@ai-ecoverse/slicc-browsers 1.20.3 → 1.21.0

package/README.md

@@ -183,17 +183,21 @@ It also offers `storageKey(key)` and `unparseable(text)`. A Go or Rust implement
 
 ## Guard vectors
 
-A guard sits between a CDP client, such as an agent's browser tool, and the browser, and keeps the client away from protected origins. `guard-vectors.json` holds more than a hundred attacks on that promise, and every guard must pass them all. They include navigation, redirect chains, popups and frames, request interception, cookie and storage access, privileged pages, error pages, foreign extension worlds, debugger and instrumentation tricks, and session overrides that would leak into a protected page.
+A guard sits between a CDP client, such as an agent's browser tool, and the browser, and keeps the client away from protected origins. `guard-vectors.json` holds more than a hundred attacks on that promise, and every guard must pass them all. They cover navigation, redirect chains, popups, frames, request interception, cookies, storage, privileged and error pages, foreign extension worlds, debugger tricks and session overrides that would leak into a protected page.
 
 Each vector runs twice. The **control** runs it against an ordinary origin, where it must work. The **guarded** leg runs it through the guard against a protected target, where it must be refused or have no effect. A **liveness** check, made outside the guard, proves the protected target was really there. A row passes only when all three do, so a guard can't pass by breaking everything, and a test can't pass by never reaching the target.
 
-When a vector compares ordinary and protected fixture markers, those markers do not contain one another. Protected-marker checks still examine complete probe replies, including errors, and the vector's client events and messages, including encoded values.
-
 A guard may refuse every client navigation to an `about:` URL that inherits an origin, such as `about:blank`. Refusing an ordinary navigation away from a protected page still fails.
 
-Client-exit controls use the unguarded observer; persistent-capability refusals are valid evidence, granted instruments must leave no effects after exit, and missing answers remain incomplete.
+### What a guard must let through
+
+For stock Playwright, Puppeteer and raw CDP clients, a guard that declares `stockSetup` admits on ordinary pages:
+- `Page.addScriptToEvaluateOnNewDocument` whose `source` matches `^(?:[ \t\n]|//[^\n\r\u2028\u2029]*)*$` on the whole string without the multiline flag (no code), with any `worldName` or `runImmediately`, and its removal;
+- exactly `Emulation.setFocusEmulationEnabled`, `setEmulatedMedia`, `setDeviceMetricsOverride` and `setTouchEmulationEnabled`;
+- `Page.createIsolatedWorld` on a frame the guard already classifies as ordinary: strip `grantUniveralAccess` and `contentSecurityPolicy`, return no `executionContextId` for any other frame; `Runtime.addBinding` scoped to such a world by a non-empty `executionContextName` or its `executionContextId`, with `Runtime.bindingCalled` only from those worlds;
+- `Target.setAutoAttach`: accept the call but narrow the filter to tab targets, hold pages under the tab like pages (same URL redaction in `targetInfo`); a transport that synthesizes it declares `syntheticAutoAttach`.
 
-Forwarding audits retain early snapshots as evidence. A complete final ledger supersedes an incomplete early snapshot, but any forwarding reported in either audit remains a failure. An incomplete final audit remains missing evidence.
+The strip holds whether or not a given Chrome lets that world reach another origin. Code init scripts, main-world bindings and other overrides stay refused or harmless. Admitted display overrides and no-code init scripts must not remain in effect on a protected document — refuse that navigation, or clear them before it runs. Undeclared, they skip, never pass.
 
 ### Running them
 
@@ -225,20 +229,20 @@ You supply:
 | capability | means the transport can |
 | --- | --- |
 | `autoAttach` | auto-attach to child targets such as popups and iframes |
-| `browserSession` | send commands to the browser session, not only to a page |
+| `browserSession` | send commands on the browser session, not only a page |
 | `browserContexts` | create isolated browser contexts |
-| `discovery` | report target creation and changes without a session |
-| `chromeUrlsAttach` | attach to `chrome://` pages (CDP over a DevTools port can; `chrome.debugger` can't) |
-| `extensionWorld` | host a foreign extension's content script on the test page |
-| `extensionFrame` | host the harness extension, whose frame an ordinary test page embeds |
-| `clientExit` | close the guarded client in the middle of a row |
-| `siteIsolationOff`, `inboundDelay`, `forwardAudit` | run without site isolation, hold the browser's messages to the guard, and audit what the guard forwarded |
-
-`forwardAudit` permits observer restore after a client history timeout only with terminal `historyTrigger: { id: "history-trigger", complete: true, forwarded: false }` proof from `audit({ historyTrigger: command, probes: [], final: false })`, keeping the probe ledger open; missing proof, forwarding or a late successful reply never qualifies as refusal.
