@ai-ecoverse/slicc-browsers 1.7.12 → 1.8.1

package/README.md

@@ -94,7 +94,7 @@ Every feature builds for `wasm32-wasip1`.
   - `discardExceptions`: where the site pattern and the extra origins' hosts go, as a `list` of strings or as a `chrome-time-map`, a map from site to the time it was added (microseconds since 1601-01-01 UTC, as a decimal string);
   - `cleanExit`: values that mark the last exit clean;
   - `form` says where a key comes from: `six` (SLICC six's keys) or `chrome-154` (what Chrome 154 reads).
-- `protectedOrigins`: what browser control must never reach, see [Protected origins](#protected-origins). `domains` (`sliccy.ai`), `hosts` (`vault.sliccy.ai`), `schemes` (`https`, `http`), `innerSchemes` (`blob`, `filesystem`, `view-source`), `anySchemes` (`devtools`), `inheriting` (`about:blank`, `about:srcdoc`), and `refusal`, the text of a refusal.
+- `protectedOrigins`: what browser control must never reach, see [Protected origins](#protected-origins). `domains` (`sliccy.ai`), `hosts` (`vault.sliccy.ai`), `schemes` (`https`, `http`), `innerSchemes` (`blob`, `filesystem`, `view-source`), `anySchemes` (`devtools`), `protectedSchemes` (`chrome`, `chrome-untrusted`, `chrome-extension`, `devtools`, `edge`, `brave`, `opera`, `vivaldi`, `arc`, `file`) with `schemeExceptions` (`chrome://newtab`, `edge://newtab`, `brave://newtab`, `opera://startpage`), `aboutScheme` (`chrome`), `targetTypes` (`browser_ui`), `inheriting` (`about:blank`, `about:srcdoc`), and `refusal`, the text of a refusal.
 - `profiles`: SLICC profiles live in `<config dir>/<root>/<name>`, and a snap's in `~/snap/<snap>/common/<snapRoot>/<name>`. `legacyRoot` is the old root, never scanned; on macOS's case-insensitive volume it is SLICC six's root too. `sixProfilePattern` matches six's profile names, case-insensitively. `namePattern` is a valid profile name. `six` describes SLICC six's Chrome profiles (see [SLICC six's profiles](#slicc-sixs-profiles)):
   - `roots`: six's profile root per OS (`macos`, `linux`, `windows`), a `base` location followed by the `path` segments. The base is its `env` when that is set and not empty (any value, as six takes it), else `home` under the home dir.
   - `defaultName` (`browser-coding-agent-chrome`), `defaultPort` (5710) and `portSuffix` (`-{port}`): six's profile for its serve port `<port>` is `<root>/<defaultName>`, with `portSuffix` added for any port other than `defaultPort`.
@@ -109,14 +109,20 @@ Browser control must never navigate to, open or attach to a target on seven's ow
 **URLs.** A URL is parsed the way the WHATWG URL Standard (and so the browser) parses it, so `https:\\seven.sliccy.ai`, a tab or newline inside the URL, `%2E`, `。` and full-width letters all reach seven. In Go and Rust that takes a WHATWG parser, not `net/url`. A URL that doesn't parse isn't protected; the browser doesn't load it either. Then:
 1. While its scheme is one of `innerSchemes`, the rest of the URL after `<scheme>:` takes its place, at most 8 times: `blob:https://seven.sliccy.ai/<uuid>` is `https://seven.sliccy.ai/<uuid>`.
 2. A scheme in `anySchemes` is protected whatever follows: a DevTools front end (`devtools://`) can be inspecting seven.
-3. A scheme in `schemes` is protected when its host is one of `hosts`, or one of `domains` or under one, at any depth and on any port. The host is lower-cased, and one trailing dot is dropped.
-4. Any other URL is protected when its origin is one of the program's **extra origins**: the seven origins it accepts besides `sliccy.ai` (slicc-cli's `--origin` and `--page` origins), compared as `scheme://host[:port]` without the scheme's default port, with the host as in 3.
+3. A scheme in `protectedSchemes` is protected like seven, whatever follows, except the `scheme://host` pairs in `schemeExceptions` (the new tab pages), on any path:
+   - Chrome's privileged UI (`chrome://settings`, `chrome://password-manager`, `chrome-untrusted://…`, `devtools://`) and the same UI in the catalog's other Chromium browsers (`edge://settings/passwords`, `edge://wallet`, `brave://`, `opera://`, `vivaldi://`, `arc://`), since a client attaches to whatever browser answers;
+   - `chrome-extension://`, every page, frame and extension target of every type: password-manager and wallet extensions keep secrets there. There are no default exceptions. Seven's own extension origin is already covered as a seven origin. If a guard ever needs an exception, it is a catalog entry by extension id with a reason, never a default;
+   - `file://`: otherwise a tool could open `~/.ssh` or `~/.aws/credentials` in the real browser, around slicc's file-system fence. Adopters whose tests open local HTML through the guarded client move those fixtures to a local http server.
+
+   An `about:` URL other than `inheriting` is first rewritten the way Chromium rewrites it, to `aboutScheme://<path>`: `about:settings` is `chrome://settings` and protected, `about:newtab` is `chrome://newtab`, and `about:blank` stays unprotected. A wrapper is judged by what it wraps (rule 1): `view-source:chrome://settings/` and `view-source:file:///…` are protected, and `blob:` and `filesystem:` URLs by their creator's origin.
+4. A scheme in `schemes` is protected when its host is one of `hosts`, or one of `domains` or under one, at any depth and on any port. The host is lower-cased, and one trailing dot is dropped.
+5. Any other URL is protected when its origin is one of the program's **extra origins**: the seven origins it accepts besides `sliccy.ai` (slicc-cli's `--origin` and `--page` origins), compared as `scheme://host[:port]` without the scheme's default port, with the host as in 3.
 
