SPKI).
 
-`{ "redirectSecret": "headers" | "mix" | "body", "as": "redirect" }` runs a C2 compound probe and owns its Fetch pauses. The client must expose `messages`, an append-only array of every raw received CDP text frame, recorded before parsing; an events-only or reply-only tap fails `rawRecorded`. The fixture must implement `redirectSecret({ path, host?, search?, to?, code?, body, remove? })`: registering an allowed hop without putting the protected marker in the initiating URL, and registering the callback body on the protected host. `fixtureServer()` supplies it. Fixture logs must include headers for the cookie check. The guard’s events and raw messages must represent the same delivered stream.
+For remote/page harnesses, `fixtureClient(base)` is exported by `./guard-runner` and `./fixture-client`, or `run(set, { fixtureBase: base, ... })` constructs it. The bundled server serves CORS-safe `GET /log?since=N` as `{ from: N, entries: [...] }`, with an append-only history unaffected by `fixture.reset()`, and `POST /redirect` with a JSON-encoded string body (a simple text/plain request, without a preflight). Control requests do not appear in the log. Registration descriptors are `{ path, host?, search?, to?, code?, body, remove? }`: `path` starts with `/`, `host` selects the callback hostname, `search` distinguishes query-bearing callbacks, `to` creates a redirect with the four Location/Content-Location/Refresh/Link headers, `code` defaults to 302, an omitted `to` serves the callback body, and `remove: true` unregisters it. The bundled endpoint returns 204; custom servers must acknowledge with a successful status and actually serve the registered routes. Custom fixtures may instead supply an async `fixture.redirectSecret` hook directly; a separate log/control server can implement the same `GET /log` and `POST /redirect` contract. A Node harness using browser-only DNS aliases should pass a reachable `fixtureBase` or its direct hook.
 
 `{ "unparseable": true, "as": "unparseable" }` runs the C8 malformed-URL compound probe on the current ordinary page: independent browser ground truth, raw/canonical destination commands, discovery/attach and cookie checks. Boolean evidence is consumed by ordinary `result` checks, with native Chrome outcomes retained in its diagnostics.
 
@@ -374,6 +380,8 @@ every alternative of an `any`, or a required (`all`, `not` or plain) check, need
 selects one variant or an array; omission selects all. `parallel` defaults to 1.
 With the `browserContexts` capability each leg runs in its own browser context. A `Target.createBrowserContext` that fails with a timeout is retried once, and the row's `notes` records it; any other failure fails the row.
 
+Every target created by the runner’s own unguarded observer uses `Target.createTarget` with `newWindow: true`, then verifies through `Target.getTargetInfo` that `openerId` is absent. A supplied opener or missing target evidence fails and cleans up that target, rather than inheriting the active client tab (which could be seven). This includes ordinary control setup, storage canaries, protected-error history seeds and the malformed-URL observer. The row notes record `newWindow=true, openerId absent`. Intentional guarded-client creation commands and popup/opener tests keep their original parameters.
+
 `settleScale` (default 1) multiplies the bounds of waits for events the leg expects to happen: settles (beacon, served, title and load) on the control leg and `required` settles on either leg, `paused` on the control leg, page and child loads, the wait for a background step's `as` result (`<as> did not complete within <ms>ms`), the wait for the pre-action beacons, the C9 control's `Debugger.paused`, and the wait for an observation the leg expects to be `true`. Adopters on slow hosts can set 3 or 4. Every wait polls and returns as soon as its event arrives, so a larger bound only costs time when something is really missing, and each timeout error names the bound it used. An observation read from the fixture (`observer: "fixture"`, such as a beacon or a served request) that the leg expects to be `true` is polled for up to 5000 ms (scaled) instead of read once. One that the leg expects to be `false` is still read once.
 