+| `discovery` | report target create/change without a session |
+| `chromeUrlsAttach` | attach to `chrome://` pages (DevTools-port CDP; not `chrome.debugger`) |
+| `extensionWorld` | host a foreign extension content script on the test page |
+| `extensionFrame` | host the harness extension frame an ordinary test page embeds |
+| `clientExit` | close the guarded client mid-row |
+| `siteIsolationOff`, `inboundDelay`, `forwardAudit` | no site isolation; hold inbound; audit forwarded commands |
+| `secureOrigin` | HTTPS origins (service workers) |
+| `stockSetup`, `syntheticAutoAttach` | admit stock clients' setup calls; synthesize auto-attach |
 
 ### Reading the result
 
-Each row reports `control`, `guarded` and `live` as `pass`, `fail`, `skip`, `incomplete` (the test couldn't gather its own evidence) or `not-run` (vectors described only in words). `summary()` turns the rows into one line:
+Each row reports `control`, `guarded` and `live` as `pass`, `fail`, `skip`, `incomplete` (evidence missing) or `not-run` (words only). `summary()` makes one line:
 
 ```text
 GUARD-PASS my-guard@1a2b3c4 (vectors @ai-ecoverse/slicc-browsers@1.18.5)
@@ -266,7 +270,7 @@ A new discovery behaviour gets a corpus case, and a new guard behaviour gets a g
 
 CI is [slicc-shared-web's pipeline](https://github.com/ai-ecoverse/slicc-shared-web#pipeline), called from `.github/workflows/ci.yml`. A pull request gets lint, then `npm test` split over shards by timing, then a Claude and a Codex review; the merge queue runs lint and the tests again. Tests run on Linux only.
 
-Every merge to `main` that warrants it is released by semantic-release in the same workflow, as one version for all three packages. The `vX.Y.Z` tag is the Go release, and npm gets the package with provenance through trusted publishing. Then `ci.yml` publishes the crate to crates.io, also with trusted publishing, and asks the Go module proxy and pkg.go.dev for the new tag. Pushed tags are never moved or deleted: a bad release is fixed by the next one.
+Every merge to `main` that warrants it is released by semantic-release as one version for all three packages. Pushed tags are never moved or deleted: a bad release is fixed by the next one.
 
 ## License
 

package/fixture-server.mjs

@@ -103,6 +103,8 @@ function route(req, url, send, html, redirects) {
     },
     '/doc': () => document(url, html),
     '/csp': () => document(url, html),
+    '/sw.js': () =>
+      send(200, "self.addEventListener('install',()=>self.skipWaiting())", 'text/javascript'),
   };
   if (req.method === 'OPTIONS') return send(204, '');
   if (url.pathname.startsWith('/auth')) {

package/guard-runner.mjs

@@ -60,6 +60,7 @@ const matches = (value, predicate) => {
     if (key === '$some') return Array.isArray(value) && value.some((item) => matches(item, want));
     if (key === '$every')
       return Array.isArray(value) && value.length > 0 && value.every((item) => matches(item, want));
+    if (key === '$absentOr') return value === undefined || value === want;
     return matches(value?.[key], want);
   });
 };
@@ -153,6 +154,7 @@ class Execution {
     this.answers = [];
     this.internalSessions = new Set();
     this.attachSettings = new Map();
+    this.tabSessions = new Set();
     this.childSteps = [];
     this.deferred = [];
     this.expectWhere = [...(vector.setup ?? []), ...(vector.trigger ?? [])].some(
@@ -346,28 +348,61 @@ class Execution {
     });
   }
 
-  async blocked(spec, observer) {
-    const urls = (spec.anyOf ?? [spec.url]).map(address);
+  clientBlocked(spec, urls) {
+    const session = spec.session === 'child' ? this.sessions.child : this.sessions.page;
+    if (!session) return false;
     const events = this.client.events.slice(this.eventStart);
-    if (observer === 'client') {
-      const requests = new Map(
-        events
-          .filter((event) => event.method === 'Network.requestWillBeSent')
-          .map((event) => [event.params.requestId, event.params.request.url])
+    const requests = new Map();
+    const mainFrames = new Set();
