@ai-ecoverse/slicc-browsers 1.7.3 → 1.7.5

package/README.md

@@ -87,7 +87,7 @@ Every feature builds for `wasm32-wasip1`.
   - `names`: an endpoint's name when it isn't from a known browser's user-data dir: `electron` when the user agent contains `electronUserAgent`, else `products[<product>]` for the product before the `/` in `/json/version`'s `Browser`, else that product, else `fallback`;
   - `process`: the process scan, see [The process source](#the-process-source).
 - `seven`:
-  - `originScheme` and `originHostPattern`: a seven origin is `https://<host>` with a host matching the pattern, except for the `excludedLabels` (`www`, `vault`, `vault-preview`, `get`, `mcpcat`) and the `excludedLabelPrefixes` (`vault-`, which excludes `vault-feature-x` and any other vault branch preview). The bare apex (`sliccy.ai`, i.e. an empty label) never matches. An origin is compared without the scheme's default port (443 for `https`, 80 for `http`), so `https://seven.sliccy.ai:443` is seven and `https://seven.sliccy.ai:8443` is not. The same goes for extra seven origins;
+  - `originScheme` and `originHostPattern`: a seven origin is `https://<host>` with a host matching the pattern, except for the `excludedLabels` (`www`, `vault`, `vault-preview`, `get`, `mcpcat`, `echo`) and the `excludedLabelPrefixes` (`vault-`, which excludes `vault-feature-x` and any other vault branch preview). The bare apex (`sliccy.ai`, i.e. an empty label) never matches. An origin is compared without the scheme's default port (443 for `https`, 80 for `http`), so `https://seven.sliccy.ai:443` is seven and `https://seven.sliccy.ai:8443` is not. The same goes for extra seven origins;
   - `sitePattern` (`[*.]sliccy.ai`);
   - `switches` and `disabledFeatures`: the seven flags, all `--disable-features` values merged into one switch;
   - `prefs`: values merged into a profile's `Default/Preferences` at the `path` of keys;
@@ -112,7 +112,7 @@ Browser control must never navigate to, open or attach to a target on seven's ow
 3. A scheme in `schemes` is protected when its host is one of `hosts`, or one of `domains` or under one, at any depth and on any port. The host is lower-cased, and one trailing dot is dropped.
 4. Any other URL is protected when its origin is one of the program's **extra origins**: the seven origins it accepts besides `sliccy.ai` (slicc-cli's `--origin` and `--page` origins), compared as `scheme://host[:port]` without the scheme's default port, with the host as in 3.
 
-This is wider than the rule for finding seven (`seven.originHostPattern`, which leaves out the `excludedLabels` and `excludedLabelPrefixes`—`www`, `vault`, `vault-preview`, `get`, `mcpcat`, and any `vault-*` prefix). Every `sliccy.ai` host shares the `sliccy.ai` cookies, and cookies ignore the port and, without `Secure`, the scheme. SLICC six lives on `www.sliccy.ai` and the apex, and its cookies matter. `*.kernel.localhost` is not protected: each port is its own origin, and the agent's own servers live there. An extra origin is matched exactly, so `http://127.0.0.1:5710` doesn't protect `http://127.0.0.1:5711`.
+This is wider than the rule for finding seven (`seven.originHostPattern`, which leaves out the `excludedLabels` and `excludedLabelPrefixes`—`www`, `vault`, `vault-preview`, `get`, `mcpcat`, `echo`, and any `vault-*` prefix). Every `sliccy.ai` host shares the `sliccy.ai` cookies, and cookies ignore the port and, without `Secure`, the scheme. SLICC six lives on `www.sliccy.ai` and the apex, and its cookies matter. `*.kernel.localhost` is not protected: each port is its own origin, and the agent's own servers live there. An extra origin is matched exactly, so `http://127.0.0.1:5710` doesn't protect `http://127.0.0.1:5711`.
 
 **The vault.** `vault.sliccy.ai` is in `hosts` by name, and vault branch previews (`vault-preview.sliccy.ai`, `vault-*.sliccy.ai`) are covered by the `sliccy.ai` domain rule. `sliccy.ai` already covers them all, but vault must stay protected even if `domains` ever changes: the vault must never be a CDP target for agent tools. The one exception is slicc-cli's own pairing attach for the vault, which is the CLI's own connection and not browser control handed to the agent.
 
