@ai-ecoverse/slicc-browsers 1.14.5 → 1.14.7

package/README.md

@@ -309,9 +309,10 @@ It exports:
 - `waitFor(check, ms, step?)`: polls `check` every `step` ms (default 25) until it holds, checking once more after the bound. A timer heartbeat every `step` runs for the whole wait, including while `check` is awaiting a reply, and any gap between beats longer than a second (or four steps, if longer) extends the bound by that gap, so a synchronous event-loop stall elsewhere in the process does not consume it. The extensions add up to at most `max(4 × ms, 30000)` ms, so a throttled page cannot stretch a wait without limit. `load`, the runner's waits and the error-page and redirect-body probes use it;
 - `judge(vector, side, observed)`: `{ pass, refused, skipped, mismatches }`, where `refused` lists the leg's refusals and `skipped` the observations that depend on them or explicitly record unavailable observation capabilities;
 - `result(vector, run)`: a report row from `{ target, variant, transport, via?, capabilities?, control, guarded, live }`. `capabilities` is the transport's; without it, the transport has them all;
+- `knownOrigins` and `originDefaults`: the origin names a runner can miss, and the origins `plain`, `cross`, `log` and `own` fall back to when unset;
 - `parseURL(value, base?)`: a `URL`, or `null` for anything `new URL` rejects or a non-string; every parse of a fixture log entry or a Chrome-reported URL in the runner and the fixture goes through it (`protected.mjs` keeps its own copy, since it imports nothing), so an unparseable entry never throws;
 - `owned(entries, tag)`: the fixture log entries whose raw URL contains `tag`, the row's attribution through its `n=`, `tag=` or `to=` query;
-- `summary({ guard, sha, set, results })`: `set` is the parsed `guard-vectors.json`. It returns `{ set, schemaVersion, guard, sha, variants, targets, transports, results, skipped, notRun, missing, pass, line }`. `missing` lists each `{ id, target, variant, transport }` without a row, for every vector whose `scope` is `any` or the guard, every target it lists, every variant in `variants` or `results`, and every transport in `results`; `pass` needs it empty, where `line` is `GUARD-PASS <guard>@<sha> (vectors @ai-ecoverse/slicc-browsers@X.Y.Z)` or `GUARD-FAIL …`.
+- `summary({ guard, sha, set, results })`: `set` is the parsed `guard-vectors.json`. It returns `{ set, schemaVersion, guard, sha, variants, targets, transports, results, skipped, notRun, missing, forged, pass, line }`. `missing` lists each `{ id, target, variant, transport }` without a row, for every vector whose `scope` is `any` or the guard, every target it lists, every variant in `variants` or `results`, and every transport in `results`; `pass` needs it empty, where `line` is `GUARD-PASS <guard>@<sha> (vectors @ai-ecoverse/slicc-browsers@X.Y.Z)` or `GUARD-FAIL …`. `forged` lists each `{ id, target, variant, transport, why }` that is `not-run` on a vector that isn't `kind: "text"`, or `skip` without a reason the runner gives (`not-applicable`, `not-applicable:no-<origin>-origin` for an origin in `knownOrigins` that the row's target or vector names, directly or through `originDefaults`, the vector's own `skip.reason` on its target, or `not-supported:<capability>` for a capability the set requires, `browserSession` or `unguarded-observer`); `pass` needs it empty too, and `line` then ends in `forged <n>`.
 
 **`npm run validate`** checks that:
 - the file matches the schema, and ids are unique;

package/guard-driver.mjs

@@ -1,5 +1,25 @@
 const q = JSON.stringify;
 
+export const originDefaults = {
+  plain: 'ordinary',
+  cross: 'client',
+  log: 'ordinary',
+  own: 'client',
+};
+export const knownOrigins = [
+  'ordinary',
+  'ordinary-same-site',
+  'seven',
+  'vault',
+  'vault-x',
+  'apex',
+  'own',
+  'client',
+  'plain',
+  'cross',
+  'log',
+];
+
 export const beacon = (log, tag) =>
   `try { const u = ${q(log)} + '/beacon?tag=' + ${q(tag)} + '&origin=' + encodeURIComponent(location.origin); if (!navigator.sendBeacon(u)) fetch(u, { keepalive: true, mode: 'no-cors' }).catch(() => {}); } catch {}`;
 
@@ -276,6 +296,56 @@ const passed = (r) =>
   [r.control, r.guarded, r.live].every((s) => s === 'skip') ||
   [r.control, r.guarded, r.live].every((s) => s === 'not-run');
 
