@ai-ecoverse/slicc-browsers 1.18.1 → 1.18.2

package/README.md

@@ -283,7 +283,7 @@ Popups are observed by `Target.targetCreated` with the opener's `openerId`, or b
 
 `{ "extensionWorld": "hidden" | "select" | "debugger" | "drivable", "as": "world", "requires": ["extensionWorld"] }` runs the C9 compound probe on the current ordinary page. The runner attaches an independent observer to discover actual context ids, unique ids and names, and sends probes through the client session. Discovery matches the expected fixture extension’s exact origin, never the first extension world: `run()`’s optional `extensionWorldId` defaults to shared-web’s harness id `ankmbodmgimjemnojmeddfcdlbocolob`. Multiple unrelated content-script worlds are ignored for fixture selection, while guards must still protect foreign worlds. A custom fixture must provide the same content-script marker contract. Object handles are minted and validated on the unguarded control session, then replayed as guesses on the guarded leg; Chrome object handles and DOM node ids are session-local, so observer handles must never be mistaken for client handles. Numeric ids from the control are also replayed alongside fresh observer-discovered selectors, but numeric ids are local to a tab: a control id may name the next tab’s exposed default context, which must work and return no extension marker. The same-tab hidden world’s actual numeric id and every extension unique-id guess still require a matched refusal. Unknown numeric ids and stale object handles (`not exposed`) need explicit refusals rather than Chrome’s invalid-id errors. `guessesRefused` aggregates only required refusals; `guessesReached` must be false on the guarded leg, and `exposedContextsWork` must remain true. Its result contains boolean evidence consumed by ordinary `result` checks. The unguarded leg validates those selectors against Chrome itself before guarded evidence can pass.
 
-`{ "errorPage": "recover", "secret"?: "all" | "query" | "fragment", "as": "errorPage" }` (also modes `restore` and `sticky`; `secret` defaults to `all`) runs the protected-error-page compound probe with independent commit evidence, discovery redaction and recovery or sticky-lock checks. The unguarded observer seeds the protected history and failed commit, so the rows run on page-session-only transports too. The guarded client uses only `Target.getTargetInfo` with a `targetId`, `Target.getTargets`, `Target.setDiscoverTargets`, `Target.attachToTarget`, `Target.detachFromTarget` and `Target.closeTarget` without a session, which page-session transports answer themselves, and everything else on its page session; the rows require no whole-vector capability. Only `eventsRedacted` requires `discovery`: without it the probe does not call `Target.setDiscoverTargets`, that one field is `not-supported` in both legs, and the notes say `not-supported:discovery`; info, list, attach, recovery and lock checks still run. Discovery absence is structural: a guarded transport delivering either `Target.targetCreated` or `Target.targetInfoChanged` during such a row without declaring `discovery` fails the row, even when the event names an ordinary target. `Target.attachedToTarget` remains independently checked by `attachRedacted`. The runner leaves this probe’s independent Fetch sessions to the probe rather than answering their pauses itself. Each of the probe’s waits is bounded at 5000 ms, scaled by `settleScale`. When the probe’s own evidence is missing, it returns `incomplete` with `protected-error-page: <reason>` instead of throwing: the observer target could not be created or attached (an `openerId` included, after cleaning the target up), the observer’s history seed or allowed document did not commit (or its setup failed), the client’s `Page.navigate` to the trigger failed or was refused, the control’s own Fetch failure injection left no error commit, the protected history entry is missing, no real `BackForwardCacheRestore` arrived, or the observer’s sticky failure left no error page. The guarded leg’s missing error commit is not incomplete: it is the guard’s, and stays `live: false`.
+`{ "errorPage": "recover", "secret"?: "all" | "query" | "fragment", "as": "errorPage" }` (also modes `restore` and `sticky`; `secret` defaults to `all`) runs the protected-error-page compound probe with independent commit evidence, discovery redaction and recovery or sticky-lock checks. The unguarded observer seeds the protected history and failed commit, so the rows run on page-session-only transports too. The guarded client uses only `Target.getTargetInfo` with a `targetId`, `Target.getTargets`, `Target.setDiscoverTargets`, `Target.attachToTarget`, `Target.detachFromTarget` and `Target.closeTarget` without a session, which page-session transports answer themselves, and everything else on its page session; the rows require no whole-vector capability. Only `eventsRedacted` requires `discovery`: without it the probe does not call `Target.setDiscoverTargets`, that one field is `not-supported` in both legs, and the notes say `not-supported:discovery`; info, list, attach, recovery and lock checks still run. Discovery absence is structural: a guarded transport delivering either `Target.targetCreated` or `Target.targetInfoChanged` during such a row without declaring `discovery` fails the row, even when the event names an ordinary target. `Target.attachedToTarget` remains independently checked by `attachRedacted`. The runner leaves this probe’s independent Fetch sessions to the probe rather than answering their pauses itself. Each of the probe’s waits is bounded at 5000 ms, scaled by `settleScale`. Its `diagnostics` record the client’s `Target.attachToTarget` as `clientAttach`, whose `outcome` is `answered` (with `sessionId`, whether the reply carried one), `refused` or `error` (both with the `error` text), and, once the client has navigated, the error-commit wait as `errorCommit`: `seen`, `elapsedMs` when seen or at timeout, `budgetMs` with `settleScale` applied, and the last `frame` and `targetInfo` read. They change no verdict. The row carries them as `evidence.control.errorPage` and `evidence.guarded.errorPage`, and a guarded leg that is not live because the attach gave no session or the commit was not seen says why: `not live: client attach refused: <text>` (or `failed: <text>`, or `answered without a sessionId`), or `not live: error commit not seen after <elapsed>ms (budget <budget>ms): frame <url> unreachableUrl <url or none>, target <url>`. When the probe’s own evidence is missing, it returns `incomplete` with `protected-error-page: <reason>` instead of throwing: the observer target could not be created or attached (an `openerId` included, after cleaning the target up), the observer’s history seed or allowed document did not commit (or its setup failed), the client’s `Page.navigate` to the trigger failed or was refused, the control’s own Fetch failure injection left no error commit, the protected history entry is missing, no real `BackForwardCacheRestore` arrived, or the observer’s sticky failure left no error page. The guarded leg’s missing error commit is not incomplete: it is the guard’s, and stays `live: false`.
 
