@ai-ecoverse/slicc-browsers 1.14.3 → 1.14.4

package/README.md

@@ -190,9 +190,9 @@ The `C9` foreign extension isolated-world family requires `extensionWorld`: a br
 
 The integration launcher loads shared-web 1.25.2’s harness extension exactly once through `Extensions.loadUnpacked` (`ankmbodmgimjemnojmeddfcdlbocolob`), whose content script runs on HTTP(S) pages. shared-web 1.25.2 also loads it by default in its own harness. A transport unable to host a foreign content-script extension omits `extensionWorld` and reports `not-supported:extensionWorld`; an advertised capability with no observed world fails, rather than silently skipping.
 
-`C2.redirect-secret` probes ordinary fixture 302s to seven’s `/auth/callback?code=…&state=…` and vault’s `/oauth/mcp-callback?code=…`, plus `#access_token=…` variants of both. It navigates with Page and scripted `location.href`, fetches a subresource and sends an XHR. The 302 carries `Location`, `Content-Location`, `Refresh: 0;url=…` and `Link: <…>; rel=preconnect`. Page, Network (including ExtraInfo), Runtime, Log, Audits and both Fetch stages are enabled. Every received raw message is scanned, including replies, across an eight-second tail, for raw, percent-encoded, JSON-escaped and base64 marker representations. Both response-body APIs are attempted on each hop; guarded bodies need matched refusals. Page frame trees, resource trees and navigation history are read before recovery to catch error-page leftovers. A separate structural check requires every protected `Network.Request.urlFragment` and `Page.Frame.urlFragment` to be empty or absent, even if its value contains no marker; the ordinary `#access_token` control independently requires fragment evidence in request events, frame events, frame-tree replies and resource-tree replies. The ordinary session must survive. The unguarded ordinary redirect control preserves all four headers in `redirectResponse`, ExtraInfo’s headers and `headersText`, and Fetch’s response headers. `C2.redirect-secret-mix` repeats that matrix with 301/303/307/308. The protected leg requires in-place ExtraInfo delivery with origin-only header values, not merely the absence of a marker.
+`C2.redirect-secret` probes ordinary fixture 302s to seven’s `/auth/callback?code=…&state=…` and vault’s `/oauth/mcp-callback?code=…`, plus `#access_token=…` variants of both. It navigates with Page and scripted `location.href`, fetches a subresource and sends an XHR. The 302 carries `Location`, `Content-Location`, `Refresh: 0;url=…` and `Link: <…>; rel=preconnect`. Page, Network (including ExtraInfo), Runtime, Log, Audits and both Fetch stages are enabled. Every received raw message is scanned, including replies but not the probe’s own observer session traffic, across an eight-second tail, for raw, percent-encoded, JSON-escaped and base64 marker representations. Both response-body APIs are attempted on each hop; guarded bodies need matched refusals. `Network.getResponseBody` is attempted, once per id, with every network id the client learns for a 301–308 hop: the `requestId` of a Network event carrying the redirect status and the `networkId` of the Fetch response-stage pause. For each registered hop whose id the client learned neither way, the probe reads the hop’s real id from the harness’s own unguarded tap (the observer session, which enables Network on the guarded leg) and attempts the read on the guarded session with it. The evidence’s `networkBodyCarriers` counts the ids per carrier, and `networkBodyPath` names the weakest carrier any id needed: `withheld+tap`, then `fetch-networkId`, then `network`, or `none` without any id. These reads never hold up a Fetch pause, and the probe gives them five seconds after `Fetch.disable` to settle. A read still unanswered then is not a refusal. `networkBodyAttempted` and `networkBodyRefused` hold only when every attempt is refused. On the guarded leg a `fetch-networkId` or `withheld+tap` carrier also needs the same row’s unguarded control to have seen the redirect’s Network events. Without that proof, or with no id at all, both read `incomplete` and the probe returns `redirect-secret: network body leg <reason>`; an attempt that is not refused is measured and fails. Every `Network.requestWillBeSent` the client sees for a registered redirect URL must end within the step in a redirect `requestWillBeSent`, `loadingFinished` or `loadingFailed` for that `requestId`. The evidence’s `hops` records per `requestId` the `delivery` (`redacted` for an origin-only protected redirect in place, `withheld` for a terminal without the redirect, `ordinary`, `raw` or `unterminated`) and the `terminal` event method. `requestsTerminated` is false on any `unterminated` request, a measured guard failure rather than missing evidence; `hopsRedacted` is false on any `raw` or `ordinary` hop, so a delivered protected hop must be origin-only, never the raw or a substituted URL; the guarded leg expects it. Page frame trees, resource trees and navigation history are read before recovery to catch error-page leftovers. A separate structural check requires every protected `Network.Request.urlFragment` and `Page.Frame.urlFragment` to be empty or absent, even if its value contains no marker; the ordinary `#access_token` control independently requires fragment evidence in request events, frame events, frame-tree replies and resource-tree replies. The ordinary session must survive. The unguarded ordinary redirect control preserves all four headers in `redirectResponse`, ExtraInfo’s headers and `headersText`, and Fetch’s response headers. `C2.redirect-secret-mix` repeats that matrix with 301/303/307/308. The protected leg requires in-place ExtraInfo delivery with origin-only header values, not merely the absence of a marker.
 