 `refusalScale` (default 1) multiplies the bounds of waits for what the guarded leg expects to be absent, the beacon, request, title or navigation that the guard should block: settles that are not `required`, and `paused`, on the guarded leg. Such a wait runs to its full bound whenever the guard works, so `settleScale` leaves it alone. The trade-off: a larger `refusalScale` gives more sensitivity to a leak that arrives late on a slow host, because the observations after the wait see it, at the cost of that much more time per guarded row. Adopters should keep `refusalScale` at 1 or higher, never below 1; the runner refuses a `refusalScale` below 1 with `refusalScale must be a number of at least 1`.
@@ -499,6 +507,7 @@ const capabilities = {
   browserSession: true,
   browserContexts: true,
   chromeUrlsAttach: true,
+  discovery: true,
 };
 const execution = await run(set, {
   clientFactory: (metadata) => connectGuardAndObserver(metadata),
@@ -624,7 +633,7 @@ Go 1.26, Rust stable with `wasm32-wasip1`, Node ≥ 24.
 - `npm run validate` checks `catalog.json`, `corpus.json`, `protected.json` and `guard-vectors.json` against the schemas, runs the protected-origin vectors through `protected.mjs`, loads `protected.mjs` and `seven.mjs` with only `URL`, and checks what a schema can't say: unique ids, bundle ids and names, known Windows roots, rising tiers, compiling patterns, known tokens, tier order, `sevenOpen`, `tabs` (which holds no entry of `sevenTabs`), `six` and `auto` in each `expected.json`, and no port from 9222 to 9229.
 - Every gate prints one verdict line when it passes: `validate: PASS …`, `corpus: PASS <n> cases` (`node scripts/corpus.mjs --check`), `major-guard: PASS v<version> fits <module>`, and `guard-sweep: PASS 14 targets` (`npm run test:guard-sweep`). CI runs each through `scripts/gate.mjs --expect <regex> -- <command>`, which fails when the command exits non-zero or prints no matching line, so a silent or early exit never reads as a pass. `gate.mjs --expect <regex> --in <file>` checks a log instead; the release job uses it on semantic-release's log for the major-guard line. `npm run test:gates` tests the gates, including runs through a symlinked checkout and a symlinked script.
 - `npm run lint`: the slicc lint tools (Biome, no comments, no unit tests in git, `AGENTS.md`), `gofmt`, `go mod tidy -diff`, `go vet`, golangci-lint, `cargo fmt --check` and clippy.
-- `npm test`: `validate`, `test/integration/self-contained.test.mjs`, the Go tests in `test/integration/`, and `cargo test --all-features`.
+- `npm test`: `validate`, `test/integration/self-contained.test.mjs`, `test/integration/git-retry.test.mjs`, the Go tests in `test/integration/`, and `cargo test --all-features`.
 - `npm run build`: the Go module, the crate (also for `wasm32-wasip1`), and `npm pack --dry-run`.
 
 Changing a table in `slicc-cli/internal/browser` means changing `catalog.json` here, releasing, and bumping the dependency; slicc-cli has no tables of its own. A new behaviour gets a corpus case.
@@ -637,6 +646,8 @@ semantic-release cuts one version from `main` for all three packages (`.github/w
 3. **crates.io:** with the repository variable `SLICC_BROWSERS_CRATES_PUBLISH` set to `true`, `Cargo.toml` is stamped with the version and `cargo publish` runs with a short-lived token from crates.io trusted publishing (`rust-lang/crates-io-auth-action`). A version that is already on crates.io is skipped.
 4. **Cert line:** after the npm publish, the workflow runs `npm pack @ai-ecoverse/slicc-browsers@X.Y.Z` against the registry and appends `cert: @ai-ecoverse/slicc-browsers@X.Y.Z sha256=<hex> gitHead=<sha>` to the `vX.Y.Z` GitHub release and the job summary, once; the cert lane copies it from there.
 