@@ -150,7 +150,7 @@ Every CDP guard runs the vectors in `guard-vectors.json` (schema `schema/guard-v
 - `scope`: `any`, or the one guard the vector is for;
 - `setup` and `trigger`, both lists of steps;
 - `targets`: the protected targets it runs against;
-- `requires?`: the capabilities it needs, the union of its steps' and observations' `requires`. A runner whose transport lacks one reports the vector as `skip` with the reason `not-supported:<capability>`;
+- `requires?`: the capabilities it needs, the union of its steps' and observations' `requires`. A runner whose transport lacks one reports the vector as `skip` with the reason `not-supported:<capability>`. A row with a `page-or-browser` cookie step that would carry a `browserContextId` reports `not-supported:browserSession` without a browser session, because that parameter is only allowed on the browser target;
 - `observe?`: each observed name, as `{ "means", "dependsOn"?, "requires"?, "eitherWhen"? }`. `dependsOn` lists the refusals the observation depends on (see Refusals). `eitherWhen` is a check: when it holds on the guarded leg, that observation's expectation becomes `"either"` there (see Design-dependent outcomes);
 - `live`: the liveness check;
 - `control` (`origin: "ordinary"`, `via`, `expected`) and `expected`: an object of names and booleans, or text;
@@ -170,7 +170,7 @@ Any `cdp`, `page` or `children` step can take `requires`, the capabilities it ne
   - `eval`: evaluate `expression`.
   `hops` routes `url` through `/hop` on each `origin`, with its `code`.
 - `{ "answer": { "url", "stage"?, "cdp"?, "params"?, "hold"? } }`: answer each paused request or auth challenge for `url` with that call; `hold` leaves it paused. Every other paused request continues unchanged.
-- `{ "children": steps }`: run these steps on each target auto-attached from then on, then resume it.
+- `{ "children": steps, "where"? }`: run these steps on each target auto-attached from then on, then resume it. `where` scopes them to the row's own target: `{ "openerId": "page" }` (opened by the row's page) or `{ "urlPrefix": url }`; other attached targets are resumed and otherwise left alone.
 - `{ "settle": { "beacon"?, "title"?, "ms"?, "variant"?, "session"? } }`: wait for a beacon from `beacon`, for the page `title`, or for the session to detach. It waits up to `ms` (10000 by default), then another 600 ms. `variant` waits the run's detach variant instead.
 - `{ "wait": ms }`.
 - `{ "guess": { "between", "cdp", "params" }, "as" }`: the call for each request id between the ids paused for the two URLs.
@@ -253,7 +253,10 @@ error as `error.cdp`, or an error message. `client` carries the guarded leg;
 `unguarded`, when supplied, carries unguarded controls and observation reads.
 There is no fallback from observer reads to the guarded client. A bare client
 means guarded transport only; rows requiring an observer report
-`skip` with `not-supported:unguarded-observer`, counted in `summary().observerSkipped`.
+`skip` with `not-supported:unguarded-observer`, counted in `summary().observerSkipped`. The run's `summary()` also reports
+`skips`, the number of skipped rows per reason, and appends
+`skips <n> (<reason>=<count>, ...)` to `line` whenever any row was skipped, so a
+certification line never reads skipped rows as coverage.
 `clientFactory({ variant, detachDelay, vector, target, slot })` is called per row
 and may return either a client or `{ client, unguarded, close, transportVariant }`.
 The factory can configure the guard's own transport delay from this metadata;
@@ -270,13 +273,16 @@ of supported names. `capabilities.scope` selects owner-specific rows.
 Map `ordinary`, `ordinary-same-site`, `seven`, `vault`, `vault-x`, `apex`, `own`
 and `client` to origins. Optionally map `plain`, `cross` and `log`; their defaults
 are `ordinary`, `client` and `ordinary`. Origins must preserve the site
-relationships of the data. Explicitly map an unavailable target to `null`: every
+relationships of the data. Map an unavailable target to `null`, or leave it out; a
+missing or `undefined` origin is treated exactly like `null`: every
 row needing that origin is reported as `skip` for control, guarded and live, with
 reason `not-applicable:no-<target>-origin`; no substitute origin is used and the
 row never passes. A guard whose whole site is protected, such as the extension
 where every `sliccy.ai` host is protected, passes `ordinary-same-site: null`.
-This also applies to origins referenced in setup, triggers, observations and
-liveness checks, not only the row target. Tags and cookie names are unique per leg. `variant`
+This also applies to origins referenced in setup and triggers, not only the row
+target. In observations and liveness checks, an `any` alternative that references
+a `null` origin is dropped and the rest are evaluated; the row skips only when
+every alternative of an `any`, or a required (`all`, `not` or plain) check, needs it. Tags and cookie names are unique per leg. `variant`
 selects one variant or an array; omission selects all. `parallel` defaults to 1.
 `log(row)` receives completed rows. A variant supplies the wait before an
 explicit `Target.detachFromTarget` step and for a `settle.variant` step.
@@ -322,7 +328,17 @@ A step that the guard refuses in every context, such as `Network.clearBrowserCoo
 in `C6.clear-cookies`, is refusable, so refusing it on both legs passes and allowing it
 is judged on its effect. A child step that fails after its child session detached is
 recorded as detached, not as a refusal, and the runner awaits a child's started
-`children` steps before any later `session: "child"` step and before the trigger. Redirect
+`children` steps before any later `session: "child"` step and before the trigger. A page
+navigation waits for the load of its own `loaderId` (its `Page.frameNavigated` and then a
+load event), and a settle waits for a main-frame commit followed by its load, so a stale
+load event never ends a wait. After a child's `children` steps that include `Page.enable`,
+the runner waits, bounded at 5 s, for the child's first document to commit and load before
+any later child step. `{ "settle": { "beacon", "required": true, "dependsOn"? } }` waits
+for that beacon at the fixture and fails the row with `settle: no beacon from <origin>
+within <ms>ms` when it never arrives, unless a refusal it `dependsOn` was recorded; the rows
+whose `allowedBeacon` comes from an earlier document settle on it before their trigger.
+Beacons use `navigator.sendBeacon`, with a `fetch(…, { keepalive: true })` fallback. An observation that reads a background step's `as` result
+waits for that step, up to 10 s, and fails with `<as> did not complete within …` past it. Redirect
 vectors list every nested hop URL and the final destination because Chromium
 reports the URL intercepted by the guard. A matching block still requires the
 pre-action beacon alongside it; an unrelated error cannot certify the chain.
@@ -344,7 +360,7 @@ fixture log. A setup beacon on the same origin and tag cannot settle an unfinish
 redirect chain. This does not change the observations used to judge either leg.
 