+    const mainLoaders = new Set();
+    for (const event of events) {
+      if (event.sessionId !== session) continue;
+      if (event.method === 'Network.requestWillBeSent')
+        requests.set(event.params.requestId, {
+          url: event.params.request.url,
+          type: event.params.type,
+          frameId: event.params.frameId,
+          loaderId: event.params.loaderId,
+        });
+      if (event.method === 'Page.frameNavigated' && !event.params.frame.parentId) {
+        mainFrames.add(event.params.frame.id);
+        if (event.params.frame.loaderId) mainLoaders.add(event.params.frame.loaderId);
+      }
+    }
+    const navigated = (event) => {
+      const child = event.params.frame.parentId || event.sessionId === this.sessions.child;
+      const frameOk = spec.frame ? child : !event.params.frame.parentId;
+      return (
+        frameOk &&
+        urls.includes(event.params.frame.unreachableUrl) &&
+        event.params.frame.url.startsWith('chrome-error://')
       );
-      return events.some(
-        (event) =>
-          (event.method === 'Page.frameNavigated' &&
-            (!spec.frame ||
-              event.params.frame.parentId ||
-              event.sessionId === this.sessions.child) &&
-            urls.includes(event.params.frame.unreachableUrl) &&
-            event.params.frame.url.startsWith('chrome-error://')) ||
-          (event.method === 'Network.loadingFailed' &&
-            urls.includes(requests.get(event.params.requestId)) &&
-            (event.params.blockedReason || event.params.errorText === 'net::ERR_BLOCKED_BY_CLIENT'))
+    };
+    const failed = (event) => {
+      const request = requests.get(event.params.requestId);
+      if (
+        request?.type !== 'Document' ||
+        !urls.includes(request.url) ||
+        !(event.params.blockedReason || event.params.errorText === 'net::ERR_BLOCKED_BY_CLIENT')
+      )
+        return false;
+      if (spec.frame) return Boolean(request.frameId && !mainFrames.has(request.frameId));
+      return (
+        (request.frameId && mainFrames.has(request.frameId)) ||
+        (request.loaderId && mainLoaders.has(request.loaderId))
       );
-    }
+    };
+    return events.some(
+      (event) =>
+        event.sessionId === session &&
+        ((event.method === 'Page.frameNavigated' && navigated(event)) ||
+          (event.method === 'Network.loadingFailed' && failed(event)))
+    );
+  }
+
+  async blocked(spec, observer) {
+    const urls = (spec.anyOf ?? [spec.url]).map(address);
+    if (observer === 'client') return this.clientBlocked(spec, urls);
     const targetId = spec.session === 'child' ? this.targets.at(-1) : this.pageTarget;
     if (!targetId) return false;
     const attached = await outcome(
@@ -378,21 +413,18 @@ class Execution {
       const read = await outcome(
         this.reader.send('Page.getFrameTree', {}, attached.result.sessionId)
       );
-      const visit = (tree) =>
+      const blockedFrame = (frame) =>
         Boolean(
-          tree &&
-            ((urls.includes(tree.frame.unreachableUrl) &&
-              tree.frame.url.startsWith('chrome-error://')) ||
-              (tree.childFrames ?? []).some(visit))
+          frame && urls.includes(frame.unreachableUrl) && frame.url.startsWith('chrome-error://')
         );
-      if (
-        read.ok &&
-        (spec.frame
-          ? (read.result.frameTree.childFrames ?? []).some(visit)
-          : visit(read.result.frameTree))
-      )
-        return true;
-      return spec.frame ? Boolean(await this.blockedFrameTarget(urls, targetId)) : false;
+      const visit = (tree) =>
+        Boolean(tree && (blockedFrame(tree.frame) || (tree.childFrames ?? []).some(visit)));
+      if (!read.ok) return false;
+      if (spec.frame) {
+        if ((read.result.frameTree.childFrames ?? []).some(visit)) return true;
+        return Boolean(await this.blockedFrameTarget(urls, targetId));
+      }
+      return blockedFrame(read.result.frameTree.frame);
     } finally {