+GitHub sometimes rejects the push of `refs/notes/semantic-release-vX.Y.Z` with a bare `(failed)` right after the tag push; no ruleset covers `refs/notes/*`. The semantic-release step runs with `pipefail` and puts `scripts/git-retry.mjs` first on `PATH` as `git`: it runs the real git (`REAL_GIT`) and retries a push of a `refs/notes/` ref up to five times, 5, 10, 15 and 20 seconds apart; any other git command runs once. When semantic-release still fails, the job fails before npm and crates.io publish. Recover without moving the tag: create the GitHub release on the existing tag, then run `gh workflow run release.yml --ref main -f tag=vX.Y.Z`. A tag without its note counts as on the default channel (semantic-release reads a missing note as `channels: [null]`), so the next release builds on it. `test/integration/git-retry.test.mjs` tests the retry with a fake git.
+
 A run started by hand publishes what's missing without a new release: `gh workflow run release.yml --ref main` when `main`'s head has its tag, or `gh workflow run release.yml --ref main -f tag=vX.Y.Z` for any existing tag. `gh workflow run release.yml --ref main -f cert-only=true` only adds the cert line for the latest npm version.
 
 **Go module versions.** A pushed tag is the release: `proxy.golang.org` caches it and `sum.golang.org` records its hash for good. Never move or delete a pushed tag; retract a bad version in `go.mod` and release anew. A `BREAKING CHANGE` needs a `/vN` module path first.

package/fixture-client.mjs

@@ -0,0 +1,51 @@
+export function fixtureClient(base, { fetch: request = globalThis.fetch } = {}) {
+  const entries = [];
+  let pending;
+  return {
+    log: async () => {
+      if (!pending)
+        pending = (async () => {
+          const response = await request(new URL(`/log?since=${entries.length}`, base));
+          if (!response.ok) throw new Error(`fixture.log: HTTP ${response.status}`);
+          const batch = await response.json();
+          if (batch.from !== entries.length || !Array.isArray(batch.entries))
+            throw new Error('fixture.log: invalid append-only log response');
+          entries.push(...batch.entries);
+          return [...entries];
+        })().finally(() => {
+          pending = undefined;
+        });
+      return pending;
+    },
+    redirectSecret: async (registration) => {
+      try {
+        const response = await request(new URL('/redirect', base), {
+          method: 'POST',
+          body: JSON.stringify(registration),
+        });
+        if (!response.ok) throw new Error(`HTTP ${response.status}`);
+      } catch (error) {
+        throw new Error(
+          `redirectSecret fixture registration required: POST /redirect failed: ${error.message}`
+        );
+      }
+    },
+  };
+}
+
+export function prepareFixture(set, options) {
+  const fixture =
+    options.fixture ?? (options.fixtureBase ? fixtureClient(options.fixtureBase) : undefined);
+  const needsRedirect = set.vectors.some(
+    (vector) =>
+      vector.id.startsWith('C2.redirect') || vector.trigger?.some((step) => step.redirectSecret)
+  );
+  if (!needsRedirect || typeof fixture?.redirectSecret === 'function' || !fixture?.log)
+    return fixture;
+  const control = fixtureClient(options.fixtureBase ?? fixture.origin ?? options.targets?.ordinary);
+  return {
+    ...fixture,
+    log: (...args) => fixture.log(...args),
+    redirectSecret: control.redirectSecret,
+  };
+}