 This is wider than the rule for finding seven (`seven.originHostPattern`, which leaves out the `excludedLabels` and `excludedLabelPrefixes`—`www`, `vault`, `vault-preview`, `get`, `mcpcat`, `echo`, and any `vault-*` prefix). Every `sliccy.ai` host shares the `sliccy.ai` cookies, and cookies ignore the port and, without `Secure`, the scheme. SLICC six lives on `www.sliccy.ai` and the apex, and its cookies matter. `*.kernel.localhost` is not protected: each port is its own origin, and the agent's own servers live there. An extra origin is matched exactly, so `http://127.0.0.1:5710` doesn't protect `http://127.0.0.1:5711`.
 
 **The vault.** `vault.sliccy.ai` is in `hosts` by name, and vault branch previews (`vault-preview.sliccy.ai`, `vault-*.sliccy.ai`) are covered by the `sliccy.ai` domain rule. `sliccy.ai` already covers them all, but vault must stay protected even if `domains` ever changes: the vault must never be a CDP target for agent tools. The one exception is slicc-cli's own pairing attach for the vault, which is the CLI's own connection and not browser control handed to the agent.
 
-**Targets.** A target's effective origin is its URL's (`TargetInfo.url`), except when the URL inherits the origin of whoever made the document: the empty URL, and `inheriting` with any query or fragment. Such a target is protected when it was protected before this URL (a seven tab that went to `about:blank` keeps seven's origin), or when its opener (`openerId`, else `openerFrameId`) is protected or unknown, for an opener closed before the program saw it. The URL, `openerFrameId` and `browserContextId` alone can't tell: a blank popup that seven opens has seven's origin and the URL `about:blank`. A program that holds a session to the target also has the document's real origin: the main frame's `securityOrigin` in `Page.frameNavigated`, and the default context's `origin` in `Runtime.executionContextCreated`. When one of those is protected, the target is protected too, until a URL with an origin of its own replaces it.
+**Targets.** A target whose `TargetInfo.type` is one of `targetTypes` (`browser_ui`, Chrome's own UI such as `chrome://omnibox-popup.top-chrome/`) is always protected, whatever its URL. Otherwise a target's effective origin is its URL's (`TargetInfo.url`), except when the URL inherits the origin of whoever made the document: the empty URL, and `inheriting` with any query or fragment. Such a target is protected when it was protected before this URL (a seven tab that went to `about:blank` keeps seven's origin), or when its opener (`openerId`, else `openerFrameId`) is protected or unknown, for an opener closed before the program saw it. The URL, `openerFrameId` and `browserContextId` alone can't tell: a blank popup that seven opens has seven's origin and the URL `about:blank`. A program that holds a session to the target also has the document's real origin: the main frame's `securityOrigin` in `Page.frameNavigated`, and the default context's `origin` in `Runtime.executionContextCreated`. When one of those is protected, the target is protected too, until a URL with an origin of its own replaces it.
 
 A same-site frame shares its parent's process and has no target of its own. Every `sliccy.ai` host is protected, and site isolation gives a seven frame inside any other site its own target, so this only matters for an extra origin whose site has other origins (another port of `127.0.0.1`, say).
 
@@ -126,7 +132,7 @@ A same-site frame shares its parent's process and has no target of its own. Ever
 
 **Refusals** carry the text in `refusal`, `slicc: refused: target is on seven's origin`.
 
-**`protected.json`** (schema `schema/protected.schema.json`): `origins`, the extra origins every vector runs with; `urls` (`url`, `protected`); `targets` (`url`, `previous?`, whether the target was protected before; `opener?`, `protected`, `unprotected` or `unknown`, and no `opener` for a target without one; `protected`); `cookieDomains` (`domain`, `protected`); `storageKeys` (`key`, `protected`). `npm run validate` runs every vector through `protected.mjs`, and no vector uses a port from 9222 to 9229.
+**`protected.json`** (schema `schema/protected.schema.json`): `origins`, the extra origins every vector runs with; `urls` (`url`, `protected`); `targets` (`url`, `type?`, the target's `TargetInfo.type`; `previous?`, whether the target was protected before; `opener?`, `protected`, `unprotected` or `unknown`, and no `opener` for a target without one; `protected`); `cookieDomains` (`domain`, `protected`); `storageKeys` (`key`, `protected`). `npm run validate` runs every vector through `protected.mjs`, and no vector uses a port from 9222 to 9229.
 
 ## Guard vectors
 
@@ -134,12 +140,13 @@ Every CDP guard runs the vectors in `guard-vectors.json` (schema `schema/guard-v
 - slicc-cli's `protectVectors` at `2d5d981` (`test/integration/testdata/link/protect.js`), with the ids kept, and at `fe33052` for `C3.redirect-popup-stays-out` and `C3.direct-popup-stays-out`: a popup opened straight onto, or through a redirect chain to, a protected origin never reaches the client, not at open and not after the page later navigates itself and auto-attach runs again;
 - slicc-cdp's `test/integration/guard-vectors.json` at `4907a45`, where its `E1`, `E2`, `E3`, `E5` and `B2` are renamed `E1.onload`, `E2.binding`, `E3.bypass-csp`, `E5.console` and `B2.headers`;
 - the cert lane's E and B rows;
-- `C5.continue-request` and `C5.continue-response`, added next to `C5.document`.
+- `C5.continue-request` and `C5.continue-response`, added next to `C5.document`;
+- the `C8` rows for privileged pages: `C8.navigate` (a page navigates to `chrome://settings`, `chrome://password-manager`, an extension page or `file:///`; refused), `C8.view-source` (the same through `view-source:`; refused), `C8.create` (`Target.createTarget` straight on those pages; refused), `C8.browser-ui-listed` (`Target.getTargets` lists no `browser_ui` target) and `C8.browser-ui-attach` (`Target.attachToTarget` by a `browser_ui` target's id; refused). All four have an unguarded control, since the guard refuses them only on the privileged target. Two cases aren't rows, because Chrome itself blocks them, so an unguarded client can't tell a guard from none: a page's `window.open('chrome://settings')`, and an `about:` alias such as `about:settings`, which `Page.navigate` and `Target.createTarget` both turn into `about:blank#blocked`. The `about:` aliases are in `protected.json` instead.
 