-`C2.redirect-body` calls `Network.loadNetworkResource` on an ordinary redirect with `includeCredentials: true`, reads any stream with `IO.read`, replays a redirected XHR, requests Page resource content, and captures Page/MHTML and DOM snapshots after a main-frame redirect. It also captures an ordinary parent containing an iframe redirected to vault, including its error document, and overrides a paused ordinary Fetch request to the allowed redirect URL. No protected marker may appear in any message or body, and no request from those operations may send the independently seeded seven cookie. The ordinary control must return the body, resource content and snapshots, and accept the URL override. Each probe cleans up its redirect registrations, observer session and cookie. The focused Chrome tests use HTTPS with SPKI-pinned fixture trust and default-port protected URLs; host resolver rules route seven and vault to the fixture rather than the public service.
+`C2.redirect-body` calls `Network.loadNetworkResource` on an ordinary redirect with `includeCredentials: true`, reads any stream with `IO.read`, replays a redirected XHR, requests Page resource content, and captures Page/MHTML and DOM snapshots after a main-frame redirect. It also captures an ordinary parent containing an iframe redirected to vault, including its error document, and overrides a paused ordinary Fetch request to the allowed redirect URL. No protected marker may appear in any message or body, and no request from those operations may send the independently seeded seven cookie. The ordinary control must return the body, resource content and snapshots, and accept the URL override. Its network-body carrier, `networkBodyAttempted`, `networkBodyRefused`, `hops`, `requestsTerminated` and `hopsRedacted` follow `C2.redirect-secret`. Each probe cleans up its redirect registrations, observer session and cookie. The focused Chrome tests use HTTPS with SPKI-pinned fixture trust and default-port protected URLs; host resolver rules route seven and vault to the fixture rather than the public service.
 
 `C8.unparseable` probes both raw and canonical space/U+200D/invalid-punycode URLs through creation and navigation. Every guarded destination needs a matched refusal. Its unguarded controls record `document` or `native-rejection` outcomes, including Chrome builds that reject raw U+200D instead of committing it. Both raw and encoded-space forms must commit real fixture documents, because that is the proven cookie leak. An independent observer loads the encoded-space document and confirms it shares a uniquely seeded `.sliccy.ai` cookie; the guarded client must neither list nor attach to it, read its cookie, query that cookie by URL, nor cause a cookie-bearing destination request. The guard does not erase the observer’s private browser state. The row runs on both browser-session and page-session-only transports, uses the default context, and cleans up its own targets and cookie. Cookie seeding always uses the unguarded observer’s browser session, never the guarded client. Only guarded browser-session target listing requires `browserSession`; without it, `listed` records `not-supported` explicitly in probe and observation evidence, and the result lists that field in `notSupported`. Creation, navigation, attachment and `Network.getCookies` with `urls` still require matched refusals; filtering cookies without refusing fails `cookieRefused`. Fixture URLs omit the colon when the port is empty, and reported URLs are compared after canonicalisation, including Chrome’s WHATWG-unparseable encoded-space hosts. Launchers must resolve the raw/canonical space, U+200D/punycode and invalid-punycode `.sliccy.ai` fixture hosts to the fixture server, including for default-port HTTP or HTTPS origins. The HTTP fixture accepts Chrome’s encoded-space Host header without reparsing it as a WHATWG origin.
 