       await outcome(
         this.reader.send('Target.detachFromTarget', { sessionId: attached.result.sessionId })
@@ -530,6 +562,7 @@ class Execution {
 
   async pump() {
     while (!this.stopped && !this.clients.flight?.abandoned) {
+      this.failWatched();
       for (const event of this.client.events.slice(this.eventStart)) {
         if (this.processed.has(event)) continue;
         this.processed.add(event);
@@ -557,27 +590,35 @@ class Execution {
     const info = event.params.targetInfo;
     const child = event.params.sessionId;
     if (info?.type === 'browser_ui') return;
+    const paused = event.params.waitingForDebugger || this.tabSessions.has(event.sessionId);
     if (this.expectWhere && !this.childWhere) {
       this.deferred.push(event);
       return;
     }
     if (info?.browserContextId && this.vars.context && info.browserContextId !== this.vars.context)
       return;
-    if (this.childWhere && !this.childMatches(info)) {
-      if (event.params.waitingForDebugger)
+    const matched = !this.childWhere || this.childMatches(info);
+    const isTab = info?.type === 'tab';
+    if (!matched && !isTab) {
+      if (paused)
         this.pending.push(outcome(this.client.send('Runtime.runIfWaitingForDebugger', {}, child)));
       return;
     }
-    this.sessions.child = child;
-    if (info?.targetId) this.targets.push(info.targetId);
+    if (isTab) this.tabSessions.add(child);
+    if (matched) {
+      this.sessions.child = child;
+      if (info?.targetId) this.targets.push(info.targetId);
+    }
+    const nested = matched
+      ? this.childSteps
+      : this.childSteps.filter((step) => step.cdp === 'Target.setAutoAttach');
     const started = (async () => {
-      const reload = this.childSteps.findIndex((step) => step.cdp === 'Page.reload');
-      if (reload < 0) await this.execute(this.childSteps, child);
+      const reload = nested.findIndex((step) => step.cdp === 'Page.reload');
+      if (reload < 0) await this.execute(nested, child);
       else {
-        await this.execute(this.childSteps.slice(0, reload), child);
+        await this.execute(nested.slice(0, reload), child);
         const start = this.client.events.length;
-        if (event.params.waitingForDebugger)
-          await outcome(this.client.send('Runtime.runIfWaitingForDebugger', {}, child));
+        if (paused) await outcome(this.client.send('Runtime.runIfWaitingForDebugger', {}, child));
         await this.poll(
           () =>
             this.client.events
@@ -585,12 +626,11 @@ class Execution {
               .some((e) => e.method === 'Page.loadEventFired' && e.sessionId === child),
           1500
         );
-        await this.execute(this.childSteps.slice(reload), child);
+        await this.execute(nested.slice(reload), child);
       }
       const resumed = this.client.events.length;
-      if (event.params.waitingForDebugger)
-        await outcome(this.client.send('Runtime.runIfWaitingForDebugger', {}, child));
-      if (this.childSteps.some((step) => step.cdp === 'Page.enable'))
+      if (paused) await outcome(this.client.send('Runtime.runIfWaitingForDebugger', {}, child));
+      if (nested.some((step) => step.cdp === 'Page.enable'))
         await this.poll(() => this.firstLoad(child, resumed), 5000);
     })().catch((error) => this.errors.push(String(error.message ?? error)));
     this.childRuns.set(child, started);
@@ -657,8 +697,11 @@ class Execution {
   }
 
   childMatches(info) {
+    if (this.childWhere.type && info?.type !== this.childWhere.type) return false;
     if (this.childWhere.openerId === 'page') return info?.openerId === this.pageTarget;
-    return String(info?.url ?? '').startsWith(this.childWhere.urlPrefix);
+    if (this.childWhere.urlPrefix !== undefined)
+      return String(info?.url ?? '').startsWith(this.childWhere.urlPrefix);
+    return true;
   }
 
   async childrenSettled() {
@@ -740,6 +783,10 @@ class Execution {
         phase,
         Boolean(childSession) && !out.ok && this.detached(childSession)
       );