 **Top level.**
 - `schemaVersion` (1): guards pin it.
 - `setVersion`: the package version. The release flow stamps it into the npm package and the crate (`scripts/set-crate-version.mjs`). In git, and so in the Go module, it reads `0.0.0`; Go code gets the version from the module.
-- `targets`: the names a runner maps to a scheme, host and port: `seven`, `vault`, `vault-x` (a vault branch preview), `apex`, `own` (the client page's origin, `{client}`), `ordinary` and `ordinary-same-site`. Each has a `description` and, for the protected ones, a default `host`. Nothing in the file is a URL a runner must use.
+- `targets`: the names a runner maps to a scheme, host and port: `seven`, `vault`, `vault-x` (a vault branch preview), `apex`, `own` (the client page's origin, `{client}`), `ordinary`, `ordinary-same-site`, `chrome-settings`, `chrome-passwords`, `chrome-extension-page` and `file-root`. Each has a `description` and, for the protected ones, a default `host`. `chrome-settings` (`chrome://settings/`), `chrome-passwords` (`chrome://password-manager/`), `chrome-extension-page` (a page of Chrome's built-in PDF viewer extension) and `file-root` (`file:///`) carry a `url`, which the runner uses unless `targets` maps the name to something else. No other URL in the file is one a runner must use.
 - `variants`: the detach variants in ms. `prompt` and `lagging` are documented; a runner may add others, such as `lagging-8s`, and reports the name it ran.
 - `capabilities`: what a transport may lack. `autoAttach` covers `Target.setAutoAttach`, `children` steps and child sessions; `browserSession` covers calls on the browser session; `browserContexts` covers `Target.createBrowserContext` and `Target.disposeBrowserContext`.
 - `placeholders`: every `{name}` used in the vectors, with what it stands for. `{client}` is the client page's origin, which the runner maps.
@@ -272,7 +279,13 @@ otherwise they run serially. `capabilities` is an object of booleans or an array
 of supported names. `capabilities.scope` selects owner-specific rows.
 
 Map `ordinary`, `ordinary-same-site`, `seven`, `vault`, `vault-x`, `apex`, `own`
-and `client` to origins. Optionally map `plain`, `cross` and `log`; their defaults
+and `client` to origins. `chrome-settings`, `chrome-passwords`, `chrome-extension-page` and `file-root` default to their `url`.
+`{browserUi}` is the id of one of Chrome's own `browser_ui` targets, which the runner looks up through
+its unguarded observer (or the client) before the row; a row that uses it fails when there is none.
+A vector with `"defaultContext": true` runs in the browser's default context even with the
+`browserContexts` capability: navigating a page in a created browser context to `chrome://settings`
+closes Chrome's DevTools connection (Chrome for Testing 156), so `C8.navigate` stays in the default
+context. Optionally map `plain`, `cross` and `log`; their defaults
 are `ordinary`, `client` and `ordinary`. Origins must preserve the site
 relationships of the data. Map an unavailable target to `null`, or leave it out; a
 missing or `undefined` origin is treated exactly like `null`: every
@@ -287,7 +300,9 @@ every alternative of an `any`, or a required (`all`, `not` or plain) check, need
 selects one variant or an array; omission selects all. `parallel` defaults to 1.
 With the `browserContexts` capability each leg runs in its own browser context. A `Target.createBrowserContext` that fails with a timeout is retried once, and the row's `notes` records it; any other failure fails the row.
 
-`settleScale` (default 1) multiplies every bound the runner waits on: settles (beacon, served, title and load), `paused`, page and child loads, the wait for a background step's `as` result (`<as> did not complete within <ms>ms`), and the wait for an observation. Adopters on slow hosts can set 3 or 4. Every wait polls and returns as soon as its event arrives, so a larger bound only costs time when something is really missing, and each timeout error names the bound it used. An observation read from the fixture (`observer: "fixture"`, such as a beacon or a served request) that the leg expects to be `true` is polled for up to 5000 ms (scaled) instead of read once. One that the leg expects to be `false` is still read once.
+`settleScale` (default 1) multiplies the bounds of waits for events the leg expects to happen: settles (beacon, served, title and load) on the control leg and `required` settles on either leg, `paused` on the control leg, page and child loads, the wait for a background step's `as` result (`<as> did not complete within <ms>ms`), and the wait for an observation the leg expects to be `true`. Adopters on slow hosts can set 3 or 4. Every wait polls and returns as soon as its event arrives, so a larger bound only costs time when something is really missing, and each timeout error names the bound it used. An observation read from the fixture (`observer: "fixture"`, such as a beacon or a served request) that the leg expects to be `true` is polled for up to 5000 ms (scaled) instead of read once. One that the leg expects to be `false` is still read once.
+
+`refusalScale` (default 1) multiplies the bounds of waits for what the guarded leg expects to be absent, the beacon, request, title or navigation that the guard should block: settles that are not `required`, and `paused`, on the guarded leg. Such a wait runs to its full bound whenever the guard works, so `settleScale` leaves it alone. The trade-off: a larger `refusalScale` gives more sensitivity to a leak that arrives late on a slow host, because the observations after the wait see it, at the cost of that much more time per guarded row. Adopters should keep `refusalScale` at 1 or higher, never below 1; the runner refuses a `refusalScale` below 1 with `refusalScale must be a number of at least 1`.
 