package/guard-runner.mjs

@@ -703,6 +703,7 @@ class Execution {
             fixture: this.options.fixture,
             mode: step.redirectSecret,
             side: this.side,
+            controls: (this.clients.redirectSecretControls ??= {}),
           })
         );
       } finally {

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.14.3",
+  "setVersion": "1.14.4",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -309,6 +309,42 @@
             "equals": true,
             "observer": "client"
           }
+        },
+        "requestsTerminated": {
+          "means": "redirect secret: every seen redirect request ends, no unterminated request",
+          "check": {
+            "result": "redirect",
+            "path": "result.requestsTerminated",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "hopsRedacted": {
+          "means": "redirect secret: every protected hop is origin-only, never the raw URL",
+          "check": {
+            "result": "redirect",
+            "path": "result.hopsRedacted",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "networkBodyAttempted": {
+          "means": "redirect secret: networkBodyAttempted",
+          "check": {
+            "result": "redirect",
+            "path": "result.networkBodyAttempted",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "networkBodyRefused": {
+          "means": "redirect secret: networkBodyRefused",
+          "check": {
+            "result": "redirect",
+            "path": "result.networkBodyRefused",
+            "equals": true,
+            "observer": "client"
+          }
         }
       },
       "live": "the fixture served the registered ordinary redirect",
@@ -337,7 +373,9 @@
           "resourceContentAttempted": true,
           "snapshotAttempted": true,
           "domSnapshotAttempted": true,
-          "overridesWorked": true
+          "overridesWorked": true,
+          "requestsTerminated": true,
+          "networkBodyAttempted": true
         }
       },
       "expected": {
@@ -352,7 +390,11 @@
         "snapshotAttempted": true,
         "domSnapshotAttempted": true,
         "overridesRefused": true,
-        "iframeSnapshotAttempted": true
+        "iframeSnapshotAttempted": true,
+        "requestsTerminated": true,
+        "hopsRedacted": true,
+        "networkBodyAttempted": true,
+        "networkBodyRefused": true
       }
     },
     {
@@ -518,6 +560,24 @@
             "equals": true,
             "observer": "client"
           }
+        },
+        "requestsTerminated": {
+          "means": "redirect secret: every seen redirect request ends, no unterminated request",
+          "check": {
+            "result": "redirect",
+            "path": "result.requestsTerminated",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "hopsRedacted": {
+          "means": "redirect secret: every protected hop is origin-only, never the raw URL",
+          "check": {
+            "result": "redirect",
+            "path": "result.hopsRedacted",
+            "equals": true,
+            "observer": "client"
+          }
         }
       },
       "live": "the fixture served the registered ordinary redirect",
@@ -543,7 +603,8 @@
           "networkFragmentVisible": true,
           "frameFragmentVisible": true,
           "frameTreeFragmentVisible": true,
-          "resourceTreeFragmentVisible": true
+          "resourceTreeFragmentVisible": true,
+          "requestsTerminated": true
         }
       },
       "expected": {
@@ -556,7 +617,9 @@
         "fetchBodyRefused": true,
         "networkBodyRefused": true,
         "extraLocation": true,
-        "fragmentsHidden": true
+        "fragmentsHidden": true,
+        "requestsTerminated": true,
+        "hopsRedacted": true
       }
     },
     {
@@ -722,6 +785,24 @@
             "equals": true,
             "observer": "client"
           }
+        },
+        "requestsTerminated": {
+          "means": "redirect secret: every seen redirect request ends, no unterminated request",
+          "check": {
+            "result": "redirect",
+            "path": "result.requestsTerminated",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "hopsRedacted": {
+          "means": "redirect secret: every protected hop is origin-only, never the raw URL",
+          "check": {
+            "result": "redirect",
+            "path": "result.hopsRedacted",
+            "equals": true,
+            "observer": "client"
+          }
         }
       },
       "live": "the fixture served the registered ordinary redirect",
@@ -747,7 +828,8 @@
           "networkFragmentVisible": true,
           "frameFragmentVisible": true,
           "frameTreeFragmentVisible": true,
-          "resourceTreeFragmentVisible": true
+          "resourceTreeFragmentVisible": true,
+          "requestsTerminated": true
         }
       },
       "expected": {
@@ -760,7 +842,9 @@
         "fetchBodyRefused": true,
         "networkBodyRefused": true,
         "extraLocation": true,
-        "fragmentsHidden": true
+        "fragmentsHidden": true,
+        "requestsTerminated": true,
+        "hopsRedacted": true
       }
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.14.3",
+  "version": "1.14.4",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -66,7 +66,7 @@
     "validate": "node scripts/validate.mjs",
     "lint": "slicc-lint && test -z \"$(gofmt -l .)\" && go mod tidy -diff && go vet ./... && golangci-lint run && cargo fmt --check && cargo clippy --all-features --all-targets -- -D warnings",
     "format": "biome check --write . && gofmt -w . && cargo fmt",
-    "test": "npm run validate && node --test test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/git-retry.test.mjs test/integration/dist-tag.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-stall.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
+    "test": "npm run validate && node --test test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/git-retry.test.mjs test/integration/guard-redirect-carrier.test.mjs test/integration/dist-tag.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-stall.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
     "test:unit": "go test -race -cover ./...",
     "build": "go build ./... && cargo build --all-features && cargo build --target wasm32-wasip1 --all-features && npm pack --dry-run",
     "trust": "npx fledgling sync -y --skip-publish",