package/fixture-server.mjs

@@ -108,16 +108,22 @@ function requestURL(req, scheme) {
 
 export async function fixtureServer({ host = '127.0.0.1', port = 0, tls, latency } = {}) {
   let entries = [];
+  const history = [];
   const redirects = new Map();
+  const redirectSecret = async ({ path, host = '', search = '', remove, ...value }) => {
+    if (
+      typeof path !== 'string' ||
+      !path.startsWith('/') ||
+      (!remove && typeof value.body !== 'string')
+    )
+      throw new Error('invalid redirect registration');
+    const key = `${host}${path}${search}`;
+    if (remove) redirects.delete(key);
+    else redirects.set(key, value);
+  };
   const scheme = tls ? 'https' : 'http';
-  const handler = (req, res) => {
+  const handler = async (req, res) => {
     const url = requestURL(req, scheme);
-    entries.push({
-      url: url.href,
-      method: req.method,
-      headers: { ...req.headers },
-      time: Date.now(),
-    });
     const p = url.searchParams;
     const cors = {
       'access-control-allow-origin': req.headers.origin ?? '*',
@@ -136,6 +142,30 @@ export async function fixtureServer({ host = '127.0.0.1', port = 0, tls, latency
         'text/html',
         headers
       );
+    if (req.method === 'GET' && url.pathname === '/log') {
+      const from = Number(p.get('since') ?? 0);
+      if (!Number.isInteger(from) || from < 0 || from > history.length)
+        return send(400, 'invalid log cursor', 'text/plain');
+      return send(200, JSON.stringify({ from, entries: history.slice(from) }), 'application/json');
+    }
+    if (req.method === 'POST' && url.pathname === '/redirect') {
+      try {
+        const chunks = [];
+        for await (const chunk of req) chunks.push(chunk);
+        await redirectSecret(JSON.parse(Buffer.concat(chunks).toString('utf8')));
+        return send(204, '', 'text/plain');
+      } catch {
+        return send(400, 'invalid redirect registration', 'text/plain');
+      }
+    }
+    const entry = {
+      url: url.href,
+      method: req.method,
+      headers: { ...req.headers },
+      time: Date.now(),
+    };
+    entries.push(entry);
+    history.push(entry);
     const wait = latency?.(url) ?? 0;
     if (wait > 0) setTimeout(() => route(req, url, send, html, redirects), wait);
     else route(req, url, send, html, redirects);
@@ -148,11 +178,7 @@ export async function fixtureServer({ host = '127.0.0.1', port = 0, tls, latency
   const address = server.address();
   return {
     redirects,
-    redirectSecret: async ({ path, host = '', search = '', remove, ...value }) => {
-      const key = `${host}${path}${search}`;
-      if (remove) redirects.delete(key);
-      else redirects.set(key, value);
-    },
+    redirectSecret,
     port: address.port,
     origin: `${scheme}://${host}:${address.port}`,
     log: () => structuredClone(entries),

package/guard-runner.mjs

@@ -1,3 +1,7 @@
+import { fixtureClient, prepareFixture } from './fixture-client.mjs';
+
+export { fixtureClient };
+
 import { extensionWorld } from './extension-world.mjs';
 import {
   beacon,
@@ -13,6 +17,7 @@ import {
   result,
   steps,
 } from './guard-driver.mjs';
+import { createObserverTarget, discoveryViolation } from './observer-target.mjs';
 import { protectedErrorPage } from './protected-error-page.mjs';
 import { redirectSecret } from './redirect-secret.mjs';
 import { canonicalURL, unparseableURLs } from './unparseable-url.mjs';
@@ -153,11 +158,15 @@ class Execution {
   }
 
   async create(url, context = this.vars.context, client = this.client, background = true) {
-    const { targetId } = await client.send('Target.createTarget', {
+    const params = {
       url: 'about:blank',
       background,
       ...(context ? { browserContextId: context } : {}),
-    });
+    };
+    const { targetId } =
+      client === this.reader
+        ? await createObserverTarget(this.reader, params, this.notes)
+        : await client.send('Target.createTarget', params);
     this.targets.push(targetId);
     this.pageTarget = targetId;
     this.vars.pageTarget = targetId;
@@ -200,10 +209,14 @@ class Execution {
       ...(this.vars.context ? { browserContextId: this.vars.context } : {}),
     });
     if (!state.storage) return;
-    const { targetId } = await this.reader.send('Target.createTarget', {
-      url: 'about:blank',
-      ...(this.vars.context ? { browserContextId: this.vars.context } : {}),
-    });
+    const { targetId } = await createObserverTarget(
+      this.reader,
+      {
+        url: 'about:blank',
+        ...(this.vars.context ? { browserContextId: this.vars.context } : {}),
+      },
+      this.notes
+    );
     this.canaryTarget = targetId;
     this.targets.push(targetId);
     const { sessionId } = await this.reader.send('Target.attachToTarget', {
@@ -711,6 +724,8 @@ class Execution {
           mode: step.errorPage,
           side: this.side,
           secret: step.secret,
+          discovery: supported(['discovery'], this.options.capabilities),
+          notes: this.notes,
         })
       );
     if (step.unparseable)
@@ -724,6 +739,7 @@ class Execution {
           tag: this.vars.tag,
           fixture: this.options.fixture,
           browserSession: supported(['browserSession'], this.options.capabilities),
+          notes: this.notes,
         })
       );
     if (step.extensionWorld)
@@ -1219,6 +1235,16 @@ class Execution {
           (this.reader ?? this.client).send('Target.disposeBrowserContext', { browserContextId })
         );
       await Promise.allSettled(this.pending);
+      if (
+        this.side === 'guarded' &&
+        this.vector.observe?.eventsRedacted?.requires?.includes('discovery')
+      ) {
+        const violation = discoveryViolation(
+          this.client.events.slice(this.eventStart),
+          supported(['discovery'], this.options.capabilities)
+        );
+        if (violation) this.errors.push(violation);
+      }
     }
   }
 }
@@ -1613,6 +1639,7 @@ export function run(set, options) {
 