+const capabilities = (value) =>
+  Array.isArray(value)
+    ? value.flatMap(capabilities)
+    : value && typeof value === 'object'
+      ? Object.entries(value).flatMap(([key, item]) =>
+          key === 'requires' && Array.isArray(item) ? item : capabilities(item)
+        )
+      : [];
+
+function originReason(vector, row, reason) {
+  const origin = /^not-applicable:no-(.+)-origin$/.exec(reason)?.[1];
+  if (!knownOrigins.includes(origin)) return false;
+  return [
+    ...q([`{${row.target}}`, '{plain}', vector ?? null]).matchAll(/\{([A-Za-z][A-Za-z-]*)\}/g),
+  ]
+    .map((match) => (match[1] === 'beacon' || match[1] === 'probe' ? 'log' : match[1]))
+    .some((name) => name === origin || originDefaults[name] === origin);
+}
+
+function skipWhy(vector, row, known) {
+  const { reason } = row;
+  if (typeof reason !== 'string' || reason === '') return 'skip without a reason';
+  if (reason === 'not-applicable' || originReason(vector, row, reason)) return null;
+  if (vector?.skip?.target === row.target && vector.skip.reason === reason) return null;
+  if (reason.startsWith('not-supported:') && known.has(reason.slice('not-supported:'.length)))
+    return null;
+  return `skip with a reason the runner never gives: ${reason}`;
+}
+
+function forgeries(set, results) {
+  const vectors = new Map(set.vectors.map((v) => [v.id, v]));
+  const known = new Set([
+    'browserSession',
+    'unguarded-observer',
+    ...capabilities(set.vectors).filter((c) => typeof c === 'string' && c !== ''),
+  ]);
+  return results.flatMap((row) => {
+    const legs = [row.control, row.guarded, row.live];
+    const vector = vectors.get(row.id);
+    const why = [];
+    if (legs.includes('not-run') && vector?.kind !== 'text')
+      why.push('not-run on a vector that is not kind text');
+    if (legs.includes('skip')) why.push(skipWhy(vector, row, known));
+    const found = why.filter(Boolean);
+    if (!found.length) return [];
+    const { id, target, variant, transport } = row;
+    return [{ id, target, variant, transport, why: found.join('; ') }];
+  });
+}
+
 export function summary({ guard, sha, set, results }) {
   const uniq = (k) => [...new Set(results.map((r) => r[k]))].sort();
   const variants = [...new Set([...Object.keys(set.variants ?? {}), ...uniq('variant')])].sort();
@@ -286,7 +356,9 @@ export function summary({ guard, sha, set, results }) {
     .flatMap((row) => variants.map((variant) => ({ ...row, variant })))
     .flatMap((row) => uniq('transport').map((transport) => ({ ...row, transport })))
     .filter((r) => !has.has(q([r.id, r.target, r.variant, r.transport])));
-  const pass = results.length > 0 && missing.length === 0 && results.every(passed);
+  const forged = forgeries(set, results);
+  const pass =
+    results.length > 0 && missing.length === 0 && forged.length === 0 && results.every(passed);
   const name = `@ai-ecoverse/slicc-browsers@${set.setVersion}`;
   return {
     set: name,
@@ -302,8 +374,9 @@ export function summary({ guard, sha, set, results }) {
       .map(({ id, target, reason }) => ({ id, target, reason })),
     notRun: [...new Set(results.filter((r) => r.control === 'not-run').map((r) => r.id))],
     missing,
+    forged,
     pass,
-    line: `${pass ? 'GUARD-PASS' : 'GUARD-FAIL'} ${guard}@${sha} (vectors ${name})`,
+    line: `${pass ? 'GUARD-PASS' : 'GUARD-FAIL'} ${guard}@${sha} (vectors ${name})${forged.length ? ` forged ${forged.length}` : ''}`,
   };
 }
 

package/guard-runner.mjs

@@ -9,7 +9,9 @@ import {
   expand,
   hop,
   isRefusal,
+  knownOrigins,
   loadedAfter,
+  originDefaults,
   outcome,
   owned,
   parseURL,
@@ -1302,21 +1304,6 @@ const browserContextStep = (vector, capabilities) =>
         supported(['browserContexts'], capabilities))
   );
 
-const originDefaults = { plain: 'ordinary', cross: 'client', log: 'ordinary', own: 'client' };
-const knownOrigins = [
-  'ordinary',
-  'ordinary-same-site',
-  'seven',
-  'vault',
-  'vault-x',
-  'apex',
-  'own',
-  'client',
-  'plain',
-  'cross',
-  'log',
-];
-
 function nullOrigins(value, targets) {
   return [...q(value).matchAll(/\{([A-Za-z][A-Za-z-]*)\}/g)]
     .map((match) => (match[1] === 'beacon' || match[1] === 'probe' ? 'log' : match[1]))

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.14.5",
+  "setVersion": "1.14.7",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.14.5",
+  "version": "1.14.7",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -66,7 +66,7 @@
     "validate": "node scripts/validate.mjs",
     "lint": "slicc-lint && test -z \"$(gofmt -l .)\" && go mod tidy -diff && go vet ./... && golangci-lint run && cargo fmt --check && cargo clippy --all-features --all-targets -- -D warnings",
     "format": "biome check --write . && gofmt -w . && cargo fmt",
-    "test": "npm run validate && node --test test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/git-retry.test.mjs test/integration/guard-redirect-carrier.test.mjs test/integration/dist-tag.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-stall.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
+    "test": "npm run validate && node --test test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/git-retry.test.mjs test/integration/guard-redirect-carrier.test.mjs test/integration/dist-tag.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-stall.test.mjs test/integration/guard-forged.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
     "test:unit": "go test -race -cover ./...",
     "build": "go build ./... && cargo build --all-features && cargo build --target wasm32-wasip1 --all-features && npm pack --dry-run",
     "trust": "npx fledgling sync -y --skip-publish",
@@ -81,7 +81,7 @@
     "test:unit:guard": "mkdir -p coverage/unit && node --experimental-vm-modules --no-warnings --experimental-test-coverage --test --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-include=fixture-client.mjs --test-coverage-include=observer-target.mjs --test-coverage-include=protected-error-page.mjs --test-coverage-include=unparseable-url.mjs --test-coverage-include=scripts/browser-runner.mjs --test-coverage-include=scripts/validate.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/guard.lcov test/unit/guard-*.test.mjs && slicc-diff-cover coverage/unit/guard.lcov"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-shared-web": "2.3.6",
+    "@ai-ecoverse/slicc-shared-web": "2.4.0",
     "@biomejs/biome": "2.5.15",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",