@ai-ecoverse/slicc-browsers 1.16.1 → 1.17.0

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.16.1",
+  "setVersion": "1.17.0",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -98,7 +98,8 @@
     "extensionWorld": "a browser hosting a foreign content-script extension isolated world on the ordinary fixture page",
     "discovery": "session-less Target.setDiscoverTargets and targetCreated/targetInfoChanged delivery; absent transports must emit neither event",
     "chromeUrlsAttach": "attaching to and driving chrome:// pages, which CDP over a DevTools port can and chrome.debugger can't",
-    "clientExit": "closing the guarded client mid-row: the client has close(), the clientFactory makes a fresh guarded client for the next leg, and an independent unguarded observer outlives it"
+    "clientExit": "closing the guarded client mid-row: the client has close(), the clientFactory makes a fresh guarded client for the next leg, and an independent unguarded observer outlives it",
+    "siteIsolationOff": "the browser runs without site isolation, so a cross-site iframe shares its parent's process"
   },
   "placeholders": {
     "target": "the target's origin; {plain} on the control",
@@ -13042,6 +13043,524 @@
         "observer": "client"
       }
     },
+    {
+      "id": "C4.iframe-preattach.blank",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "defaultContext": true,
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/blank"
+        }
+      ],
+      "trigger": [
+        {
+          "frameRead": "blank",
+          "from": "{ordinary-same-site}",
+          "on": "guarded",
+          "as": "frames"
+        },
+        {
+          "frameRead": "blank",
+          "from": "{plain}",
+          "on": "control",
+          "as": "frames"
+        }
+      ],
+      "targets": ["seven"],
+      "observe": {
+        "live": {
+          "means": "the observer saw the protected frame's about:blank child and its marker in the page's process",
+          "check": {
+            "result": "frames",
+            "path": "result.live",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "frameTreeShown": {
+          "means": "the client's Page.getFrameTree showed the child's marker or the protected path, query or fragment",
+          "check": {
+            "result": "frames",
+            "path": "result.frameTreeShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "axFullShown": {
+          "means": "the client's frame-scoped Accessibility.getFullAXTree showed the marker",
+          "check": {
+            "result": "frames",
+            "path": "result.axFullShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "axPartialShown": {
+          "means": "the client's Accessibility.getPartialAXTree of the marker node showed the marker",
+          "check": {
+            "result": "frames",
+            "path": "result.axPartialShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "documentShown": {
+          "means": "the client's pierced DOM.getDocument showed the marker or the protected path, query or fragment",
+          "check": {
+            "result": "frames",
+            "path": "result.documentShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "nodeShown": {
+          "means": "the client's DOM.describeNode and DOM.getOuterHTML of the child's nodes showed the marker",
+          "check": {
+            "result": "frames",
+            "path": "result.nodeShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "snapshotShown": {
+          "means": "the client's DOMSnapshot.captureSnapshot showed the marker or the protected path, query or fragment",
+          "check": {
+            "result": "frames",
+            "path": "result.snapshotShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "eventsShown": {
+          "means": "an event on the client's session showed the marker or the protected path, query or fragment",
+          "check": {
+            "result": "frames",
+            "path": "result.eventsShown",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the independent observer, before the client attaches, sees {target}'s about:blank child frame and its marker in the page's own process through every read",
+      "liveCheck": {
+        "result": "frames",
+        "path": "result.live",
+        "equals": true,
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "live": true,
+          "frameTreeShown": true,
+          "axFullShown": true,
+          "axPartialShown": true,
+          "documentShown": true,
+          "nodeShown": true,
+          "snapshotShown": true
+        }
+      },
+      "expected": {
+        "live": true,
+        "frameTreeShown": false,
+        "axFullShown": false,
+        "axPartialShown": false,
+        "documentShown": false,
+        "nodeShown": false,
+        "snapshotShown": false,
+        "eventsShown": false