 async function runAll(set, options, flights) {
   const opts = { capabilities: {}, variant: Object.keys(set.variants), parallel: 1, ...options };
+  opts.fixture = prepareFixture(set, opts);
   opts.targets = {
     ...Object.fromEntries(
       Object.entries(set.targets ?? {})

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.13.0",
+  "setVersion": "1.13.2",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -91,6 +91,7 @@
     "browserSession": "CDP calls on the browser session",
     "browserContexts": "Target.createBrowserContext and Target.disposeBrowserContext",
     "extensionWorld": "a browser hosting a foreign content-script extension isolated world on the ordinary fixture page",
+    "discovery": "session-less Target.setDiscoverTargets and targetCreated/targetInfoChanged delivery; absent transports must emit neither event",
     "chromeUrlsAttach": "attaching to and driving chrome:// pages, which CDP over a DevTools port can and chrome.debugger can't"
   },
   "placeholders": {
@@ -820,6 +821,7 @@
         },
         "eventsRedacted": {
           "means": "protected error-page recover: eventsRedacted",
+          "requires": ["discovery"],
           "check": {
             "result": "errorPage",
             "path": "result.eventsRedacted",
@@ -968,6 +970,7 @@
         },
         "eventsRedacted": {
           "means": "protected error-page recover (query): eventsRedacted",
+          "requires": ["discovery"],
           "check": {
             "result": "errorPage",
             "path": "result.eventsRedacted",
@@ -1116,6 +1119,7 @@
         },
         "eventsRedacted": {
           "means": "protected error-page recover (fragment): eventsRedacted",
+          "requires": ["discovery"],
           "check": {
             "result": "errorPage",
             "path": "result.eventsRedacted",
@@ -1263,6 +1267,7 @@
         },
         "eventsRedacted": {
           "means": "protected error-page restore: eventsRedacted",
+          "requires": ["discovery"],
           "check": {
             "result": "errorPage",
             "path": "result.eventsRedacted",
@@ -1443,6 +1448,7 @@
         },
         "eventsRedacted": {
           "means": "protected error-page sticky: eventsRedacted",
+          "requires": ["discovery"],
           "check": {
             "result": "errorPage",
             "path": "result.eventsRedacted",
@@ -1635,6 +1641,7 @@
         },
         "eventsRedacted": {
           "means": "protected error-page sticky (query): eventsRedacted",
+          "requires": ["discovery"],
           "check": {
             "result": "errorPage",
             "path": "result.eventsRedacted",
@@ -1827,6 +1834,7 @@
         },
         "eventsRedacted": {
           "means": "protected error-page sticky (fragment): eventsRedacted",
+          "requires": ["discovery"],
           "check": {
             "result": "errorPage",
             "path": "result.eventsRedacted",

