@ai-ecoverse/slicc-browsers 1.7.7 → 1.7.8

package/README.md

@@ -81,7 +81,7 @@ Every feature builds for `wasm32-wasip1`.
 - `rank`: `tiers`, 1 to 6: `sevenOpen` (an endpoint with a seven tab), `endpoint` (any other endpoint), `chrome` (installed `chromeId`), `chromium` (other installed Chromium browsers), `electron` (installed Electron apps), `six` (an endpoint in SLICC six's profile, with or without a seven tab; see [SLICC six's profiles](#slicc-sixs-profiles)).
 - `discovery`:
   - `activePortFile` (`DevToolsActivePort`): its first line is the port (1 to 65535) and its second the browser's websocket path, which starts with `/`. A file without both is ignored. A file is live only when its port answers `/json/version` with a `webSocketDebuggerUrl` whose path is that websocket path; otherwise it's stale and ignored. When the port accepts connections but serves no `/json/version`, the endpoint is listed as `wsOnly`, with `ws://127.0.0.1:<port><path>`;
-  - `probePorts` (9222 to 9229, probed by `slicc` only);
+  - `probePorts` (9222 to 9229);
   - every endpoint's `cdp` is `<scheme>://<host>:<port>`, with the host in lower case and `localhost` and `::1` written as `127.0.0.1`, whatever form the URL was found in. Endpoints with the same host and port, written that way, are one endpoint. A `ws://` `--cdp` URL that is listed as `wsOnly` keeps its websocket URL as given;
   - `sourceRank`: when two sources find the same host and port, the lower rank wins, and on a tie the first found;
   - `names`: an endpoint's name when it isn't from a known browser's user-data dir: `electron` when the user agent contains `electronUserAgent`, else `products[<product>]` for the product before the `/` in `/json/version`'s `Browser`, else that product, else `fallback`;
@@ -131,7 +131,7 @@ A same-site frame shares its parent's process and has no target of its own. Ever
 ## Guard vectors
 
 Every CDP guard runs the vectors in `guard-vectors.json` (schema `schema/guard-vectors.schema.json`): bios, slicc-cdp, slicc-extension and slicc-cli. The sources are listed in `sources`:
-- slicc-cli's `protectVectors` at `2d5d981` (`test/integration/testdata/link/protect.js`), with the ids kept;
+- slicc-cli's `protectVectors` at `2d5d981` (`test/integration/testdata/link/protect.js`), with the ids kept, and at `fe33052` for `C3.redirect-popup-stays-out` and `C3.direct-popup-stays-out`: a popup opened straight onto, or through a redirect chain to, a protected origin never reaches the client, not at open and not after the page later navigates itself and auto-attach runs again;
 - slicc-cdp's `test/integration/guard-vectors.json` at `4907a45`, where its `E1`, `E2`, `E3`, `E5` and `B2` are renamed `E1.onload`, `E2.binding`, `E3.bypass-csp`, `E5.console` and `B2.headers`;
 - the cert lane's E and B rows;
 - `C5.continue-request` and `C5.continue-response`, added next to `C5.document`.
@@ -171,7 +171,7 @@ Any `cdp`, `page` or `children` step can take `requires`, the capabilities it ne
   `hops` routes `url` through `/hop` on each `origin`, with its `code`.
 - `{ "answer": { "url", "stage"?, "cdp"?, "params"?, "hold"? } }`: answer each paused request or auth challenge for `url` with that call; `hold` leaves it paused. Every other paused request continues unchanged.
 - `{ "children": steps, "where"? }`: run these steps on each target auto-attached from then on, then resume it. `where` scopes them to the row's own target: `{ "openerId": "page" }` (opened by the row's page) or `{ "urlPrefix": url }`; other attached targets are resumed and otherwise left alone.
-- `{ "settle": { "beacon"?, "title"?, "ms"?, "variant"?, "session"? } }`: wait for a beacon from `beacon`, for the page `title`, or for the session to detach. It waits up to `ms` (10000 by default), then another 600 ms. `variant` waits the run's detach variant instead.
+- `{ "settle": { "beacon"?, "served"?, "title"?, "ms"?, "variant"?, "session"? } }`: wait for a beacon from `beacon`, for the fixture to log a request for the URL `served`, for the page `title`, or for the session to detach. It waits up to `ms` (10000 by default), then another 600 ms. `variant` waits the run's detach variant instead.
 - `{ "wait": ms }`.
 - `{ "paused": { "url", "ms" } }`: wait until the client has seen the pause that an `answer` rule for `url` matches (`Fetch.requestPaused` at the rule's stage, or `Fetch.authRequired` for a `Fetch.continueWithAuth` rule). It waits up to `ms`. On the control leg, a pause that never comes fails the row with `paused: no pause for <url> within <ms>ms`. On the guarded leg the guard may hide that pause, so the step waits the full `ms` and doesn't fail. The C5 guessed-id vectors and `C5.auth` use it before their second request, so the probe's interception id falls between the two ids the guess spans.
 - `{ "guess": { "between", "cdp", "params" }, "as" }`: the call for each request id between the ids paused for the two URLs.
@@ -191,7 +191,7 @@ Popups are observed by `Target.targetCreated` with the opener's `openerId`, or b
 