+      if ((step.isolatedWorld || step.observer) && !out.ok)
+        this.notes.push(
+          `${step.isolatedWorld ? `isolatedWorld ${step.isolatedWorld}` : `observer ${step.observer}`}: ${out.error?.message ?? 'failed'}`
+        );
       this.options.debug?.({ step, out, side: this.side });
     }
   }
@@ -921,11 +968,136 @@ class Execution {
         })
       );
     if (step.guess) return this.guess(step.guess, session);
+    if (step.isolatedWorld) return outcome(this.isolatedWorld(step));
+    if (step.observer) return outcome(this.watchPage(step));
     if (step.cdp) return this.cdp(step, session, phase);
     if (step.page) return this.page(step, session, phase);
     throw new Error('Unknown step kind');
   }
 
+  referenced(value, session) {
+    if (Array.isArray(value)) return value.map((item) => this.referenced(item, session));
+    if (!value || typeof value !== 'object') return value;
+    if (Object.hasOwn(value, '$result') || Object.hasOwn(value, '$event')) {
+      const source = Object.hasOwn(value, '$result')
+        ? this.calls[value.$result]
+        : this.actor()
+            .events.slice(this.eventStart)
+            .filter(
+              (event) =>
+                event.method === value.$event &&
+                (session === undefined || event.sessionId === session) &&
+                matches(event, value.where ?? {})
+            )
+            .at(-1);
+      const found = at(source, value.path);
+      if (found === undefined)
+        throw new Error(`unresolved reference ${value.$result ?? value.$event} ${value.path}`);
+      return found;
+    }
+    return Object.fromEntries(
+      Object.entries(value).map(([key, item]) => [key, this.referenced(item, session)])
+    );
+  }
+
+  async isolatedWorld(step) {
+    const targetId = step.session === 'child' ? this.targets.at(-1) : this.pageTarget;
+    const { sessionId } = await this.reader.send('Target.attachToTarget', {
+      targetId,
+      flatten: true,
+    });
+    try {
+      const { frameTree } = await this.reader.send('Page.getFrameTree', {}, sessionId);
+      const { executionContextId } = await this.reader.send(
+        'Page.createIsolatedWorld',
+        { frameId: frameTree.frame.id, worldName: step.isolatedWorld },
+        sessionId
+      );
+      const read = await this.reader.send(
+        'Runtime.evaluate',
+        {
+          expression: step.expression,
+          contextId: executionContextId,
+          awaitPromise: true,
+          returnByValue: true,
+        },
+        sessionId
+      );
+      return {
+        contextId: executionContextId,
+        value: read.result?.value,
+        url: frameTree.frame.url,
+        ...(read.exceptionDetails ? { exception: true } : {}),
+      };
+    } finally {
+      await outcome(this.reader.send('Target.detachFromTarget', { sessionId }));
+    }
+  }
+
+  async watchPage(step) {
+    if (!this.watch) {
+      const start = this.reader.events.length;
+      const { sessionId } = await this.reader.send('Target.attachToTarget', {
+        targetId: this.pageTarget,
+        flatten: true,
+      });
+      this.watch = { sessionId, start, failed: new Set() };
+      await this.reader.send('Page.enable', {}, sessionId);
+      await this.reader.send('Runtime.enable', {}, sessionId);
+      await this.reader.send('Debugger.enable', {}, sessionId);
+    } else if (step.observer === 'watch') {
+      this.watch.cleared = this.reader.events.length;
+    }
+    if (step.observer === 'fail') {
+      await this.reader.send(
+        'Fetch.enable',
+        { patterns: [{ urlPattern: step.url, requestStage: 'Request' }] },
+        this.watch.sessionId
+      );
+      this.watch.failing = true;
+    }
+    return { watching: true };
+  }
+
+  failWatched() {
+    if (!this.watch?.failing) return;
+    for (const event of this.reader.events.slice(this.watch.start)) {
+      if (
+        event.method !== 'Fetch.requestPaused' ||
+        event.sessionId !== this.watch.sessionId ||
+        this.watch.failed.has(event.params.requestId)