 `onStart(row)` receives each row's `id`, `target`, `variant`, `transport` and `via` as the row starts. `run()` returns a promise that also has `inFlight()`, and its result has `inFlight` too. `inFlight()` lists the rows that are running now, each as `{ id, target, variant, leg, phase, step, clients }`, where `step` is the index of the current step in its `phase` (`setup`, `trigger` or `child`), and `clients` lists each client's pending CDP calls as `{ method, session, ageMs }` (`client`, plus `unguarded` when it is a separate client). With `rowTimeoutMs`, a row still running after that many milliseconds fails on its own. Its `errors` hold `row timed out after <ms>ms: <the in-flight view>`, `inFlight` holds the view, and the clients that `clientFactory` made for it are closed. The run then goes on to the next row. It is off by default, and a client passed as `client` is never closed.
 
@@ -515,7 +530,7 @@ for case in corpus().cases {
 Go 1.26, Rust stable with `wasm32-wasip1`, Node ≥ 24.
 - `npm run corpus` regenerates `corpus.json` from `corpus/`; the pre-commit hook and CI fail when it's stale.
 - `npm run validate` checks `catalog.json`, `corpus.json`, `protected.json` and `guard-vectors.json` against the schemas, runs the protected-origin vectors through `protected.mjs`, and checks what a schema can't say: unique ids, bundle ids and names, known Windows roots, rising tiers, compiling patterns, known tokens, tier order, `sevenOpen`, `tabs` (which holds no entry of `sevenTabs`), `six` and `auto` in each `expected.json`, and no port from 9222 to 9229.
-- Every gate prints one verdict line when it passes: `validate: PASS …`, `corpus: PASS <n> cases` (`node scripts/corpus.mjs --check`), `major-guard: PASS v<version> fits <module>`, and `guard-sweep: PASS 5 targets` (`npm run test:guard-sweep`). CI runs each through `scripts/gate.mjs --expect <regex> -- <command>`, which fails when the command exits non-zero or prints no matching line, so a silent or early exit never reads as a pass. `gate.mjs --expect <regex> --in <file>` checks a log instead; the release job uses it on semantic-release's log for the major-guard line. `npm run test:gates` tests the gates, including runs through a symlinked checkout and a symlinked script.
+- Every gate prints one verdict line when it passes: `validate: PASS …`, `corpus: PASS <n> cases` (`node scripts/corpus.mjs --check`), `major-guard: PASS v<version> fits <module>`, and `guard-sweep: PASS 9 targets` (`npm run test:guard-sweep`). CI runs each through `scripts/gate.mjs --expect <regex> -- <command>`, which fails when the command exits non-zero or prints no matching line, so a silent or early exit never reads as a pass. `gate.mjs --expect <regex> --in <file>` checks a log instead; the release job uses it on semantic-release's log for the major-guard line. `npm run test:gates` tests the gates, including runs through a symlinked checkout and a symlinked script.
 - `npm run lint`: the slicc lint tools (Biome, no comments, no unit tests in git, `AGENTS.md`), `gofmt`, `go mod tidy -diff`, `go vet`, golangci-lint, `cargo fmt --check` and clippy.
 - `npm test`: `validate`, the Go tests in `test/integration/`, and `cargo test --all-features`.
 - `npm run build`: the Go module, the crate (also for `wasm32-wasip1`), and `npm pack --dry-run`.

package/catalog.json

@@ -708,6 +708,21 @@
     "schemes": ["https", "http"],
     "innerSchemes": ["blob", "filesystem", "view-source"],
     "anySchemes": ["devtools"],
+    "protectedSchemes": [
+      "chrome",
+      "chrome-untrusted",
+      "chrome-extension",
+      "devtools",
+      "edge",
+      "brave",
+      "opera",
+      "vivaldi",
+      "arc",
+      "file"
+    ],
+    "schemeExceptions": ["chrome://newtab", "edge://newtab", "brave://newtab", "opera://startpage"],
+    "aboutScheme": "chrome",
+    "targetTypes": ["browser_ui"],
     "inheriting": ["about:blank", "about:srcdoc"],
     "refusal": "slicc: refused: target is on seven's origin"
   },

package/guard-runner.mjs

@@ -117,6 +117,7 @@ class Execution {
       (step) => step.children && step.where
     );
     this.scale = options.settleScale ?? 1;
+    this.refusalScale = options.refusalScale ?? 1;
     this.childRuns = new Map();
     this.named = new Map();
     this.processed = new Set();
@@ -169,12 +170,12 @@ class Execution {
     return out;
   }
 
-  bound(ms) {
-    return Math.round(ms * this.scale);
+  bound(ms, absent = false) {
+    return Math.round(ms * (absent ? this.refusalScale : this.scale));
   }
 