 `{ "redirectSecret": "headers" | "mix" | "body", "as": "redirect" }` runs a C2 compound probe and owns its Fetch pauses. The client must expose `messages`, an append-only array of every raw received CDP text frame, recorded before parsing; an events-only or reply-only tap fails `rawRecorded`. Whenever a run includes a `C2.redirect-*` row or a `redirectSecret` step, `run()` retains an explicit `fixture.redirectSecret` hook or automatically installs a fetch-only `POST /redirect` bridge. Its base is `fixtureBase`, then `fixture.origin`, then `targets.ordinary`; a browser-page alias or reverse proxy must forward that endpoint to the bundled fixture. The bundled `fixtureServer()` always supplies both its direct hook and HTTP control endpoint, so no custom registration method is needed. Missing, unreachable or non-successful registration is an explicit row/summary error containing `redirectSecret fixture registration required`, never a pass or a skipped observation. Fixture logs must include headers for the cookie check. The guard’s events and raw messages must represent the same delivered stream. The leak scan memoizes each decoded string and yields to the event loop between items, so concurrent rows in the same process are not starved. When the probe’s own unguarded observer setup (attach, `Page.enable` and the seven cookie) fails before the client is used, the probe returns `incomplete` with `redirect-secret: observer setup failed: <reason>` instead of throwing.
 