package/redirect-secret.mjs

@@ -89,6 +89,7 @@ class RedirectProbe {
     this.attempts = [];
     this.jobs = new Set();
     this.networkBodies = new Set();
+    this.learned = { network: new Set(), fetch: new Set(), tap: new Set() };
     this.registrations = [];
     this.seen = new Map();
     this.protectedURLs = [
@@ -97,6 +98,7 @@ class RedirectProbe {
       `https://seven.sliccy.ai/auth/callback#access_token=${encodeURIComponent(this.marker)}&state=${encodeURIComponent(this.marker)}`,
       `https://vault.sliccy.ai/oauth/mcp-callback#access_token=${encodeURIComponent(this.marker)}`,
     ];
+    this.prefix = new URL(`${this.ordinary}/redirect-secret/${this.tag}-`).href;
     this.plainURL = `${this.ordinary}/redirect-secret-body/${this.tag}-plain?code=${encodeURIComponent(this.marker)}`;
     this.destinations =
       this.side === 'control'
@@ -119,6 +121,7 @@ class RedirectProbe {
     if (redirects.includes(event.params.responseStatusCode)) {
       const out = await this.send('Fetch.getResponseBody', { requestId: event.params.requestId });
       this.attempts.push({ method: 'Fetch.getResponseBody', ...out });
+      if (event.params.networkId) this.track(this.networkBody(event.params.networkId, 'fetch'));
     }
     if (
       this.holdURL &&
@@ -139,19 +142,130 @@ class RedirectProbe {
         if (event.method === 'Fetch.requestPaused') this.track(this.fetchPause(event));
         const response = event.params?.redirectResponse ?? event.params?.response;
         if (!response || !redirects.includes(response.status)) continue;
-        const requestId = event.params.requestId;
-        if (this.networkBodies.has(requestId)) continue;
-        this.networkBodies.add(requestId);
-        this.track(
-          this.send('Network.getResponseBody', { requestId }).then((out) => {
-            this.attempts.push({ method: 'Network.getResponseBody', ...out });
-          })
-        );
+        this.track(this.networkBody(event.params.requestId, 'network'));
       }
       await pause(5);
     }
   }
 