 The separately exported Node module `@ai-ecoverse/slicc-browsers/fixture` exposes
-`fixtureServer({ host, port, tls })`, defaulting to a random loopback port.
+`fixtureServer({ host, port, tls, latency })`, defaulting to a random loopback port. `latency(url)` returns milliseconds to hold that response, for timing tests.
 Pass `tls: { key, cert }` to serve HTTPS using Node TLS key and certificate
 values. The returned origin, request logs, redirect URLs and document heartbeats
 use `https://<Host>` with TLS, so `served`, `hops` and `liveCheck` compare against

package/catalog.json

@@ -642,7 +642,7 @@
   "seven": {
     "originScheme": "https",
     "originHostPattern": "^([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\\.sliccy\\.ai$",
-    "excludedLabels": ["www", "vault", "vault-preview", "get", "mcpcat"],
+    "excludedLabels": ["www", "vault", "vault-preview", "get", "mcpcat", "echo"],
     "excludedLabelPrefixes": ["vault-"],
     "sitePattern": "[*.]sliccy.ai",
     "switches": [

package/fixture-server.mjs

@@ -76,7 +76,7 @@ function route(req, url, send, html) {
   return send(404, 'missing', 'text/plain');
 }
 
-export async function fixtureServer({ host = '127.0.0.1', port = 0, tls } = {}) {
+export async function fixtureServer({ host = '127.0.0.1', port = 0, tls, latency } = {}) {
   let entries = [];
   const scheme = tls ? 'https' : 'http';
   const handler = (req, res) => {
@@ -105,7 +105,9 @@ export async function fixtureServer({ host = '127.0.0.1', port = 0, tls } = {})
         'text/html',
         headers
       );
-    route(req, url, send, html);
+    const wait = latency?.(url) ?? 0;
+    if (wait > 0) setTimeout(() => route(req, url, send, html), wait);
+    else route(req, url, send, html);
   };
   const server = tls ? createSecureServer(tls, handler) : createServer(handler);
   await new Promise((resolve, reject) => {

package/guard-driver.mjs

@@ -1,7 +1,7 @@
 const q = JSON.stringify;
 
 export const beacon = (log, tag) =>
-  `try { navigator.sendBeacon(${q(log)} + '/beacon?tag=' + ${q(tag)} + '&origin=' + encodeURIComponent(location.origin)); } catch {}`;
+  `try { const u = ${q(log)} + '/beacon?tag=' + ${q(tag)} + '&origin=' + encodeURIComponent(location.origin); if (!navigator.sendBeacon(u)) fetch(u, { keepalive: true, mode: 'no-cors' }).catch(() => {}); } catch {}`;
 
 export const probe = (log, tag) =>
   `(() => { ${beacon(log, tag)} const p = btoa(location.origin + location.pathname); if (window.probeBinding) window.probeBinding(p); console.log('probe:' + p); })()`;
@@ -91,13 +91,31 @@ export async function instrument(client, sessionId, log, tag) {
   await client.send('Page.setBypassCSP', { enabled: true }, sessionId);
 }
 
-export async function load(client, sessionId, url, ms = 20000) {
-  const loaded = client.waitEvent(
-    (e) => e.method === 'Page.loadEventFired' && e.sessionId === sessionId,
-    ms
+export function loadedAfter(events, sessionId, loaderId) {
+  const committed = events.findIndex(
+    (e) =>
+      e.method === 'Page.frameNavigated' &&
+      e.sessionId === sessionId &&
+      !e.params?.frame?.parentId &&
+      e.params?.frame?.loaderId === loaderId
+  );
+  return (
+    committed >= 0 &&
+    events
+      .slice(committed + 1)
+      .some((e) => e.method === 'Page.loadEventFired' && e.sessionId === sessionId)
   );
-  await client.send('Page.navigate', { url }, sessionId);
-  await loaded;
+}
+
+export async function load(client, sessionId, url, ms = 20000) {
+  const start = client.events.length;
+  const { loaderId } = await client.send('Page.navigate', { url }, sessionId);
+  if (!loaderId) return;
+  const deadline = Date.now() + ms;
+  while (!loadedAfter(client.events.slice(start), sessionId, loaderId)) {
+    if (Date.now() > deadline) throw new Error(`load of ${url} timed out`);
+    await new Promise((resolve) => setTimeout(resolve, 25));
+  }
 }
 
 export function popup(client, openerId, ms = 10000) {

package/guard-runner.mjs

@@ -4,6 +4,7 @@ import {
   expand,
   hop,
   isRefusal,
+  loadedAfter,
   outcome,
   summary as report,
   result,
@@ -11,6 +12,7 @@ import {
 } from './guard-driver.mjs';
 