package/observer-target.mjs

@@ -0,0 +1,23 @@
+import { outcome } from './guard-driver.mjs';
+
+export async function createObserverTarget(reader, params, notes = []) {
+  const result = await reader.send('Target.createTarget', { ...params, newWindow: true });
+  try {
+    const { targetInfo } = await reader.send('Target.getTargetInfo', { targetId: result.targetId });
+    if (!targetInfo || Object.hasOwn(targetInfo, 'openerId'))
+      throw new Error('observer target must have no openerId');
+    notes.push(`observer target ${result.targetId}: newWindow=true, openerId absent`);
+    return result;
+  } catch (error) {
+    await outcome(reader.send('Target.closeTarget', { targetId: result.targetId }));
+    throw error;
+  }
+}
+
+export function discoveryViolation(events, declared) {
+  if (declared) return null;
+  const event = events.find((entry) =>
+    ['Target.targetCreated', 'Target.targetInfoChanged'].includes(entry.method)
+  );
+  return event ? `discovery not declared, but transport delivered ${event.method}` : null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.13.0",
+  "version": "1.13.2",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -38,7 +38,8 @@
     "./package.json": "./package.json",
     "./guard-runner.mjs": "./guard-runner.mjs",
     "./guard-runner": "./guard-runner.mjs",
-    "./fixture": "./fixture-server.mjs"
+    "./fixture": "./fixture-server.mjs",
+    "./fixture-client": "./fixture-client.mjs"
   },
   "files": [
     "catalog.json",
@@ -55,7 +56,9 @@
     "unparseable-url.mjs",
     "protected-error-page.mjs",
     "redirect-secret.mjs",
-    "redirect-fragments.mjs"
+    "redirect-fragments.mjs",
+    "observer-target.mjs",
+    "fixture-client.mjs"
   ],
   "scripts": {
     "prepare": "lefthook install",
@@ -63,22 +66,22 @@
     "validate": "node scripts/validate.mjs",
     "lint": "slicc-lint && test -z \"$(gofmt -l .)\" && go mod tidy -diff && go vet ./... && golangci-lint run && cargo fmt --check && cargo clippy --all-features --all-targets -- -D warnings",
     "format": "biome check --write . && gofmt -w . && cargo fmt",
-    "test": "npm run validate && node --test test/integration/self-contained.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
+    "test": "npm run validate && node --test test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/git-retry.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
     "test:unit": "go test -race -cover ./...",
     "build": "go build ./... && cargo build --all-features && cargo build --target wasm32-wasip1 --all-features && npm pack --dry-run",
     "trust": "npx fledgling sync -y --skip-publish",
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish",
     "release": "semantic-release",
     "test:guard": "npm run test:guard-integration && npm run test:guard-sweep",
-    "test:guard-integration": "node --test --test-concurrency=2 test/integration/guard-lifecycle.test.mjs test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-worlds.test.mjs test/integration/guard-world-discovery.test.mjs test/integration/guard-world-guesses.test.mjs test/integration/guard-unparseable.test.mjs test/integration/guard-redirect-secret.test.mjs test/integration/guard-error-page.test.mjs test/integration/guard-scales.test.mjs test/integration/guard-shared-log.test.mjs test/integration/guard-pre-beacon.test.mjs test/integration/guard-world-pause.test.mjs test/integration/self-contained.test.mjs",
+    "test:guard-integration": "node --test --test-concurrency=2 test/integration/guard-lifecycle.test.mjs test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-worlds.test.mjs test/integration/guard-world-discovery.test.mjs test/integration/guard-world-guesses.test.mjs test/integration/guard-unparseable.test.mjs test/integration/guard-redirect-secret.test.mjs test/integration/guard-error-page.test.mjs test/integration/guard-discovery.test.mjs test/integration/guard-browser-page.test.mjs test/integration/guard-scales.test.mjs test/integration/guard-shared-log.test.mjs test/integration/guard-pre-beacon.test.mjs test/integration/guard-world-pause.test.mjs test/integration/self-contained.test.mjs",
     "test:guard-sweep": "node scripts/test-guards.mjs",
     "test:gates": "node --test test/integration/gates.test.mjs",
     "test:guard-target": "node --test test/integration/guard-runner.test.mjs",
     "test:unit:redirect": "mkdir -p coverage/unit && node --experimental-test-coverage --test --test-coverage-include=redirect-secret.mjs --test-coverage-include=redirect-fragments.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/redirect.lcov test/unit/guard-redirect-*.test.mjs && slicc-diff-cover coverage/unit/redirect.lcov",
-    "test:unit:guard": "node --experimental-test-coverage --test --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-lines=100 test/unit/guard-*.test.mjs"
+    "test:unit:guard": "mkdir -p coverage/unit && node --experimental-vm-modules --no-warnings --experimental-test-coverage --test --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-include=fixture-client.mjs --test-coverage-include=observer-target.mjs --test-coverage-include=protected-error-page.mjs --test-coverage-include=unparseable-url.mjs --test-coverage-include=scripts/browser-runner.mjs --test-coverage-include=scripts/validate.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/guard.lcov test/unit/guard-*.test.mjs && slicc-diff-cover coverage/unit/guard.lcov"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-shared-web": "2.0.0",
+    "@ai-ecoverse/slicc-shared-web": "2.2.0",
     "@biomejs/biome": "2.5.15",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",