+  async networkBody(requestId, source) {
+    this.learned[source].add(requestId);
+    if (this.networkBodies.has(requestId)) return;
+    this.networkBodies.add(requestId);
+    const entry = { method: 'Network.getResponseBody', source, pending: true };
+    this.attempts.push(entry);
+    const out = await this.send('Network.getResponseBody', { requestId });
+    delete entry.pending;
+    Object.assign(entry, out);
+  }
+
+  async settle() {
+    for (let i = 0; i < 500 && this.jobs.size; i++) await pause(10);
+  }
+
+  tap() {
+    for (const event of this.reader.events ?? []) {
+      if (event.sessionId !== this.observer) continue;
+      const response = event.params?.redirectResponse ?? event.params?.response;
+      if (response?.url?.startsWith(this.prefix) && redirects.includes(response.status))
+        this.track(this.networkBody(event.params.requestId, 'tap'));
+    }
+  }
+
+  networkLeg() {
+    const carriers = [...this.networkBodies].map((id) =>
+      this.learned.network.has(id)
+        ? 'network'
+        : this.learned.fetch.has(id)
+          ? 'fetch-networkId'
+          : 'withheld+tap'
+    );
+    const path =
+      ['withheld+tap', 'fetch-networkId', 'network'].find((carrier) =>
+        carriers.includes(carrier)
+      ) ?? 'none';
+    const networkBodyCarriers = Object.fromEntries(
+      [...new Set(carriers)].map((carrier) => [
+        carrier,
+        carriers.filter((entry) => entry === carrier).length,
+      ])
+    );
+    const attempts = this.attempts.filter((entry) => entry.method === 'Network.getResponseBody');
+    const refusedAll = attempts.length > 0 && attempts.every(refused);
+    const proven = path === 'network' || this.side !== 'guarded' || this.controls?.networkEvents;
+    const reason =
+      path === 'none'
+        ? 'no network id for the redirect'
+        : proven
+          ? undefined
+          : 'control did not prove the redirect Network events';
+    if (reason && (!attempts.length || refusedAll))
+      return {
+        networkBodyPath: path,
+        networkBodyCarriers,
+        networkBodyAttempted: 'incomplete',
+        networkBodyRefused: 'incomplete',
+        incomplete: `redirect-secret: network body leg ${reason}`,
+      };
+    return {
+      networkBodyPath: path,
+      networkBodyCarriers,
+      networkBodyAttempted: attempts.length > 0,
+      networkBodyRefused: refusedAll,
+    };
+  }
+
+  hops(events) {
+    const own = events.filter((event) => event.sessionId === this.session);
+    const seen = new Set(
+      own
+        .filter(
+          (event) =>
+            event.method === 'Network.requestWillBeSent' &&
+            !event.params.redirectResponse &&
+            event.params.request?.url?.startsWith(this.prefix)
+        )
+        .map((event) => event.params.requestId)
+    );
+    const protectedOrigins = this.protectedURLs.map((url) => new URL(url).origin);
+    const hops = Object.fromEntries(
+      [...seen].map((requestId) => {
+        const mine = own.filter((event) => event.params?.requestId === requestId);
+        const hop = mine.find(
+          (event) =>
+            event.method === 'Network.requestWillBeSent' &&
+            event.params.redirectResponse?.url?.startsWith(this.prefix)
+        );
+        const end = mine.find((event) =>
+          ['Network.loadingFinished', 'Network.loadingFailed'].includes(event.method)
+        );
+        const url = hop?.params.request?.url ?? '';
+        const origin = protectedOrigins.find((value) => url.startsWith(value));
+        return [
+          requestId,
+          {
+            delivery: !hop
+              ? end
+                ? 'withheld'
+                : 'unterminated'
+              : !origin
+                ? 'ordinary'
+                : [origin, `${origin}/`].includes(url)
+                  ? 'redacted'
+                  : 'raw',
+            terminal: (hop ?? end)?.method ?? null,
+          },
+        ];
+      })
+    );
+    const deliveries = Object.values(hops).map((entry) => entry.delivery);
+    return {
+      hops,
+      requestsTerminated: !deliveries.includes('unterminated'),
+      hopsRedacted: !deliveries.some((delivery) => ['raw', 'ordinary'].includes(delivery)),
+    };
+  }
+
   async register(key, to, code = 302) {
     const url = `${this.ordinary}/redirect-secret/${this.tag}-${key}`;
     const path = new URL(url).pathname;
@@ -186,6 +300,7 @@ class RedirectProbe {
     ).sessionId;
     this.watching = this.watch();
     await this.reader.send('Page.enable', {}, this.observer);
+    if (this.side === 'guarded') await this.reader.send('Network.enable', {}, this.observer);
     await this.reader.send('Storage.setCookies', {
       cookies: [
         {
@@ -361,14 +476,23 @@ class RedirectProbe {
 