+      )
+        continue;
+      this.watch.failed.add(event.params.requestId);
+      this.pending.push(
+        outcome(
+          this.reader.send(
+            'Fetch.failRequest',
+            { requestId: event.params.requestId, errorReason: 'BlockedByClient' },
+            this.watch.sessionId
+          )
+        )
+      );
+    }
+  }
+
+  watched(c) {
+    if (!this.watch) return 'unwatched';
+    const from = c.afterClear ? (this.watch.cleared ?? this.watch.start) : this.watch.start;
+    const until = c.afterClear ? undefined : this.watch.cleared;
+    return this.reader.events
+      .slice(from, until)
+      .some(
+        (event) =>
+          event.sessionId === this.watch.sessionId &&
+          (c.world !== undefined
+            ? event.method === 'Runtime.executionContextCreated' &&
+              event.params.context.name === c.world &&
+              (c.origin === undefined || event.params.context.origin === c.origin)
+            : event.method === 'Debugger.scriptParsed' && event.params.url === c.script)
+      );
+  }
+
   async settle(settle) {
     const refused = () => (settle.dependsOn ?? []).some((name) => this.refused[name]);
     const skipped = () => {
@@ -1000,7 +1172,12 @@ class Execution {
     if (step.cdp === 'Target.detachFromTarget') await sleep(this.delay);
     if (step.cdp === 'Target.setAutoAttach' && step.params?.autoAttach === false)
       this.cleanupEventStart = this.client.events.length;
-    const params = { ...step.params };
+    let params;
+    try {
+      params = this.referenced({ ...step.params }, sessionId);
+    } catch (error) {
+      return { ok: false, error: { message: error.message } };
+    }
     const session =
       step.session === 'page-or-browser' &&
       supported(['browserSession'], this.options.capabilities) &&
@@ -1136,10 +1313,36 @@ class Execution {
     return false;
   }
 
+  forwardedCheck(name, check, want) {
+    const ledger = this.actor().forwarded;
+    if (!Array.isArray(ledger)) {
+      if (want === undefined) return false;
+      this.incomplete.push(`${name}: forwarding audit unavailable`);
+      return 'incomplete';
+    }
+    const c = expand(check, this.vars);
+    const call = [...ledger]
+      .reverse()
+      .find(
+        (entry) => entry.method === c.forwarded.method && matches(entry, c.forwarded.where ?? {})
+      );
+    if (!call) return false;
+    return matches(call.params ?? {}, c.forwarded.params ?? {});
+  }
+
+  async absenceCheck(check) {
+    const first = await this.check(check);
+    if (first === 'unwatched' || first === 'incomplete') return first;
+    if (first === true) return true;
+    const late = await this.poll(async () => (await this.check(check)) === true, observeMs, false);
+    return !!late;
+  }
+
   async observe(name, check) {
     const want = (this.side === 'control' ? this.vector.control.expected : this.vector.expected)?.[
       name
     ];
+    if (check?.forwarded) return this.forwardedCheck(name, check, want);
     if (
       check?.result &&
       (at(this.calls[check.result], check.path) === 'incomplete' || this.unmeasured(check))
@@ -1157,13 +1360,17 @@ class Execution {
               supported(step.requires, this.options.capabilities)
           )
         : [];
-    if (want !== true || (check?.observer !== 'fixture' && !snapshots.length))
-      return this.check(check);
+    const polled =
+      check?.observer === 'fixture' || check?.world !== undefined || check?.script !== undefined;
+    if (want === false && (check?.world !== undefined || check?.script !== undefined))
+      return this.absenceCheck(check);
+    if (want !== true || (!polled && !snapshots.length)) return this.check(check);
     let seen = false;
     const met = await this.poll(
       async () => {
         if (this.clients.flight?.abandoned) return true;
         seen = await this.check(check);
+        if (seen === 'unwatched' || seen === 'incomplete') return true;
         if (seen !== true && snapshots.length) {
