@ai-ecoverse/slicc-browsers 1.7.1 → 1.7.2

package/README.md

@@ -307,7 +307,13 @@ observations: a missing or failing effect fails the control. Guarded liveness
 requires the exact target URL in the fixture log or a target-origin `/live`
 heartbeat; alternatively a pre-action `/live?tag=...&step=pre&to=...` request and
 an exact-URL block/error from the client or unguarded frame tree. An error for a
-different URL is not evidence. A declared setup refusal can supply liveness only
+different URL is not evidence. `blocked` accepts either `{ url }` for one exact URL
+or `{ anyOf: [url, ...] }` for a nonempty list of exact URLs; each URL can be a
+string or `{ hops, to, index? }`. Both forms allow `session` and `frame`. Redirect
+vectors list every nested hop URL and the final destination because Chromium
+reports the URL intercepted by the guard. A matching block still requires the
+pre-action beacon alongside it; an unrelated error cannot certify the chain.
+A declared setup refusal can supply liveness only
 when its `refusal.match` matched. Transport connectivity and command completion
 alone never prove liveness. Cookie and storage rows seed a canary outside the
 guard and read it back outside the guard; refused writes require unchanged

package/guard-runner.mjs

@@ -245,7 +245,7 @@ class Execution {
   }
 
   async blocked(spec, observer) {
-    const url = address(spec.url);
+    const urls = (spec.anyOf ?? [spec.url]).map(address);
     const events = this.client.events.slice(this.eventStart);
     if (observer === 'client') {
       const requests = new Map(
@@ -259,10 +259,10 @@ class Execution {
             (!spec.frame ||
               event.params.frame.parentId ||
               event.sessionId === this.sessions.child) &&
-            event.params.frame.unreachableUrl === url &&
+            urls.includes(event.params.frame.unreachableUrl) &&
             event.params.frame.url.startsWith('chrome-error://')) ||
           (event.method === 'Network.loadingFailed' &&
-            requests.get(event.params.requestId) === url &&
+            urls.includes(requests.get(event.params.requestId)) &&
             (event.params.blockedReason || event.params.errorText === 'net::ERR_BLOCKED_BY_CLIENT'))
       );
     }
@@ -279,7 +279,8 @@ class Execution {
       const visit = (tree) =>
         Boolean(
           tree &&
-            ((tree.frame.unreachableUrl === url && tree.frame.url.startsWith('chrome-error://')) ||
+            ((urls.includes(tree.frame.unreachableUrl) &&
+              tree.frame.url.startsWith('chrome-error://')) ||
               (tree.childFrames ?? []).some(visit))
         );
       return (
@@ -624,6 +625,7 @@ class Execution {
       );
     if (c.refused || c.reached) return this.callCheck(c);
     if (c.detached) {
+      const events = this.client.events.slice(this.eventStart, this.cleanupEventStart);
       const session = this.sessions[c.detached];
       return (
         Boolean(session) &&
@@ -938,6 +940,27 @@ async function executeRow(job, opts, clients, set, slot, index) {
   return row;
 }
 
+const invalidBlocked = (check) =>
+  Boolean(
+    check?.blocked &&
+      ((check.blocked.url === undefined) === (check.blocked.anyOf === undefined) ||
+        (check.blocked.anyOf !== undefined &&
+          (!Array.isArray(check.blocked.anyOf) || check.blocked.anyOf.length === 0)))
+  ) ||
+  [...(check?.all ?? []), ...(check?.any ?? []), ...(check?.not ? [check.not] : [])].some(
+    invalidBlocked
+  );
+
+function validateBlocked(vectors) {
+  for (const vector of vectors)
+    if (
+      [vector.liveCheck, ...Object.values(vector.observe ?? {}).map((o) => o.check)].some(
+        invalidBlocked
+      )
+    )
+      throw new TypeError(`${vector.id}: blocked needs exactly one url or nonempty anyOf`);
+}
+
 function validate(set, opts) {
   if (!opts.fixture?.log) throw new TypeError('fixture.log is required');
   for (const vector of set.vectors)
@@ -954,6 +977,7 @@ function validate(set, opts) {
   for (const vector of set.vectors)
     if (vector.kind === 'cdp' && invalidLive(vector.liveCheck))
       throw new TypeError(`${vector.id}: liveCheck needs guarded attempt evidence`);
+  validateBlocked(set.vectors);
   const variants = Array.isArray(opts.variant) ? opts.variant : [opts.variant];
   for (const name of variants)
     if (!(name in set.variants)) throw new TypeError(`Unknown variant: ${name}`);