-  async poll(predicate, ms = 1500) {
-    const deadline = Date.now() + this.bound(ms);
+  async poll(predicate, ms = 1500, absent = false) {
+    const deadline = Date.now() + this.bound(ms, absent);
     do {
       if (await predicate()) return true;
       await sleep(25);
@@ -408,7 +409,13 @@ class Execution {
   }
 
   async seed() {
-    if (supported(['browserContexts'], this.options.capabilities)) {
+    if (JSON.stringify([this.vector.setup, this.vector.trigger]).includes('{browserUi}')) {
+      const listed = await (this.reader ?? this.client).send('Target.getTargets', {});
+      const ui = listed.targetInfos?.find((info) => info.type === 'browser_ui');
+      if (!ui) throw new Error('no browser_ui target to use as {browserUi}');
+      this.vars.browserUi = ui.targetId;
+    }
+    if (supported(['browserContexts'], this.options.capabilities) && !this.vector.defaultContext) {
       const browserContextId = await this.createContext();
       this.vars.context = browserContextId;
       this.contexts.push(browserContextId);
@@ -518,7 +525,7 @@ class Execution {
             event.params?.request?.url === url &&
             this.rule(event)?.url === url
         );
-    if (!(await this.poll(seen, ms)) && this.side === 'control')
+    if (!(await this.poll(seen, ms, this.side === 'guarded')) && this.side === 'control')
       this.errors.push(`paused: no pause for ${url} within ${this.bound(ms)}ms`);
   }
 
@@ -654,13 +661,14 @@ class Execution {
       );
     };
     const alt = settle.or;
+    const absent = this.side === 'guarded' && !settle.required;
     if (refused() && !alt) return skipped();
     if (settle.variant) await sleep(this.delay);
     if (settle.title && !this.reader) {
-      await sleep(this.bound(settle.ms ?? 1500));
+      await sleep(this.bound(settle.ms ?? 1500, absent));
       return;
     }
-    const met = await this.poll(async () => {
+    const arrived = async () => {
       if (refused()) return !alt || (await this.check(alt));
       if (settle.served) return this.requestCheck({ served: settle.served, tagged: false });
       if (settle.beacon)
@@ -679,7 +687,8 @@ class Execution {
             .slice(index + 1)
             .some((e) => e.method === 'Page.loadEventFired' && e.sessionId === event.sessionId)
       );
-    }, settle.ms ?? 1500);
+    };
+    const met = await this.poll(arrived, settle.ms ?? 1500, absent);
     if (refused() && !alt) return skipped();
     if (settle.required && !met)
       this.errors.push(
@@ -731,6 +740,8 @@ class Execution {
       if (params.autoAttach) this.attachSettings.set(session, true);
       else this.attachSettings.delete(session);
     }
+    if (step.cdp === 'Target.createTarget' && out.ok && out.result?.targetId)
+      this.targets.push(out.result.targetId);
     if (step.cdp === 'Target.createBrowserContext' && out.ok) {
       this.vars.context = out.result.browserContextId;
       this.contexts.push(this.vars.context);
@@ -1411,13 +1422,22 @@ function validateBlocked(vectors) {
       throw new TypeError(`${vector.id}: blocked needs exactly one url or nonempty anyOf`);
 }
 
-function validate(set, opts) {
-  if (!opts.fixture?.log) throw new TypeError('fixture.log is required');
+function validateScales(opts) {
   if (
     opts.settleScale !== undefined &&
     !(Number.isFinite(opts.settleScale) && opts.settleScale > 0)
   )
     throw new TypeError('settleScale must be a positive number');
+  if (
+    opts.refusalScale !== undefined &&
+    !(Number.isFinite(opts.refusalScale) && opts.refusalScale >= 1)
+  )
+    throw new TypeError('refusalScale must be a number of at least 1');
+}
+
+function validate(set, opts) {
+  if (!opts.fixture?.log) throw new TypeError('fixture.log is required');
+  validateScales(opts);
   for (const vector of set.vectors)
     for (const [name, observation] of Object.entries(vector.observe ?? {}))
       if (!observation.check) throw new TypeError(`${vector.id}: ${name} lacks a check`);
@@ -1452,6 +1472,14 @@ export function run(set, options) {
 
 async function runAll(set, options, flights) {
   const opts = { capabilities: {}, variant: Object.keys(set.variants), parallel: 1, ...options };
+  opts.targets = {
+    ...Object.fromEntries(
+      Object.entries(set.targets ?? {})
+        .filter(([, target]) => typeof target?.url === 'string')
+        .map(([name, target]) => [name, target.url])
+    ),
+    ...opts.targets,
+  };
   const variants = validate(set, opts);
   const jobs = set.vectors.flatMap((vector) =>
     vector.targets.flatMap((target) => variants.map((variant) => ({ vector, target, variant })))