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const namedResultMs = 10000;
 const q = JSON.stringify;
 const at = (value, path = '') =>
   path
@@ -109,6 +111,7 @@ class Execution {
     this.attachSettings = new Map();
     this.childSteps = [];
     this.childRuns = new Map();
+    this.named = new Map();
     this.processed = new Set();
     this.eventStart = this.client.events.length;
     this.actionEventStart = this.eventStart;
@@ -151,12 +154,9 @@ class Execution {
   async navigate(client, session, url) {
     const start = client.events.length;
     const out = await outcome(client.send('Page.navigate', { url }, session));
-    if (out.ok && !out.result.errorText)
+    if (out.ok && !out.result.errorText && out.result.loaderId)
       await this.poll(
-        () =>
-          client.events
-            .slice(start)
-            .some((event) => event.method === 'Page.loadEventFired' && event.sessionId === session),
+        () => loadedAfter(client.events.slice(start), session, out.result.loaderId),
         3000
       );
     return out;
@@ -427,50 +427,50 @@ class Execution {
           event.params.targetInfo?.targetId !== this.pageTarget &&
           event.params.targetInfo?.targetId !== this.canaryTarget &&
           event.params.sessionId !== this.sessions.page
-        ) {
-          const info = event.params.targetInfo;
-          if (
-            info?.browserContextId &&
-            this.vars.context &&
-            info.browserContextId !== this.vars.context
-          )
-            continue;
-          this.sessions.child = event.params.sessionId;
-          if (info?.targetId) this.targets.push(info.targetId);
-          const child = event.params.sessionId;
-          const started = (async () => {
-            const reload = this.childSteps.findIndex((step) => step.cdp === 'Page.reload');
-            if (reload < 0) await this.execute(this.childSteps, event.params.sessionId);
-            else {
-              await this.execute(this.childSteps.slice(0, reload), event.params.sessionId);
-              const start = this.client.events.length;
-              await outcome(
-                this.client.send('Runtime.runIfWaitingForDebugger', {}, event.params.sessionId)
-              );
-              await this.poll(
-                () =>
-                  this.client.events
-                    .slice(start)
-                    .some(
-                      (e) =>
-                        e.method === 'Page.loadEventFired' && e.sessionId === event.params.sessionId
-                    ),
-                1500
-              );
-              await this.execute(this.childSteps.slice(reload), event.params.sessionId);
-            }
-            await outcome(
-              this.client.send('Runtime.runIfWaitingForDebugger', {}, event.params.sessionId)
-            );
-          })().catch((error) => this.errors.push(String(error.message ?? error)));
-          this.childRuns.set(child, started);
-          this.pending.push(started);
-        }
+        )
+          this.adopt(event);
       }
       await sleep(10);
     }
   }
 
+  adopt(event) {
+    const info = event.params.targetInfo;
+    const child = event.params.sessionId;
+    if (info?.browserContextId && this.vars.context && info.browserContextId !== this.vars.context)
+      return;
+    if (this.childWhere && !this.childMatches(info)) {
+      if (event.params.waitingForDebugger)
+        this.pending.push(outcome(this.client.send('Runtime.runIfWaitingForDebugger', {}, child)));
+      return;
+    }
+    this.sessions.child = child;
+    if (info?.targetId) this.targets.push(info.targetId);
+    const started = (async () => {
+      const reload = this.childSteps.findIndex((step) => step.cdp === 'Page.reload');
+      if (reload < 0) await this.execute(this.childSteps, child);
+      else {
+        await this.execute(this.childSteps.slice(0, reload), child);
+        const start = this.client.events.length;
+        await outcome(this.client.send('Runtime.runIfWaitingForDebugger', {}, child));
+        await this.poll(
+          () =>
+            this.client.events
+              .slice(start)
+              .some((e) => e.method === 'Page.loadEventFired' && e.sessionId === child),
+          1500
+        );
+        await this.execute(this.childSteps.slice(reload), child);
+      }
+      const resumed = this.client.events.length;
+      await outcome(this.client.send('Runtime.runIfWaitingForDebugger', {}, child));
+      if (this.childSteps.some((step) => step.cdp === 'Page.enable'))
+        await this.poll(() => this.firstLoad(child, resumed), 5000);
+    })().catch((error) => this.errors.push(String(error.message ?? error)));
+    this.childRuns.set(child, started);
+    this.pending.push(started);
+  }
+
   async answer(event) {
     const p = event.params;
     const rule = this.answers.find(
@@ -498,6 +498,24 @@ class Execution {
     this.calls[`answer.${p.requestId}.${event.method}`] = out;
   }
 
