@ai-ecoverse/slicc-browsers 1.14.7 → 1.14.9

package/README.md

@@ -282,7 +282,7 @@ For remote/page harnesses, `fixtureClient(base)` is exported by `./guard-runner`
 
 **Design-dependent outcomes.** A key listed in `designDependent` may expect `"either"`, which `true` and `false` both match: a guard that refuses a setup step lets the real document load, and one that blocks before commit doesn't. `detached` is design-dependent on the rows whose guarded leg proves the block (the pre-action beacon plus an exact-URL block or the history form): its `eitherWhen` holds the same proof, so a guard that blocks without detaching passes, and one that neither blocks nor detaches still fails. The hard negatives stay required.
 
-**Observability.** `observable.own: false` marks a vector the guard host's own origin can't show (headers, auth, redirects); a runner whose `own` is a static server reports it as `skip` with `not-observable`.
+**Observability.** `observable.own: false` marks a vector the guard host's own origin can't show (headers, auth, redirects); a runner reports it as `skip` with `not-applicable` on that target.
 
 **Applies to.** `appliesTo` lists the triggers a vector runs with (`href`, `iframe`, `popup`, `redirect`). Chrome doesn't apply some session overrides inside a cross-site iframe, so `E6.locale`, `E6.timezone`, `E6.network-state` and `E6.blocked-urls` have no `.iframe` row.
 
@@ -309,10 +309,11 @@ It exports:
 - `waitFor(check, ms, step?)`: polls `check` every `step` ms (default 25) until it holds, checking once more after the bound. A timer heartbeat every `step` runs for the whole wait, including while `check` is awaiting a reply, and any gap between beats longer than a second (or four steps, if longer) extends the bound by that gap, so a synchronous event-loop stall elsewhere in the process does not consume it. The extensions add up to at most `max(4 × ms, 30000)` ms, so a throttled page cannot stretch a wait without limit. `load`, the runner's waits and the error-page and redirect-body probes use it;
 - `judge(vector, side, observed)`: `{ pass, refused, skipped, mismatches }`, where `refused` lists the leg's refusals and `skipped` the observations that depend on them or explicitly record unavailable observation capabilities;
 - `result(vector, run)`: a report row from `{ target, variant, transport, via?, capabilities?, control, guarded, live }`. `capabilities` is the transport's; without it, the transport has them all;
+- `inapplicable(vector, target, scope)`: whether the row is `not-applicable`: the vector's `skip.target` is `target`, its `observable[target]` is `false`, or its `scope` is neither `any` nor `scope`;
 - `knownOrigins` and `originDefaults`: the origin names a runner can miss, and the origins `plain`, `cross`, `log` and `own` fall back to when unset;
 - `parseURL(value, base?)`: a `URL`, or `null` for anything `new URL` rejects or a non-string; every parse of a fixture log entry or a Chrome-reported URL in the runner and the fixture goes through it (`protected.mjs` keeps its own copy, since it imports nothing), so an unparseable entry never throws;
 - `owned(entries, tag)`: the fixture log entries whose raw URL contains `tag`, the row's attribution through its `n=`, `tag=` or `to=` query;
-- `summary({ guard, sha, set, results })`: `set` is the parsed `guard-vectors.json`. It returns `{ set, schemaVersion, guard, sha, variants, targets, transports, results, skipped, notRun, missing, forged, pass, line }`. `missing` lists each `{ id, target, variant, transport }` without a row, for every vector whose `scope` is `any` or the guard, every target it lists, every variant in `variants` or `results`, and every transport in `results`; `pass` needs it empty, where `line` is `GUARD-PASS <guard>@<sha> (vectors @ai-ecoverse/slicc-browsers@X.Y.Z)` or `GUARD-FAIL …`. `forged` lists each `{ id, target, variant, transport, why }` that is `not-run` on a vector that isn't `kind: "text"`, or `skip` without a reason the runner gives (`not-applicable`, `not-applicable:no-<origin>-origin` for an origin in `knownOrigins` that the row's target or vector names, directly or through `originDefaults`, the vector's own `skip.reason` on its target, or `not-supported:<capability>` for a capability the set requires, `browserSession` or `unguarded-observer`); `pass` needs it empty too, and `line` then ends in `forged <n>`.
+- `summary({ guard, sha, set, results })`: `set` is the parsed `guard-vectors.json`. It returns `{ set, schemaVersion, guard, sha, variants, targets, transports, results, skipped, notRun, missing, forged, pass, line }`. `missing` lists each `{ id, target, variant, transport }` without a row, for every vector whose `scope` is `any` or the guard, every target it lists, every variant in `variants` or `results`, and every transport in `results`; `pass` needs it empty, where `line` is `GUARD-PASS <guard>@<sha> (vectors @ai-ecoverse/slicc-browsers@X.Y.Z)` or `GUARD-FAIL …`. `forged` lists each `{ id, target, variant, transport, why }` that is `not-run` on a vector that isn't `kind: "text"`, or `skip` without a reason the runner gives (`not-applicable` when the vector's `skip.target` is the row's target, its `observable` is `false` for that target, or its `scope` is neither `any` nor the guard, the same `inapplicable(vector, target, scope)` the runner uses; `not-applicable:no-<origin>-origin` for an origin in `knownOrigins` that the row's target, `plain`, the control's origin, the steps or a check names, directly or through `originDefaults`, where only the first branch of an `any` counts, the vector's own `skip.reason` on its target, or `not-supported:<capability>` for a capability the set requires, `browserSession` or `unguarded-observer`); `pass` needs it empty too, and `line` then ends in `forged <n>`.
 