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.7.12",
+  "setVersion": "1.8.1",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -48,6 +48,22 @@
     },
     "ordinary-same-site": {
       "description": "an unprotected origin same-site with the target"
+    },
+    "chrome-settings": {
+      "url": "chrome://settings/",
+      "description": "Chrome's settings page, a privileged chrome: page"
+    },
+    "chrome-passwords": {
+      "url": "chrome://password-manager/",
+      "description": "Chrome's password manager, a privileged chrome: page"
+    },
+    "chrome-extension-page": {
+      "url": "chrome-extension://mhjfbmdgcfjbbpaeojofohoefgiehjai/index.html",
+      "description": "a page of Chrome's built-in PDF viewer extension, standing in for any extension page"
+    },
+    "file-root": {
+      "url": "file:///",
+      "description": "the local file system's root, standing in for any file: page"
     }
   },
   "variants": {
@@ -79,7 +95,8 @@
     "beacon": "guard-driver.mjs beacon({log}, {tag})",
     "probe": "guard-driver.mjs probe({log}, {tag})",
     "pageTarget": "the current page target id",
-    "responseOrigin": "the fixture response CORS origin"
+    "responseOrigin": "the fixture response CORS origin",
+    "browserUi": "the id of one of Chrome's own browser_ui targets, which the runner looks up with its own CDP"
   },
   "vectors": [
     {
@@ -12339,6 +12356,399 @@
         "expected": "the same setup and trigger against a plain, unprotected test origin must SUCCEED."
       },
       "expected": "as each vector"
+    },
+    {
+      "id": "C8.navigate",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "defaultContext": true,
+      "setup": [
+        {
+          "text": "a plain tab navigates itself to a privileged chrome:, extension or file: page"
+        },
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n={tag}"
+        },
+        {
+          "cdp": "Page.enable"
+        }
+      ],
+      "trigger": [
+        {
+          "cdp": "Page.navigate",
+          "params": {
+            "url": "{target}"
+          },
+          "as": "nav",
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
+        },
+        {
+          "settle": {
+            "ms": 2000
+          }
+        }
+      ],
+      "targets": ["chrome-settings", "chrome-passwords", "chrome-extension-page", "file-root"],
+      "observe": {
+        "navigated": {
+          "means": "the page committed {target}",
+          "dependsOn": ["nav"],
+          "check": {
+            "attached": "{target}",
+            "observer": "client"
+          }
+        },
+        "refused": {
+          "means": "the navigation was refused",
+          "dependsOn": [],
+          "check": {
+            "refused": ["nav"],
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the guard returned its refusal for the step, or the runner's own CDP sees the effect",
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "navigated": true,
+          "refused": false
+        }
+      },
+      "expected": {
+        "navigated": false,
+        "refused": true
+      },
+      "liveCheck": {
+        "any": [
+          {
+            "refused": ["nav"],
+            "observer": "client"
+          },
+          {
+            "attached": "{target}",
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      }
+    },
+    {
+      "id": "C8.view-source",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "defaultContext": true,
+      "setup": [
+        {
+          "text": "a plain tab navigates itself to view-source: of a privileged page"
+        },
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n={tag}"
+        },
+        {
+          "cdp": "Page.enable"
+        }
+      ],
+      "trigger": [
+        {
+          "cdp": "Page.navigate",
+          "params": {
+            "url": "view-source:{target}"
+          },
+          "as": "nav",
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
+        },
+        {
+          "settle": {
+            "ms": 2000
+          }
+        }
+      ],
+      "targets": ["chrome-settings", "chrome-extension-page", "file-root"],
+      "observe": {
+        "navigated": {
+          "means": "the page committed view-source: of {target}",
+          "dependsOn": ["nav"],
+          "check": {
+            "attached": "{target}",
+            "observer": "client"
+          }
+        },
+        "refused": {
+          "means": "the navigation was refused",
+          "dependsOn": [],
+          "check": {
+            "refused": ["nav"],
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the guard returned its refusal for the step, or the runner's own CDP sees the effect",
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "navigated": true,
+          "refused": false
+        }
+      },
+      "expected": {
+        "navigated": false,
+        "refused": true
+      },
+      "liveCheck": {
+        "any": [
+          {
+            "refused": ["nav"],
+            "observer": "client"
+          },
+          {
+            "attached": "{target}",
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      }
+    },
+    {
+      "id": "C8.create",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "text": "the client opens a new tab straight on a privileged chrome: page"
+        }
+      ],
+      "trigger": [
+        {
+          "cdp": "Target.createTarget",
+          "params": {
+            "url": "{target}"
+          },
+          "session": "browser",
+          "as": "created",
+          "requires": ["browserSession"],
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
+        },
+        {
+          "settle": {
+            "ms": 1500
+          }
+        }
+      ],
+      "targets": ["chrome-settings", "chrome-passwords"],
+      "requires": ["browserSession"],
+      "observe": {
+        "opened": {
+          "means": "Target.createTarget returned a target",
+          "dependsOn": ["created"],
+          "check": {
+            "result": "created",
+            "path": "result.targetId",
+            "equals": {
+              "$regex": "."
+            },
+            "observer": "client"
+          }
+        },
+        "refused": {
+          "means": "Target.createTarget was refused",
+          "dependsOn": [],
+          "check": {
+            "refused": ["created"],
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the guard returned its refusal for the step, or the runner's own CDP sees the effect",
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "opened": true,
+          "refused": false
+        }
+      },
+      "expected": {
+        "opened": false,
+        "refused": true
+      },
+      "liveCheck": {
+        "any": [
+          {
+            "refused": ["created"],
+            "observer": "client"
+          },
+          {
+            "result": "created",
+            "path": "ok",
+            "equals": true,
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      }
+    },
+    {
+      "id": "C8.browser-ui-listed",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "text": "the client lists the browser's targets; Chrome's own browser_ui targets are among them"
+        }
+      ],
+      "trigger": [
+        {
+          "cdp": "Target.getTargets",
+          "session": "browser",
+          "as": "targets",
+          "requires": ["browserSession"],
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
+        }
+      ],
+      "targets": ["chrome-settings"],
+      "requires": ["browserSession"],
+      "observe": {
+        "listed": {
+          "means": "Target.getTargets lists a browser_ui target",
+          "dependsOn": ["targets"],
+          "check": {
+            "result": "targets",
+            "path": "result.targetInfos",
+            "equals": {
+              "$some": {
+                "type": "browser_ui"
+              }
+            },
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the runner's own CDP lists a browser_ui target",
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "listed": true
+        }
+      },
+      "expected": {
+        "listed": false
+      },
+      "liveCheck": {
+        "any": [
+          {
+            "refused": ["targets"],
+            "observer": "client"
+          },
+          {
+            "result": "targets",
+            "path": "ok",
+            "equals": true,
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      }
+    },
+    {
+      "id": "C8.browser-ui-attach",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "text": "the client attaches to one of Chrome's own browser_ui targets by its id"
+        }
+      ],
+      "trigger": [
+        {
+          "cdp": "Target.attachToTarget",
+          "params": {
+            "targetId": "{browserUi}",
+            "flatten": true
+          },
+          "session": "browser",
+          "as": "attach",
+          "requires": ["browserSession"],
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
+        }
+      ],
+      "targets": ["chrome-settings"],
+      "requires": ["browserSession"],
+      "observe": {
+        "attached": {
+          "means": "Target.attachToTarget returned a session",
+          "dependsOn": ["attach"],
+          "check": {
+            "result": "attach",
+            "path": "result.sessionId",
+            "equals": {
+              "$regex": "."
+            },
+            "observer": "client"
+          }
+        },
+        "refused": {
+          "means": "Target.attachToTarget was refused",
+          "dependsOn": [],
+          "check": {
+            "refused": ["attach"],
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the guard returned its refusal for the step, or the runner's own CDP sees the effect",
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "attached": true,
+          "refused": false
+        }
+      },
+      "expected": {
+        "attached": false,
+        "refused": true
+      },
+      "liveCheck": {
+        "any": [
+          {
+            "refused": ["attach"],
+            "observer": "client"
+          },
+          {
+            "result": "attach",
+            "path": "ok",
+            "equals": true,
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      }
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.7.12",
+  "version": "1.8.1",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,7 +65,7 @@
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish",
     "release": "semantic-release",
     "test:guard": "npm run test:guard-integration && npm run test:guard-sweep",
-    "test:guard-integration": "node --test test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-diagnostics.test.mjs",
+    "test:guard-integration": "node --test test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-scales.test.mjs",
     "test:guard-sweep": "node scripts/test-guards.mjs",
     "test:gates": "node --test test/integration/gates.test.mjs",
     "test:guard-target": "node --test test/integration/guard-runner.test.mjs",