+  firstLoad(session, from) {
+    const events = this.client.events.slice(from);
+    return events.some(
+      (event, index) =>
+        event.method === 'Page.frameNavigated' &&
+        event.sessionId === session &&
+        !event.params?.frame?.parentId &&
+        events
+          .slice(index + 1)
+          .some((e) => e.method === 'Page.loadEventFired' && e.sessionId === session)
+    );
+  }
+
+  childMatches(info) {
+    if (this.childWhere.openerId === 'page') return info?.openerId === this.pageTarget;
+    return String(info?.url ?? '').startsWith(this.childWhere.urlPrefix);
+  }
+
   async childrenSettled() {
     await Promise.all([...this.childRuns.values()]);
   }
@@ -541,6 +559,7 @@ class Execution {
   async operation(step, session, phase) {
     if (step.children) {
       this.childSteps = step.children;
+      this.childWhere = step.where;
       return;
     }
     if (step.answer) {
@@ -562,12 +581,13 @@ class Execution {
   }
 
   async settle(settle) {
+    if ((settle.dependsOn ?? []).some((name) => this.refused[name])) return;
     if (settle.variant) await sleep(this.delay);
     if (settle.title && !this.reader) {
       await sleep(settle.ms ?? 1500);
       return;
     }
-    await this.poll(async () => {
+    const met = await this.poll(async () => {
       if (settle.beacon)
         return (
           (await this.requestCheck({ beacon: settle.beacon }, this.actionRequestStart)) &&
@@ -575,10 +595,20 @@ class Execution {
             (await this.requestCheck({ served: this.actionDestination }, this.actionRequestStart)))
         );
       if (settle.title) return this.check({ title: settle.title, session: settle.session });
-      return this.client.events
-        .slice(this.actionEventStart)
-        .some((event) => event.method === 'Page.loadEventFired');
+      const events = this.client.events.slice(this.actionEventStart);
+      return events.some(
+        (event, index) =>
+          event.method === 'Page.frameNavigated' &&
+          !event.params?.frame?.parentId &&
+          events
+            .slice(index + 1)
+            .some((e) => e.method === 'Page.loadEventFired' && e.sessionId === event.sessionId)
+      );
     }, settle.ms ?? 1500);
+    if (settle.required && !met)
+      this.errors.push(
+        `settle: no ${settle.beacon ? `beacon from ${settle.beacon}` : settle.title ? `title ${settle.title}` : 'load'} within ${settle.ms ?? 1500}ms`
+      );
   }
 
   async guess(guess, session) {
@@ -607,18 +637,19 @@ class Execution {
     if (step.cdp === 'Target.setAutoAttach' && step.params?.autoAttach === false)
       this.cleanupEventStart = this.client.events.length;
     const params = { ...step.params };
-    if (
-      /^Storage\.(getCookies|setCookies|clearCookies)$/.test(step.cdp) &&
-      this.vars.context &&
-      !params.browserContextId
-    )
-      params.browserContextId = this.vars.context;
     const session =
       step.session === 'page-or-browser' &&
       supported(['browserSession'], this.options.capabilities) &&
       /^Storage\.(getCookies|setCookies|clearCookies)$/.test(step.cdp)
         ? undefined
         : sessionId;
+    if (
+      /^Storage\.(getCookies|setCookies|clearCookies)$/.test(step.cdp) &&
+      this.vars.context &&
+      !params.browserContextId &&
+      session === undefined
+    )
+      params.browserContextId = this.vars.context;
     const out = await outcome(this.client.send(step.cdp, params, session));
     if (step.cdp === 'Target.setAutoAttach' && out.ok) {
       if (params.autoAttach) this.attachSettings.set(session, true);
@@ -673,11 +704,11 @@ class Execution {
     if (pre) expression = `(() => { ${pre} return (${expression}); })()`;
     const promise = this.evaluate(expression, session);
     if (step.background) {
-      this.pending.push(
-        promise.then((out) => {
-          if (typeof step.as === 'string') this.calls[step.as] = out;
-        })
-      );
+      const done = promise.then((out) => {
+        if (typeof step.as === 'string') this.calls[step.as] = out;
+      });
+      this.pending.push(done);
+      if (typeof step.as === 'string') this.named.set(step.as, done);
       return { ok: true, result: { pending: true } };
     }
     const out = await promise;
@@ -689,9 +720,38 @@ class Execution {
     return out;
   }
 