package/guard-runner.mjs

@@ -1283,7 +1283,10 @@ class Execution {
     if (!live && this.unmeasured(this.vector.liveCheck))
       return { live: 'incomplete', liveWhy: 'incomplete' };
     if (!live && !unseen.length) live = await this.poll(alive, 1500);
-    if (!unseen.length || (live && !incomplete.length)) return { live };
+    if (!unseen.length || (live && !incomplete.length))
+      return live
+        ? { live }
+        : { live, liveWhy: this.calls[this.vector.liveCheck.result]?.result?.liveWhy };
     const detail = incomplete.length ? ` (${incomplete.join(', ')} incomplete)` : '';
     return { live: false, liveWhy: `pre beacon not observed for ${unseen.join(', ')}${detail}` };
   }
@@ -1321,8 +1324,10 @@ class Execution {
         incomplete: this.incomplete,
         evidence: Object.fromEntries(
           Object.entries(this.calls)
-            .filter(([, out]) => out?.result?.delay && out.result.probes)
-            .map(([name, out]) => [name, out.result])
+            .filter(
+              ([, out]) => (out?.result?.delay && out.result.probes) || out?.result?.diagnostics
+            )
+            .map(([name, out]) => [name, out.result.diagnostics ?? out.result])
         ),
       };
     } finally {
@@ -1746,6 +1751,7 @@ function settleIncomplete(row, vector, base, legs) {
     control: fill('control'),
     guarded: fill('guarded'),
     live: legs.control.live === true && [true, 'incomplete'].includes(legs.guarded.live),
+    liveWhy: legs.guarded.liveWhy,
   });
   for (const side of ['control', 'guarded'])
     if (legs[side].incomplete?.length && filled[side] === 'pass') row[side] = 'incomplete';

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.18.1",
+  "setVersion": "1.18.2",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.18.1",
+  "version": "1.18.2",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",

package/protected-error-page.mjs

@@ -4,6 +4,22 @@ import { createObserverTarget } from './observer-target.mjs';
 const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 const refused = (out) => !out.ok && /^slicc: refused:/.test(out.error?.message ?? '');
 
+function attachOutcome(out) {
+  if (out.ok) return { outcome: 'answered', sessionId: Boolean(out.result?.sessionId) };
+  return {
+    outcome: refused(out) ? 'refused' : 'error',
+    error: String(out.error?.message ?? out.error),
+  };
+}
+
+const attachWhy = ({ outcome: kind, error }) =>
+  kind === 'answered'
+    ? 'client attach answered without a sessionId'
+    : `client attach ${kind === 'refused' ? 'refused' : 'failed'}: ${error}`;
+
+const commitWhy = ({ elapsedMs, budgetMs, frame, targetInfo }) =>
+  `error commit not seen after ${elapsedMs}ms (budget ${budgetMs}ms): frame ${frame.url} unreachableUrl ${frame.unreachableUrl ?? 'none'}, target ${targetInfo.url}`;
+
 async function loadedDocument(reader, observer, url, until) {
   return until(async () => {
     const { frameTree } = await reader.send('Page.getFrameTree', {}, observer);
@@ -197,7 +213,14 @@ export async function protectedErrorPage({
       client.send('Target.attachToTarget', { targetId, flatten: true })
     );
     session = attached.result?.sessionId;
-    if (!session) return { live: false, attached: false };
+    result.diagnostics = { clientAttach: attachOutcome(attached) };
+    if (!session)
+      return {
+        ...result,
+        live: false,
+        attached: false,
+        liveWhy: attachWhy(result.diagnostics.clientAttach),
+      };
     await client.send('Page.enable', {}, session);
     await client.send('Runtime.enable', {}, session);
     if (discovery) await client.send('Target.setDiscoverTargets', { discover: true });
@@ -212,6 +235,7 @@ export async function protectedErrorPage({
     const unsent = await scripted(client, session, ordinary, failedURL);
     if (unsent) return missing(unsent);
     let evidence;
+    const waited = Date.now();
     const live = await until(async () => {
       const f = await frame();
       const { targetInfo } = await reader.send('Target.getTargetInfo', { targetId });
@@ -224,10 +248,16 @@ export async function protectedErrorPage({
       );
     });
     result.evidence = evidence;
+    result.diagnostics.errorCommit = {
+      seen: live,
+      elapsedMs: Date.now() - waited,
+      budgetMs: budget,
+      ...evidence,
+    };
     if (!live && side === 'control')
       return missing(`missing error commit ${JSON.stringify(evidence)}`);
     result.live = live;
-    if (!live) return result;
+    if (!live) return { ...result, liveWhy: commitWhy(result.diagnostics.errorCommit) };
     await redaction({ client, targetId, failedURL, protectedOrigin, start, result, discovery });
     const beforeReload = (await frame()).loaderId;
     result.reload = (await outcome(client.send('Page.reload', {}, session))).ok;