   async evidence() {
     await pause(8000);
+    this.tap();
+    if (this.side === 'control' && this.controls)
+      this.controls.networkEvents = this.learned.network.size > 0;
     await this.send('Fetch.disable');
     await this.reset('survive');
     const survives = await this.send('Runtime.evaluate', {
       expression: 'document.title',
       returnByValue: true,
     });
-    const events = this.client.events.slice(this.eventsStart);
-    const messages = this.client.messages?.slice(this.messagesStart) ?? [];
+    await this.settle();
+    const tapped = `"sessionId":"${this.observer}"`;
+    const events = this.client.events
+      .slice(this.eventsStart)
+      .filter((event) => event.sessionId !== this.observer);
+    const messages = (this.client.messages?.slice(this.messagesStart) ?? []).filter(
+      (message) => !message.includes(tapped)
+    );
     const eventLeaks = await this.scan(events);
     const ordinaryEvents = events.filter(
       (event, index) =>
@@ -394,10 +518,7 @@ class RedirectProbe {
         );
       });
     const found = (key) => this.responses.some((entry) => entry[key]);
-    const attempted = (method) => this.attempts.some((entry) => entry.method === method);
-    const bodyRefused = (method) =>
-      this.attempts.filter((entry) => entry.method === method).length > 0 &&
-      this.attempts.filter((entry) => entry.method === method).every(refused);
+    const fetchAttempts = this.attempts.filter((entry) => entry.method === 'Fetch.getResponseBody');
     return {
       live: (await this.fixture.log()).some((entry) =>
         entry.url.includes(`/redirect-secret/${this.tag}`)
@@ -412,10 +533,10 @@ class RedirectProbe {
         ),
       secretHidden: !replyLeaks.includes(true),
       sessionSurvives: survives.ok && survives.result?.result?.value === 'doc',
-      fetchBodyAttempted: attempted('Fetch.getResponseBody'),
-      networkBodyAttempted: attempted('Network.getResponseBody'),
-      fetchBodyRefused: bodyRefused('Fetch.getResponseBody'),
-      networkBodyRefused: bodyRefused('Network.getResponseBody'),
+      fetchBodyAttempted: fetchAttempts.length > 0,
+      fetchBodyRefused: fetchAttempts.length > 0 && fetchAttempts.every(refused),
+      ...this.networkLeg(),
+      ...this.hops(events),
       extraInPlace,
       ...redirectFragments({
         messages,
@@ -476,7 +597,7 @@ class RedirectProbe {
   async close() {
     this.stopped = true;
     await this.watching;
-    await Promise.allSettled([...this.jobs]);
+    await this.settle();
     await outcome(this.client.send('Fetch.disable', {}, this.session));
     if (this.observer) {
       await outcome(