+      }
+    },
+    {
+      "id": "C4.iframe-preattach.srcdoc",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "defaultContext": true,
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/blank"
+        }
+      ],
+      "trigger": [
+        {
+          "frameRead": "srcdoc",
+          "from": "{ordinary-same-site}",
+          "on": "guarded",
+          "as": "frames"
+        },
+        {
+          "frameRead": "srcdoc",
+          "from": "{plain}",
+          "on": "control",
+          "as": "frames"
+        }
+      ],
+      "targets": ["seven"],
+      "observe": {
+        "live": {
+          "means": "the observer saw the protected frame's about:srcdoc child and its marker in the page's process",
+          "check": {
+            "result": "frames",
+            "path": "result.live",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "frameTreeShown": {
+          "means": "the client's Page.getFrameTree showed the child's marker or the protected path, query or fragment",
+          "check": {
+            "result": "frames",
+            "path": "result.frameTreeShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "axFullShown": {
+          "means": "the client's frame-scoped Accessibility.getFullAXTree showed the marker",
+          "check": {
+            "result": "frames",
+            "path": "result.axFullShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "axPartialShown": {
+          "means": "the client's Accessibility.getPartialAXTree of the marker node showed the marker",
+          "check": {
+            "result": "frames",
+            "path": "result.axPartialShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "documentShown": {
+          "means": "the client's pierced DOM.getDocument showed the marker or the protected path, query or fragment",
+          "check": {
+            "result": "frames",
+            "path": "result.documentShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "nodeShown": {
+          "means": "the client's DOM.describeNode and DOM.getOuterHTML of the child's nodes showed the marker",
+          "check": {
+            "result": "frames",
+            "path": "result.nodeShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "snapshotShown": {
+          "means": "the client's DOMSnapshot.captureSnapshot showed the marker or the protected path, query or fragment",
+          "check": {
+            "result": "frames",
+            "path": "result.snapshotShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "eventsShown": {
+          "means": "an event on the client's session showed the marker or the protected path, query or fragment",
+          "check": {
+            "result": "frames",
+            "path": "result.eventsShown",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the independent observer, before the client attaches, sees {target}'s about:srcdoc child frame and its marker in the page's own process through every read",
+      "liveCheck": {
+        "result": "frames",
+        "path": "result.live",
+        "equals": true,
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "live": true,
+          "frameTreeShown": true,
+          "axFullShown": true,
+          "axPartialShown": true,
+          "documentShown": true,
+          "nodeShown": true,
+          "snapshotShown": true
+        }
+      },
+      "expected": {
+        "live": true,
+        "frameTreeShown": false,
+        "axFullShown": false,
+        "axPartialShown": false,
+        "documentShown": false,
+        "nodeShown": false,
+        "snapshotShown": false,
+        "eventsShown": false
+      }
+    },
+    {
+      "id": "C4.iframe-preattach.blank.shared",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "defaultContext": true,
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/blank"
+        }
+      ],
+      "trigger": [
+        {
+          "frameRead": "blank",
+          "from": "{ordinary}",
+          "as": "frames",
+          "requires": ["siteIsolationOff"]
+        }
+      ],
+      "targets": ["seven", "vault", "vault-x", "apex"],
+      "requires": ["siteIsolationOff"],
+      "observe": {
+        "live": {
+          "means": "the observer saw the protected frame's about:blank child and its marker in the page's process",
+          "check": {
+            "result": "frames",
+            "path": "result.live",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "frameTreeShown": {
+          "means": "the client's Page.getFrameTree showed the child's marker or the protected path, query or fragment",
+          "check": {
+            "result": "frames",
+            "path": "result.frameTreeShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "axFullShown": {
+          "means": "the client's frame-scoped Accessibility.getFullAXTree showed the marker",
+          "check": {
+            "result": "frames",