package/protected-error-page.mjs

@@ -1,4 +1,5 @@
 import { outcome } from './guard-driver.mjs';
+import { createObserverTarget } from './observer-target.mjs';
 
 const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 const refused = (out) => !out.ok && /^slicc: refused:/.test(out.error?.message ?? '');
@@ -43,7 +44,15 @@ async function lockChecks({ client, session, targetId, result }) {
   result.closeRefused = refused(await outcome(client.send('Target.closeTarget', { targetId })));
 }
 
-async function redaction({ client, targetId, failedURL, protectedOrigin, start, result }) {
+async function redaction({
+  client,
+  targetId,
+  failedURL,
+  protectedOrigin,
+  start,
+  result,
+  discovery,
+}) {
   const info = await outcome(client.send('Target.getTargetInfo', { targetId }));
   const list = await outcome(client.send('Target.getTargets'));
   const before = client.events.length;
@@ -71,11 +80,13 @@ async function redaction({ client, targetId, failedURL, protectedOrigin, start,
     .slice(start)
     .filter(
       (e) =>
+        ['Target.targetCreated', 'Target.targetInfoChanged'].includes(e.method) &&
         e.params?.targetInfo?.targetId === targetId &&
         e.params.targetInfo.url.includes(new URL(protectedOrigin).host)
     );
-  result.eventsRedacted =
-    targetEvents.length > 0 && targetEvents.every((e) => only(e.params.targetInfo));
+  result.eventsRedacted = discovery
+    ? targetEvents.length > 0 && targetEvents.every((e) => only(e.params.targetInfo))
+    : 'not-supported';
 }
 
 const secrets = {
@@ -94,12 +105,19 @@ export async function protectedErrorPage({
   side,
   internalSessions = new Set(),
   secret = 'all',
+  discovery = true,
+  notes = [],
 }) {
   const initial = `${protectedOrigin}/doc?n=${tag}-history`;
   const failedURL = `${protectedOrigin}${secrets[secret](tag)}`;
   const result = {};
+  if (!discovery) notes.push('eventsRedacted: not-supported:discovery');
   const start = client.events.length;
-  const { targetId } = await reader.send('Target.createTarget', { url: initial, background: true });
+  const { targetId } = await createObserverTarget(
+    reader,
+    { url: initial, background: true },
+    notes
+  );
   let session;
   let observer;
   let failing = false;
@@ -142,7 +160,7 @@ export async function protectedErrorPage({
     if (!session) return { live: false, attached: false };
     await client.send('Page.enable', {}, session);
     await client.send('Runtime.enable', {}, session);
-    await client.send('Target.setDiscoverTargets', { discover: true });
+    if (discovery) await client.send('Target.setDiscoverTargets', { discover: true });
     if (side === 'control') {
       failing = true;
       await reader.send(
@@ -172,7 +190,7 @@ export async function protectedErrorPage({
       throw new Error(
         `protected-error-page: missing error commit ${JSON.stringify(result.evidence)}`
       );
-    await redaction({ client, targetId, failedURL, protectedOrigin, start, result });
+    await redaction({ client, targetId, failedURL, protectedOrigin, start, result, discovery });
     const beforeReload = (await frame()).loaderId;
     result.reload = (await outcome(client.send('Page.reload', {}, session))).ok;
     if (result.reload) {

package/redirect-secret.mjs

@@ -2,6 +2,23 @@ import { load, outcome } from './guard-driver.mjs';
 import { redirectFragments } from './redirect-fragments.mjs';
 