package/protected.json

@@ -284,15 +284,15 @@
     },
     {
       "url": "chrome://version/",
-      "protected": false
+      "protected": true
     },
     {
       "url": "chrome-extension://abcdefghijklmnopabcdefghijklmnop/page.html",
-      "protected": false
+      "protected": true
     },
     {
       "url": "file:///tmp/seven.sliccy.ai/index.html",
-      "protected": false
+      "protected": true
     },
     {
       "url": "",
@@ -321,6 +321,170 @@
     {
       "url": "https://vault-feature-x.sliccy.ai/",
       "protected": true
+    },
+    {
+      "url": "chrome://settings/",
+      "protected": true
+    },
+    {
+      "url": "chrome://settings/passwords",
+      "protected": true
+    },
+    {
+      "url": "chrome://password-manager/passwords",
+      "protected": true
+    },
+    {
+      "url": "CHROME://Settings/",
+      "protected": true
+    },
+    {
+      "url": "chrome://omnibox-popup.top-chrome/",
+      "protected": true
+    },
+    {
+      "url": "chrome-untrusted://print/",
+      "protected": true
+    },
+    {
+      "url": "view-source:chrome://settings/",
+      "protected": true
+    },
+    {
+      "url": "chrome://newtab/",
+      "protected": false
+    },
+    {
+      "url": "chrome://newtab",
+      "protected": false
+    },
+    {
+      "url": "chrome://newtab-x/",
+      "protected": true
+    },
+    {
+      "url": "edge://settings/passwords",
+      "protected": true
+    },
+    {
+      "url": "edge://wallet/",
+      "protected": true
+    },
+    {
+      "url": "EDGE://Settings/",
+      "protected": true
+    },
+    {
+      "url": "brave://settings/",
+      "protected": true
+    },
+    {
+      "url": "brave://wallet/",
+      "protected": true
+    },
+    {
+      "url": "opera://settings/",
+      "protected": true
+    },
+    {
+      "url": "vivaldi://settings/",
+      "protected": true
+    },
+    {
+      "url": "arc://settings/",
+      "protected": true
+    },
+    {
+      "url": "edge://newtab/",
+      "protected": false
+    },
+    {
+      "url": "brave://newtab/",
+      "protected": false
+    },
+    {
+      "url": "opera://startpage/",
+      "protected": false
+    },
+    {
+      "url": "about:settings",
+      "protected": true
+    },
+    {
+      "url": "about:passwords",
+      "protected": true
+    },
+    {
+      "url": "about:password-manager",
+      "protected": true
+    },
+    {
+      "url": "ABOUT:Settings",
+      "protected": true
+    },
+    {
+      "url": "about:version",
+      "protected": true
+    },
+    {
+      "url": "about:newtab",
+      "protected": false
+    },
+    {
+      "url": "about:blank#x",
+      "protected": false
+    },
+    {
+      "url": "about:srcdoc",
+      "protected": false
+    },
+    {
+      "url": "chrome-extension://aeblfdkhhhdcdjpifhhbdiojplfjncoa/popup.html",
+      "protected": true
+    },
+    {
+      "url": "chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/home.html#unlock",
+      "protected": true
+    },
+    {
+      "url": "blob:chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/0b9e0f6c",
+      "protected": true
+    },
+    {
+      "url": "filesystem:chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/temporary/x",
+      "protected": true
+    },
+    {
+      "url": "view-source:chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/home.html",
+      "protected": true
+    },
+    {
+      "url": "file:///etc/passwd",
+      "protected": true
+    },
+    {
+      "url": "file:///Users/me/.ssh/id_ed25519",
+      "protected": true
+    },
+    {
+      "url": "file:///C:/Users/me/.aws/credentials",
+      "protected": true
+    },
+    {
+      "url": "FILE:///",
+      "protected": true
+    },
+    {
+      "url": "view-source:file:///etc/hosts",
+      "protected": true
+    },
+    {
+      "url": "view-source:https://example.test/",
+      "protected": false
+    },
+    {
+      "url": "blob:https://example.test/0b9e0f6c",
+      "protected": false
     }
   ],
   "targets": [
@@ -413,7 +577,7 @@
     {
       "url": "about:version",
       "previous": true,
-      "protected": false
+      "protected": true
     },
     {
       "url": "data:text/html,x",
@@ -436,6 +600,51 @@
       "url": "http://127.0.0.1:5711/index.html",
       "previous": true,
       "protected": false
+    },
+    {
+      "url": "chrome://omnibox-popup.top-chrome/",
+      "type": "browser_ui",
+      "protected": true
+    },
+    {
+      "url": "https://example.test/",
+      "type": "browser_ui",
+      "protected": true
+    },
+    {
+      "url": "chrome://newtab/",
+      "type": "page",
+      "protected": false
+    },
+    {
+      "url": "https://example.test/",
+      "type": "page",
+      "protected": false
+    },
+    {
+      "url": "chrome-extension://aeblfdkhhhdcdjpifhhbdiojplfjncoa/background.js",
+      "type": "service_worker",
+      "protected": true
+    },
+    {
+      "url": "chrome-extension://aeblfdkhhhdcdjpifhhbdiojplfjncoa/background.html",
+      "type": "background_page",
+      "protected": true
+    },
+    {
+      "url": "chrome-extension://aeblfdkhhhdcdjpifhhbdiojplfjncoa/offscreen.html",
+      "type": "other",
+      "protected": true
+    },
+    {
+      "url": "file:///Users/me/notes.html",
+      "type": "page",
+      "protected": true
+    },
+    {
+      "url": "file:///Users/me/frame.html",
+      "type": "iframe",
+      "protected": true
     }
   ],
   "cookieDomains": [