+            "path": "result.axFullShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "axPartialShown": {
+          "means": "the client's Accessibility.getPartialAXTree of the marker node showed the marker",
+          "check": {
+            "result": "frames",
+            "path": "result.axPartialShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "documentShown": {
+          "means": "the client's pierced DOM.getDocument showed the marker or the protected path, query or fragment",
+          "check": {
+            "result": "frames",
+            "path": "result.documentShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "nodeShown": {
+          "means": "the client's DOM.describeNode and DOM.getOuterHTML of the child's nodes showed the marker",
+          "check": {
+            "result": "frames",
+            "path": "result.nodeShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "snapshotShown": {
+          "means": "the client's DOMSnapshot.captureSnapshot showed the marker or the protected path, query or fragment",
+          "check": {
+            "result": "frames",
+            "path": "result.snapshotShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "eventsShown": {
+          "means": "an event on the client's session showed the marker or the protected path, query or fragment",
+          "check": {
+            "result": "frames",
+            "path": "result.eventsShown",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the independent observer, before the client attaches, sees {target}'s about:blank child frame and its marker in the page's own process through every read",
+      "liveCheck": {
+        "result": "frames",
+        "path": "result.live",
+        "equals": true,
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "live": true,
+          "frameTreeShown": true,
+          "axFullShown": true,
+          "axPartialShown": true,
+          "documentShown": true,
+          "nodeShown": true,
+          "snapshotShown": true
+        }
+      },
+      "expected": {
+        "live": true,
+        "frameTreeShown": false,
+        "axFullShown": false,
+        "axPartialShown": false,
+        "documentShown": false,
+        "nodeShown": false,
+        "snapshotShown": false,
+        "eventsShown": false
+      }
+    },
+    {
+      "id": "C4.iframe-preattach.srcdoc.shared",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "defaultContext": true,
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/blank"
+        }
+      ],
+      "trigger": [
+        {
+          "frameRead": "srcdoc",
+          "from": "{ordinary}",
+          "as": "frames",
+          "requires": ["siteIsolationOff"]
+        }
+      ],
+      "targets": ["seven", "vault", "vault-x", "apex"],
+      "requires": ["siteIsolationOff"],
+      "observe": {
+        "live": {
+          "means": "the observer saw the protected frame's about:srcdoc child and its marker in the page's process",
+          "check": {
+            "result": "frames",
+            "path": "result.live",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "frameTreeShown": {
+          "means": "the client's Page.getFrameTree showed the child's marker or the protected path, query or fragment",
+          "check": {
+            "result": "frames",
+            "path": "result.frameTreeShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "axFullShown": {
+          "means": "the client's frame-scoped Accessibility.getFullAXTree showed the marker",
+          "check": {
+            "result": "frames",
+            "path": "result.axFullShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "axPartialShown": {
+          "means": "the client's Accessibility.getPartialAXTree of the marker node showed the marker",
+          "check": {
+            "result": "frames",
+            "path": "result.axPartialShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "documentShown": {
+          "means": "the client's pierced DOM.getDocument showed the marker or the protected path, query or fragment",
+          "check": {
+            "result": "frames",
+            "path": "result.documentShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "nodeShown": {
+          "means": "the client's DOM.describeNode and DOM.getOuterHTML of the child's nodes showed the marker",
+          "check": {
+            "result": "frames",
+            "path": "result.nodeShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "snapshotShown": {
+          "means": "the client's DOMSnapshot.captureSnapshot showed the marker or the protected path, query or fragment",
+          "check": {
+            "result": "frames",
+            "path": "result.snapshotShown",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "eventsShown": {
+          "means": "an event on the client's session showed the marker or the protected path, query or fragment",