+  async namedSettled(names) {
+    const waits = names.map((name) => this.named.get(name)).filter(Boolean);
+    if (!waits.length) return true;
+    let timer;
+    const expired = new Promise((resolve) => {
+      timer = setTimeout(() => resolve(false), this.options.namedResultMs ?? namedResultMs);
+    });
+    const done = await Promise.race([Promise.all(waits).then(() => true), expired]);
+    clearTimeout(timer);
+    if (!done) this.pending = this.pending.filter((work) => !waits.includes(work));
+    return done;
+  }
+
+  async ready(c) {
+    if (c.observer === 'unguarded' && !this.reader) return false;
+    return this.namedReady(c);
+  }
+
+  async namedReady(c) {
+    const names = [c.result, ...(c.compare ?? []), c.refused, c.reached]
+      .flat()
+      .filter((name) => typeof name === 'string' && this.named.has(name));
+    if (!names.length || (await this.namedSettled(names))) return true;
+    this.errors.push(
+      `${names.join(', ')} did not complete within ${this.options.namedResultMs ?? namedResultMs}ms`
+    );
+    return false;
+  }
+
   async check(check) {
     const c = expand(check, this.vars);
-    if (c.observer === 'unguarded' && !this.reader) return false;
+    if (!(await this.ready(c))) return false;
     const events = this.client.events.slice(this.eventStart);
     const evidence = await this.evidence(c);
     if (evidence !== undefined) return evidence;
@@ -945,16 +1005,87 @@ const inactive = (vector, target, capabilities) =>
   !supported(vector.requires, capabilities) ||
   (vector.scope !== 'any' && vector.scope !== capabilities.scope);
 
-function unavailableOrigin(vector, target, targets = {}) {
-  const defaults = { plain: 'ordinary', cross: 'client', log: 'ordinary', own: 'client' };
-  const references = [target, 'plain', vector.control.origin];
-  for (const match of q([vector.setup, vector.trigger, vector.observe, vector.liveCheck]).matchAll(
-    /\{([A-Za-z][A-Za-z-]*)\}/g
-  ))
-    references.push(match[1] === 'beacon' || match[1] === 'probe' ? 'log' : match[1]);
-  return references
-    .map((name) => (targets[name] === undefined ? (defaults[name] ?? name) : name))
-    .find((name) => targets[name] === null);
+const allSteps = (list) => list.flatMap((step) => [step, ...allSteps(step.children ?? [])]);
+const browserContextStep = (vector, capabilities) =>
+  allSteps([...vector.setup, ...vector.trigger]).some(
+    (step) =>
+      step.params?.browserContextId !== undefined ||
+      (step.session === 'page-or-browser' &&
+        /^Storage\.(getCookies|setCookies|clearCookies)$/.test(step.cdp ?? '') &&
+        supported(['browserContexts'], capabilities))
+  );
+
+const originDefaults = { plain: 'ordinary', cross: 'client', log: 'ordinary', own: 'client' };
+const knownOrigins = [
+  'ordinary',
+  'ordinary-same-site',
+  'seven',
+  'vault',
+  'vault-x',
+  'apex',
+  'own',
+  'client',
+  'plain',
+  'cross',
+  'log',
+];
+
+function nullOrigins(value, targets) {
+  return [...q(value).matchAll(/\{([A-Za-z][A-Za-z-]*)\}/g)]
+    .map((match) => (match[1] === 'beacon' || match[1] === 'probe' ? 'log' : match[1]))
+    .map((name) => (targets[name] === undefined ? (originDefaults[name] ?? name) : name))
+    .filter((name) => knownOrigins.includes(name) && (targets[name] ?? null) === null);
+}
+
+function prune(check, targets) {
+  if (!check || typeof check !== 'object') return { check };
+  if (check.any) {
+    const parts = check.any.map((item) => prune(item, targets));
+    const kept = parts.filter((part) => !part.missing).map((part) => part.check);
+    return kept.length ? { check: { ...check, any: kept } } : { missing: parts[0]?.missing };
+  }
+  if (check.all || check.not) {
+    const parts = (check.all ?? [check.not]).map((item) => prune(item, targets));
+    const missing = parts.find((part) => part.missing)?.missing;
+    if (missing) return { missing };
+    return {
+      check: check.all
+        ? { ...check, all: parts.map((part) => part.check) }
+        : { ...check, not: parts[0].check },
+    };
+  }
+  const missing = nullOrigins(check, targets)[0];
+  return missing ? { missing } : { check };
+}
+
+function available(vector, target, targets = {}) {
+  const fixed = nullOrigins(
+    [target, '{plain}', vector.control.origin, vector.setup, vector.trigger].map((value) =>
+      typeof value === 'string' && !value.startsWith('{') ? `{${value}}` : value
+    ),
+    targets
+  )[0];
+  if (fixed) return { missing: fixed };
+  const live = prune(vector.liveCheck, targets);
+  if (live.missing) return { missing: live.missing };
+  const observe = {};
+  for (const [name, observation] of Object.entries(vector.observe ?? {})) {
+    const pruned = prune(observation.check, targets);
+    if (pruned.missing) return { missing: pruned.missing };
+    const either = observation.eitherWhen ? prune(observation.eitherWhen, targets) : undefined;
+    observe[name] = {
+      ...observation,
+      check: pruned.check,
+      ...(observation.eitherWhen ? { eitherWhen: either.missing ? undefined : either.check } : {}),
+    };
+  }
+  return {
+    vector: {
+      ...vector,
+      ...(vector.liveCheck ? { liveCheck: live.check } : {}),
+      ...(vector.observe ? { observe } : {}),
+    },
+  };
 }
 