 const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const decodeBase64 = (text) =>
+  new TextDecoder().decode(Uint8Array.from(atob(text), (char) => char.charCodeAt(0)));
+const base64Slices = (value) => {
+  const normalized = value.replaceAll('-', '+').replaceAll('_', '/').replace(/=+$/, '');
+  const candidates = [];
+  for (let offset = 0; offset < 4; offset++) {
+    const part = normalized.slice(offset);
+    const usable = part.slice(0, part.length - (part.length % 4 === 1 ? 1 : 0));
+    candidates.push(usable.padEnd(Math.ceil(usable.length / 4) * 4, '='));
+    candidates.push(part.slice(0, Math.floor(part.length / 4) * 4));
+  }
+  return [...new Set(candidates)].filter(Boolean);
+};
+const decodedBase64 = (value) =>
+  [...value.matchAll(/[A-Za-z0-9+/_-]{12,}={0,2}/g)].flatMap(([text]) =>
+    base64Slices(text).map(decodeBase64)
+  );
 const refused = (out) => !out.ok && /^slicc: refused:/.test(out.error?.message ?? '');
 const redirects = [301, 302, 303, 307, 308];
 const redirectHeaders = (to) => ({
@@ -45,8 +62,7 @@ export function containsSecret(value, marker) {
       try {
         decoded.push(JSON.parse(`"${value}"`));
       } catch {}
-      for (const match of value.matchAll(/[A-Za-z0-9+/]{12,}={0,2}/g))
-        decoded.push(Buffer.from(match[0], 'base64').toString('utf8'));
+      decoded.push(...decodedBase64(value));
       return decoded.some((text) => text !== value && visit(text, depth + 1));
     }
     if (value && typeof value === 'object')
@@ -212,7 +228,7 @@ class RedirectProbe {
     for (let i = 0; i < 32; i++) {
       const read = await this.send('IO.read', { handle });
       text += read.result?.base64Encoded
-        ? Buffer.from(read.result.data, 'base64').toString()
+        ? decodeBase64(read.result.data)
         : (read.result?.data ?? '');
       if (!read.ok || read.result.eof) break;
     }

package/schema/guard-vectors.schema.json

@@ -86,7 +86,8 @@
         "browserSession",
         "browserContexts",
         "chromeUrlsAttach",
-        "extensionWorld"
+        "extensionWorld",
+        "discovery"
       ],
       "properties": {
         "autoAttach": {
@@ -102,6 +103,7 @@
           "minLength": 1
         },
         "extensionWorld": { "type": "string", "minLength": 1 },
+        "discovery": { "type": "string", "minLength": 1 },
         "chromeUrlsAttach": {
           "type": "string",
           "minLength": 1
@@ -133,7 +135,8 @@
         "browserSession",
         "browserContexts",
         "chromeUrlsAttach",
-        "extensionWorld"
+        "extensionWorld",
+        "discovery"
       ]
     },
     "requires": {

package/unparseable-url.mjs

@@ -1,4 +1,5 @@
 import { outcome, owned, parseURL } from './guard-driver.mjs';
+import { createObserverTarget } from './observer-target.mjs';
 
 const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 const refused = (out) => !out.ok && /^slicc: refused:/.test(out.error?.message ?? '');
@@ -151,6 +152,7 @@ export async function unparseableURLs({
   tag,
   fixture,
   browserSession,
+  notes = [],
 }) {
   const root = new URL(origin);
   const cookie = `seven-unparseable-${tag}`;
@@ -162,10 +164,14 @@ export async function unparseableURLs({
       cookies: [{ name: cookie, value, domain: '.sliccy.ai', path: '/', secure: false }],
     });
     const url = rootURL(root, 'exa%20mple.sliccy.ai', `/doc?n=${tag}-observer`);
-    const { targetId: probeId } = await reader.send('Target.createTarget', {
-      url,
-      background: true,
-    });
+    const { targetId: probeId } = await createObserverTarget(
+      reader,
+      {
+        url,
+        background: true,
+      },
+      notes
+    );
     targets.add(probeId);
     const ground = await document(reader, probeId, url);
     observer = (await reader.send('Target.attachToTarget', { targetId: probeId, flatten: true }))