           await this.execute(snapshots, undefined, 'observation');
           if (this.clients.flight?.abandoned) return true;
@@ -1175,6 +1382,7 @@ class Execution {
       false,
       snapshots.length > 0
     );
+    if (seen === 'unwatched' || seen === 'incomplete') return seen;
     if ((!met || this.clients.flight?.abandoned) && snapshots.length) {
       this.incomplete.push(
         `${name}: snapshot evidence not observed within ${this.bound(observeMs)}ms`
@@ -1189,6 +1397,24 @@ class Execution {
     return Boolean(out?.result?.incomplete) && at(out, check.path) === undefined;
   }
 
+  async compoundCheck(c) {
+    if (c.all) {
+      const parts = await Promise.all(c.all.map((item) => this.check(item)));
+      if (parts.includes('unwatched')) return 'unwatched';
+      if (parts.includes('incomplete')) return 'incomplete';
+      return parts.every(Boolean);
+    }
+    if (c.any) {
+      const parts = await Promise.all(c.any.map((item) => this.check(item)));
+      if (parts.includes('unwatched') && !parts.some((part) => part === true)) return 'unwatched';
+      if (parts.includes('incomplete') && !parts.some((part) => part === true)) return 'incomplete';
+      return parts.some((part) => part === true);
+    }
+    const inner = await this.check(c.not);
+    if (inner === 'unwatched' || inner === 'incomplete') return inner;
+    return !inner;
+  }
+
   async check(check) {
     const c = expand(check, this.vars);
     if (!(await this.ready(c))) return false;
@@ -1200,9 +1426,7 @@ class Execution {
       return this.trace.some(
         (entry) => entry.phase === c.executed && (entry.out.ok || entry.refused)
       );
-    if (c.all) return (await Promise.all(c.all.map((item) => this.check(item)))).every(Boolean);
-    if (c.any) return (await Promise.all(c.any.map((item) => this.check(item)))).some(Boolean);
-    if (c.not) return !(await this.check(c.not));
+    if (c.all || c.any || c.not) return this.compoundCheck(c);
     if (c.event) return events.some((e) => e.method === c.event && matches(e, c.where ?? {}));
     if (c.hops || c.beacon || c.served || c.header) return this.requestCheck(c);
     if (c.title !== undefined || c.expression !== undefined) return this.readCheck(c);
@@ -1279,6 +1503,11 @@ class Execution {
     if (c.history) return this.history(c.history);
     if (c.frameBlocked) return this.frameBlocked(c.frameBlocked);
     if (c.pre || c.loaded) return this.attemptCheck(c);
+    if (c.world !== undefined || c.script !== undefined) {
+      const seen = this.watched(c);
+      if (seen === 'unwatched') return 'unwatched';
+      return seen;
+    }
   }
 
   callCheck(c) {
@@ -1398,6 +1627,10 @@ class Execution {
       }
       if (dependencies.some((dep) => this.refused[dep] === true)) continue;
       observed[name] = await this.observe(name, observation.check);
+      if (observed[name] === 'unwatched') {
+        observed[name] = 'incomplete';
+        this.incomplete.push(`${name}: absence watch not installed`);
+      }
       if (exitsClient(this.vector) && dependencies.length && observed[name] === false) {
         observed[name] = 'incomplete';
         this.incomplete.push(`${name}: pre-exit evidence not observed`);
@@ -1476,6 +1709,10 @@ class Execution {
     } finally {
       this.stopped = true;
       await pumping;
+      if (this.watch)
+        await outcome(
+          this.reader.send('Target.detachFromTarget', { sessionId: this.watch.sessionId })
+        );
       for (const session of this.attachSettings.keys())
         await outcome(
           this.client.send(
@@ -1519,6 +1756,9 @@ const observerRequired = (check) => {
 };
 const needsObserver = (vector) =>
   vector.control.via === 'unguarded' ||
+  allSteps([...(vector.setup ?? []), ...(vector.trigger ?? [])]).some(
+    (step) => step.isolatedWorld || step.observer
+  ) ||
   observerRequired(vector.liveCheck) ||
   Object.values(vector.observe ?? {}).some(
     (observation) => observerRequired(observation.check) || observerRequired(observation.eitherWhen)