 function variables(targets, target, side, slot, index) {
@@ -976,7 +1107,9 @@ function variables(targets, target, side, slot, index) {
 }
 
 async function executeRow(job, opts, clients, set, slot, index) {
-  const { vector, target, variant } = job;
+  const { target, variant } = job;
+  const scoped = available(job.vector, target, opts.targets);
+  const vector = scoped.vector ?? job.vector;
   const base = {
     id: vector.id,
     target,
@@ -985,7 +1118,7 @@ async function executeRow(job, opts, clients, set, slot, index) {
     via: vector.control.via,
     transportVariant: clients.transportVariant === true,
   };
-  const unavailable = unavailableOrigin(vector, target, opts.targets);
+  const unavailable = scoped.missing;
   if (unavailable)
     return {
       ...base,
@@ -1002,8 +1135,27 @@ async function executeRow(job, opts, clients, set, slot, index) {
       live: 'not-run',
       appliesTo: vector.appliesTo ?? [],
     };
-  if (inactive(vector, target, opts.capabilities))
-    return { ...base, control: 'skip', guarded: 'skip', live: 'skip', reason: 'not-applicable' };
+  if (inactive(vector, target, opts.capabilities)) {
+    const missing = (vector.requires ?? []).find((cap) => !supported([cap], opts.capabilities));
+    return {
+      ...base,
+      control: 'skip',
+      guarded: 'skip',
+      live: 'skip',
+      reason: missing ? `not-supported:${missing}` : 'not-applicable',
+    };
+  }
+  if (
+    !supported(['browserSession'], opts.capabilities) &&
+    browserContextStep(vector, opts.capabilities)
+  )
+    return {
+      ...base,
+      control: 'skip',
+      guarded: 'skip',
+      live: 'skip',
+      reason: 'not-supported:browserSession',
+    };
   if (needsObserver(vector) && !clients.unguarded)
     return {
       ...base,
@@ -1172,10 +1324,22 @@ export function summary({ set, results, guard = 'reference', sha = 'unknown' })
   const observerSkipped = results.filter(
     (row) => row.reason === 'not-supported:unguarded-observer'
   ).length;
+  const skips = {};
+  for (const row of results)
+    if (row.control === 'skip')
+      skips[row.reason ?? 'unknown'] = (skips[row.reason ?? 'unknown'] ?? 0) + 1;
+  const skipped = Object.values(skips).reduce((sum, count) => sum + count, 0);
+  const line = observerSkipped ? value.line.replace('GUARD-PASS', 'GUARD-FAIL') : value.line;
   return {
     ...value,
     pass: value.pass && observerSkipped === 0,
-    line: observerSkipped ? value.line.replace('GUARD-PASS', 'GUARD-FAIL') : value.line,
+    line: skipped
+      ? `${line} skips ${skipped} (${Object.entries(skips)
+          .sort(([a], [b]) => a.localeCompare(b))
+          .map(([reason, count]) => `${reason}=${count}`)
+          .join(', ')})`
+      : line,
+    skips,
     observerSkipped,
     counts: Object.fromEntries(
       ['control', 'guarded', 'live'].map((side) => [