+          "check": {
+            "result": "frames",
+            "path": "result.eventsShown",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the independent observer, before the client attaches, sees {target}'s about:srcdoc child frame and its marker in the page's own process through every read",
+      "liveCheck": {
+        "result": "frames",
+        "path": "result.live",
+        "equals": true,
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "live": true,
+          "frameTreeShown": true,
+          "axFullShown": true,
+          "axPartialShown": true,
+          "documentShown": true,
+          "nodeShown": true,
+          "snapshotShown": true
+        }
+      },
+      "expected": {
+        "live": true,
+        "frameTreeShown": false,
+        "axFullShown": false,
+        "axPartialShown": false,
+        "documentShown": false,
+        "nodeShown": false,
+        "snapshotShown": false,
+        "eventsShown": false
+      }
+    },
     {
       "id": "C5.fulfill",
       "family": "C",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.16.1",
+  "version": "1.17.0",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -58,6 +58,7 @@
     "redirect-secret.mjs",
     "redirect-fragments.mjs",
     "observer-target.mjs",
+    "frame-read.mjs",
     "fixture-client.mjs"
   ],
   "scripts": {
@@ -66,7 +67,7 @@
     "validate": "node scripts/validate.mjs",
     "lint": "slicc-lint && test -z \"$(gofmt -l .)\" && go mod tidy -diff && go vet ./... && golangci-lint run && cargo fmt --check && cargo clippy --all-features --all-targets -- -D warnings",
     "format": "biome check --write . && gofmt -w . && cargo fmt",
-    "test": "npm run validate && node --test test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/git-retry.test.mjs test/integration/release-line.test.mjs test/integration/guard-redirect-carrier.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-stall.test.mjs test/integration/guard-forged.test.mjs test/integration/guard-exit-steps.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
+    "test": "npm run validate && node --test test/integration/self-contained.test.mjs test/integration/browser-runner.test.mjs test/integration/fixture-client.test.mjs test/integration/git-retry.test.mjs test/integration/release-line.test.mjs test/integration/guard-redirect-carrier.test.mjs test/integration/guard-redirect-session-end.test.mjs test/integration/guard-incomplete.test.mjs test/integration/guard-stall.test.mjs test/integration/guard-forged.test.mjs test/integration/guard-exit-steps.test.mjs test/integration/guard-frame-read.test.mjs && go test -race -count=1 ./test/integration/... && cargo test --all-features",
     "test:unit": "go test -race -cover ./...",
     "build": "go build ./... && cargo build --all-features && cargo build --target wasm32-wasip1 --all-features && npm pack --dry-run",
     "trust": "npx fledgling sync -y --skip-publish",
@@ -78,10 +79,10 @@
     "test:gates": "node --test test/integration/gates.test.mjs",
     "test:guard-target": "node --test test/integration/guard-runner.test.mjs",
     "test:unit:redirect": "mkdir -p coverage/unit && node --experimental-test-coverage --test --test-coverage-include=redirect-secret.mjs --test-coverage-include=redirect-fragments.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/redirect.lcov test/unit/guard-redirect-*.test.mjs && slicc-diff-cover coverage/unit/redirect.lcov",
-    "test:unit:guard": "mkdir -p coverage/unit && node --experimental-vm-modules --no-warnings --experimental-test-coverage --test --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-include=fixture-client.mjs --test-coverage-include=observer-target.mjs --test-coverage-include=protected-error-page.mjs --test-coverage-include=unparseable-url.mjs --test-coverage-include=scripts/browser-runner.mjs --test-coverage-include=scripts/validate.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/guard.lcov test/unit/guard-*.test.mjs && slicc-diff-cover coverage/unit/guard.lcov"
+    "test:unit:guard": "mkdir -p coverage/unit && node --experimental-vm-modules --no-warnings --experimental-test-coverage --test --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-include=fixture-client.mjs --test-coverage-include=observer-target.mjs --test-coverage-include=frame-read.mjs --test-coverage-include=protected-error-page.mjs --test-coverage-include=unparseable-url.mjs --test-coverage-include=scripts/browser-runner.mjs --test-coverage-include=scripts/validate.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/guard.lcov test/unit/guard-*.test.mjs && slicc-diff-cover coverage/unit/guard.lcov"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-shared-web": "2.7.4",
+    "@ai-ecoverse/slicc-shared-web": "2.7.5",
     "@biomejs/biome": "2.5.15",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",