 **`npm run validate`** checks that:
 - the file matches the schema, and ids are unique;
@@ -361,7 +362,7 @@ otherwise they run serially. `capabilities` is an object of booleans or an array
 of supported names, and a capability that isn't declared is unsupported: a CDP
 transport over a DevTools port declares `chromeUrlsAttach: true`, and an
 extension on `chrome.debugger` leaves it out, so `C8.newtab` is skipped with
-`not-supported:chromeUrlsAttach`. `capabilities.scope` selects owner-specific rows.
+`not-supported:chromeUrlsAttach`. `capabilities.scope` selects owner-specific rows; pass the same name as `guard` to `summary()`.
 
 Map `ordinary`, `ordinary-same-site`, `seven`, `vault`, `vault-x`, `apex`, `own`
 and `client` to origins. `chrome-newtab`, `chrome-new-tab-page`, `chrome-settings`, `chrome-passwords`, `chrome-search`, `network-error`, `chrome-extension-page` and `file-root` default to their `url`.

package/guard-driver.mjs

@@ -305,27 +305,55 @@ const capabilities = (value) =>
         )
       : [];
 
+const originNames = (value) =>
+  [...q(value ?? null).matchAll(/\{([A-Za-z][A-Za-z-]*)\}/g)]
+    .map((match) => (match[1] === 'beacon' || match[1] === 'probe' ? 'log' : match[1]))
+    .flatMap((name) => [name, originDefaults[name]]);
+
+const checkOrigins = (check) => {
+  if (!check || typeof check !== 'object') return [];
+  if (check.any) return checkOrigins(check.any[0]);
+  if (check.all || check.not) return (check.all ?? [check.not]).flatMap(checkOrigins);
+  return originNames(check);
+};
+
 function originReason(vector, row, reason) {
   const origin = /^not-applicable:no-(.+)-origin$/.exec(reason)?.[1];
   if (!knownOrigins.includes(origin)) return false;
+  const fixed = [
+    row.target,
+    '{plain}',
+    vector?.control?.origin,
+    vector?.setup,
+    vector?.trigger,
+  ].map((value) => (typeof value === 'string' && !value.startsWith('{') ? `{${value}}` : value));
   return [
-    ...q([`{${row.target}}`, '{plain}', vector ?? null]).matchAll(/\{([A-Za-z][A-Za-z-]*)\}/g),
-  ]
-    .map((match) => (match[1] === 'beacon' || match[1] === 'probe' ? 'log' : match[1]))
-    .some((name) => name === origin || originDefaults[name] === origin);
+    ...originNames(fixed),
+    ...checkOrigins(vector?.liveCheck),
+    ...Object.values(vector?.observe ?? {}).flatMap((observation) =>
+      checkOrigins(observation?.check)
+    ),
+  ].includes(origin);
 }
 
-function skipWhy(vector, row, known) {
+export const inapplicable = (vector, target, scope) =>
+  Boolean(vector) &&
+  (vector.skip?.target === target ||
+    vector.observable?.[target] === false ||
+    (vector.scope !== 'any' && vector.scope !== scope));
+
+function skipWhy(vector, row, known, guard) {
   const { reason } = row;
   if (typeof reason !== 'string' || reason === '') return 'skip without a reason';
-  if (reason === 'not-applicable' || originReason(vector, row, reason)) return null;
+  if (reason === 'not-applicable' && inapplicable(vector, row.target, guard)) return null;
+  if (originReason(vector, row, reason)) return null;
   if (vector?.skip?.target === row.target && vector.skip.reason === reason) return null;
   if (reason.startsWith('not-supported:') && known.has(reason.slice('not-supported:'.length)))
     return null;
   return `skip with a reason the runner never gives: ${reason}`;
 }
 
-function forgeries(set, results) {
+function forgeries(set, results, guard) {
   const vectors = new Map(set.vectors.map((v) => [v.id, v]));
   const known = new Set([
     'browserSession',
@@ -338,7 +366,7 @@ function forgeries(set, results) {
     const why = [];
     if (legs.includes('not-run') && vector?.kind !== 'text')
       why.push('not-run on a vector that is not kind text');
-    if (legs.includes('skip')) why.push(skipWhy(vector, row, known));
+    if (legs.includes('skip')) why.push(skipWhy(vector, row, known, guard));
     const found = why.filter(Boolean);
     if (!found.length) return [];
     const { id, target, variant, transport } = row;
@@ -356,7 +384,7 @@ export function summary({ guard, sha, set, results }) {
     .flatMap((row) => variants.map((variant) => ({ ...row, variant })))
     .flatMap((row) => uniq('transport').map((transport) => ({ ...row, transport })))
     .filter((r) => !has.has(q([r.id, r.target, r.variant, r.transport])));
-  const forged = forgeries(set, results);
+  const forged = forgeries(set, results, guard);
   const pass =
     results.length > 0 && missing.length === 0 && forged.length === 0 && results.every(passed);
   const name = `@ai-ecoverse/slicc-browsers@${set.setVersion}`;

package/guard-runner.mjs

@@ -8,6 +8,7 @@ import {
   canary,
   expand,
   hop,
+  inapplicable,
   isRefusal,
   knownOrigins,
   loadedAfter,
@@ -1289,10 +1290,7 @@ const needsObserver = (vector) =>
   );
 
 const inactive = (vector, target, capabilities) =>
-  vector.skip?.target === target ||
-  vector.observable?.[target] === false ||
-  !supported(vector.requires, capabilities) ||
-  (vector.scope !== 'any' && vector.scope !== capabilities.scope);
+  inapplicable(vector, target, capabilities.scope) || !supported(vector.requires, capabilities);
 
 const allSteps = (list) => list.flatMap((step) => [step, ...allSteps(step.children ?? [])]);
 const browserContextStep = (vector, capabilities) =>

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.14.7",
+  "setVersion": "1.14.9",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.14.7",
+  "version": "1.14.9",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",