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.7.3",
+  "setVersion": "1.7.5",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -116,6 +116,14 @@
         {
           "page": "navigate",
           "url": "{ordinary}/doc?n=next-{tag}"
+        },
+        {
+          "settle": {
+            "beacon": "{ordinary}",
+            "ms": 5000,
+            "required": true,
+            "dependsOn": ["refused.3"]
+          }
         }
       ],
       "trigger": [
@@ -318,6 +326,14 @@
         {
           "page": "navigate",
           "url": "{ordinary}/doc?n=next-{tag}"
+        },
+        {
+          "settle": {
+            "beacon": "{ordinary}",
+            "ms": 5000,
+            "required": true,
+            "dependsOn": ["refused.3"]
+          }
         }
       ],
       "trigger": [
@@ -929,6 +945,14 @@
         {
           "page": "navigate",
           "url": "{ordinary}/doc?n=next-{tag}"
+        },
+        {
+          "settle": {
+            "beacon": "{ordinary}",
+            "ms": 5000,
+            "required": true,
+            "dependsOn": ["refused.3"]
+          }
         }
       ],
       "trigger": [
@@ -1540,6 +1564,14 @@
         {
           "page": "navigate",
           "url": "{ordinary}/doc?n=next-{tag}"
+        },
+        {
+          "settle": {
+            "beacon": "{ordinary}",
+            "ms": 5000,
+            "required": true,
+            "dependsOn": ["refused.3"]
+          }
         }
       ],
       "trigger": [
@@ -2151,6 +2183,14 @@
         {
           "page": "navigate",
           "url": "{ordinary}/doc?n=next-{tag}"
+        },
+        {
+          "settle": {
+            "beacon": "{ordinary}",
+            "ms": 5000,
+            "required": true,
+            "dependsOn": ["refused.3"]
+          }
         }
       ],
       "trigger": [
@@ -2590,6 +2630,14 @@
         {
           "page": "navigate",
           "url": "{ordinary}/doc?n=next-{tag}"
+        },
+        {
+          "settle": {
+            "beacon": "{ordinary}",
+            "ms": 5000,
+            "required": true,
+            "dependsOn": ["refused.3"]
+          }
         }
       ],
       "trigger": [
@@ -3029,6 +3077,14 @@
         {
           "page": "navigate",
           "url": "{ordinary}/doc?n=next-{tag}"
+        },
+        {
+          "settle": {
+            "beacon": "{ordinary}",
+            "ms": 5000,
+            "required": true,
+            "dependsOn": ["refused.3"]
+          }
         }
       ],
       "trigger": [
@@ -3472,6 +3528,14 @@
         {
           "page": "navigate",
           "url": "{ordinary}/doc?n=next-{tag}"
+        },
+        {
+          "settle": {
+            "beacon": "{ordinary}",
+            "ms": 5000,
+            "required": true,
+            "dependsOn": ["refused.3"]
+          }
         }
       ],
       "trigger": [
@@ -3929,6 +3993,9 @@
               }
             }
           ],
+          "where": {
+            "openerId": "page"
+          },
           "requires": ["autoAttach"]
         },
         {
@@ -3940,6 +4007,16 @@
           "url": "{ordinary}/doc?n=popup-{tag}&again=1",
           "session": "child",
           "requires": ["autoAttach"]
+        },
+        {
+          "settle": {
+            "beacon": "{ordinary}",
+            "session": "child",
+            "ms": 5000,
+            "required": true,
+            "dependsOn": ["refused.2", "refused.5"]
+          },
+          "requires": ["autoAttach"]
         }
       ],
       "trigger": [
@@ -4180,6 +4257,9 @@
               "cdp": "Page.reload"
             }
           ],
+          "where": {
+            "openerId": "page"
+          },
           "requires": ["autoAttach"]
         }
       ],
@@ -4415,6 +4495,9 @@
               "cdp": "Page.reload"
             }
           ],
+          "where": {
+            "openerId": "page"
+          },
           "requires": ["autoAttach"]
         }
       ],
@@ -4847,7 +4930,7 @@
         },
         "beacon": {
           "means": "a beacon from {target}",
-          "dependsOn": ["refused.7", "refused.8"],
+          "dependsOn": ["refused.3", "refused.7", "refused.8"],
           "requires": ["autoAttach"],
           "check": {
             "beacon": "{target}",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.7.3",
+  "version": "1.7.5",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -64,12 +64,14 @@
     "trust": "npx fledgling sync -y --skip-publish",
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish",
     "release": "semantic-release",
-    "test:guard": "node --test test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs && node scripts/test-guards.mjs",
+    "test:guard": "npm run test:guard-integration && npm run test:guard-sweep",
+    "test:guard-integration": "node --test test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs",
+    "test:guard-sweep": "node scripts/test-guards.mjs",
     "test:guard-target": "node --test test/integration/guard-runner.test.mjs",
     "test:unit:guard": "node --experimental-test-coverage --test --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-lines=100 test/unit/guard-*.test.mjs"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-shared-web": "1.20.0",
+    "@ai-ecoverse/slicc-shared-web": "1.21.1",
     "@biomejs/biome": "2.5.15",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",

package/protected.json

@@ -314,6 +314,10 @@
       "url": "https://vault-preview.sliccy.ai/",
       "protected": true
     },
+    {
+      "url": "https://echo.sliccy.ai/",
+      "protected": true
+    },
     {
       "url": "https://vault-feature-x.sliccy.ai/",
       "protected": true

package/schema/guard-vectors.schema.json

@@ -545,6 +545,22 @@
             "children": {
               "$ref": "#/$defs/steps"
             },
+            "where": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["openerId"],
+                  "properties": { "openerId": { "const": "page" } }
+                },
+                {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["urlPrefix"],
+                  "properties": { "urlPrefix": { "type": "string", "minLength": 1 } }
+                }
+              ]
+            },
             "on": {
               "$ref": "#/$defs/on"
             },
@@ -578,9 +594,23 @@
                 },
                 "session": {
                   "$ref": "#/$defs/session"
+                },
+                "required": {
+                  "const": true
+                },
+                "dependsOn": {
+                  "type": "array",
+                  "uniqueItems": true,
+                  "items": {
+                    "type": "string",
+                    "pattern": "^(refused\\.[0-9]+|[A-Za-z][A-Za-z0-9]*)$"
+                  }
                 }
               }
             },
+            "requires": {
+              "$ref": "#/$defs/requires"
+            },
             "on": {
               "$ref": "#/$defs/on"
             }