package/protected.mjs

@@ -34,11 +34,19 @@ export function protectedOrigins(rules, extraOrigins = []) {
     return u;
   };
 
+  const alias = (u) => {
+    if (!u || scheme(u) !== 'about' || !rules.aboutScheme) return u;
+    if (rules.inheriting.includes(`about:${u.pathname.toLowerCase()}`)) return u;
+    return parse(`${rules.aboutScheme}://${u.pathname}${u.search}${u.hash}`) ?? u;
+  };
+
   const url = (text) => {
-    const u = unwrap(parse(text));
+    const u = alias(unwrap(parse(text)));
     if (!u) return false;
     const s = scheme(u);
     if (rules.anySchemes.includes(s)) return true;
+    if ((rules.protectedSchemes ?? []).includes(s))
+      return !(rules.schemeExceptions ?? []).includes(`${s}://${hostOf(u)}`);
     if (rules.schemes.includes(s) && rules.hosts.includes(hostOf(u))) return true;
     if (rules.schemes.includes(s) && rules.domains.some((d) => under(hostOf(u), d))) return true;
     const o = originOf(u);
@@ -55,7 +63,8 @@ export function protectedOrigins(rules, extraOrigins = []) {
     );
   };
 
-  const target = ({ url: text, previous = false, opener }) => {
+  const target = ({ url: text, previous = false, opener, type }) => {
+    if (type && (rules.targetTypes ?? []).includes(type)) return true;
     if (inheriting(text)) return previous || opener === 'protected' || opener === 'unknown';
     return url(text);
   };

package/schema/catalog.schema.json

@@ -180,6 +180,10 @@
         "schemes",
         "innerSchemes",
         "anySchemes",
+        "protectedSchemes",
+        "schemeExceptions",
+        "aboutScheme",
+        "targetTypes",
         "inheriting",
         "refusal"
       ],
@@ -204,6 +208,18 @@
         "schemes": { "$ref": "#/$defs/schemes", "type": "array", "minItems": 1 },
         "innerSchemes": { "$ref": "#/$defs/schemes" },
         "anySchemes": { "$ref": "#/$defs/schemes" },
+        "protectedSchemes": { "$ref": "#/$defs/schemes" },
+        "schemeExceptions": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "string", "pattern": "^[a-z][a-z0-9+.-]*://[a-z0-9.-]+$" }
+        },
+        "aboutScheme": { "type": "string", "pattern": "^[a-z][a-z0-9+.-]*$" },
+        "targetTypes": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "string", "pattern": "^[a-z_]+$" }
+        },
         "inheriting": {
           "type": "array",
           "uniqueItems": true,

package/schema/guard-vectors.schema.json

@@ -56,6 +56,10 @@
             "type": "string",
             "pattern": "^[a-z0-9.-]+$"
           },
+          "url": {
+            "type": "string",
+            "pattern": "^[a-z][a-z0-9+.-]*://\\S+$"
+          },
           "description": {
             "type": "string",
             "minLength": 1
@@ -152,7 +156,17 @@
       }
     },
     "target": {
-      "enum": ["seven", "vault", "vault-x", "apex", "own"]
+      "enum": [
+        "seven",
+        "vault",
+        "vault-x",
+        "apex",
+        "own",
+        "chrome-settings",
+        "chrome-passwords",
+        "chrome-extension-page",
+        "file-root"
+      ]
     },
     "expected": {
       "oneOf": [
@@ -266,6 +280,9 @@
             }
           }
         },
+        "defaultContext": {
+          "const": true
+        },
         "designDependent": {
           "type": "array",
           "uniqueItems": true,

package/schema/protected.schema.json

@@ -28,6 +28,7 @@
         "required": ["url", "protected"],
         "properties": {
           "url": { "type": "string" },
+          "type": { "type": "string" },
           "previous": { "type": "boolean" },
           "opener": { "enum": ["protected", "unprotected", "unknown"] },
           "protected": { "type": "boolean" }