 **The control rule.** Every vector has a control on an ordinary origin: the same setup and trigger against an unprotected origin must succeed. A missing or failing control fails the id. With `via: "guard"`, the control runs through the guard. With `via: "unguarded"`, the runner runs setup and trigger through its own CDP against the ordinary origin and against the protected stand-in, and both must show the effect. The runner reports the control's transport as `via`.
 
-**Refusals.** Each refusable step has a refusal name: its `as`, or `refused.<i>`, where `i` is its index in the vector's steps, setup then trigger, with each `children` step's steps right after it, counted from 0 before `on` is applied. When a guard refuses the step and the error matches `refusal.match`, the runner sets that name to `true` in the leg's observations. On that leg, an observation whose `dependsOn` lists the name is skipped; every other observation is checked as usual. A guard that refuses the step on every origin passes in one of two ways: through the guard, with the step refused on both legs, or with an unguarded control and the guard's matched refusal on the guarded leg. With `via: "guard"`, a refusal on one leg only fails that leg. The comparison only counts steps that ran on both legs. A step that ran on one leg only (for example a `children` step on the control's popup, when the guarded leg never gets that popup attached) doesn't fail the row by itself, and the row reports it in `ran`, as `{ "refused.5": "control-only" }` or `"guarded-only"`. Observations that depend on such a step follow their `dependsOn` on each leg. A guard that allows the step must pass its control through the guard.
+**Refusals.** Each refusable step has a refusal name: its `as`, or `refused.<i>`, where `i` is its index in the vector's steps, setup then trigger, with each `children` step's steps right after it, counted from 0 before `on` is applied. When a guard refuses the step and the error matches `refusal.match`, the runner sets that name to `true` in the leg's observations. On that leg, an observation whose `dependsOn` lists the name is skipped; every other observation is checked as usual. A guard that refuses the step on every origin passes in one of two ways: through the guard, with the step refused on both legs, or with an unguarded control and the guard's matched refusal on the guarded leg. With `via: "guard"`, a refusal on one leg only fails that leg. The comparison only counts steps that ran on both legs. A step that ran on one leg only (for example a `children` step on the control's popup, when the guarded leg never gets that popup attached) doesn't fail the row by itself, and the row reports it in `ran`, as `{ "refused.5": "control-only" }` or `"guarded-only"`. Observations that depend on such a step follow their `dependsOn` on each leg. A refusable step that fails without a matching refusal, for example with an internal error or a timeout, is not a refusal: it fails the row with `<name> failed without a refusal: <message>`. A step skipped because an earlier step failed therefore never passes through `ran`, and only a matched refusal skips the observations that depend on it. A guard that allows the step must pass its control through the guard.
 
 **Liveness.** A runner checks `live` through its own CDP, never through the guard path: either the protected document loaded (title, marker or URL), or the guard returned its own refusal for a refusable step. A failing `live` fails the id.
 
@@ -285,7 +285,11 @@ target. In observations and liveness checks, an `any` alternative that reference
 a `null` origin is dropped and the rest are evaluated; the row skips only when
 every alternative of an `any`, or a required (`all`, `not` or plain) check, needs it. Tags and cookie names are unique per leg. `variant`
 selects one variant or an array; omission selects all. `parallel` defaults to 1.
-`log(row)` receives completed rows. Besides `control`, `guarded`, `live`, `why` and `errors`, a row may carry `ran` (steps that ran on one leg only) and `notes` (settles skipped because their registration was refused). A variant supplies the wait before an
+With the `browserContexts` capability each leg runs in its own browser context. A `Target.createBrowserContext` that fails with a timeout is retried once, and the row's `notes` records it; any other failure fails the row.
+
+`onStart(row)` receives each row's `id`, `target`, `variant`, `transport` and `via` as the row starts. `run()` returns a promise that also has `inFlight()`, and its result has `inFlight` too. `inFlight()` lists the rows that are running now, each as `{ id, target, variant, leg, phase, step, clients }`, where `step` is the index of the current step in its `phase` (`setup`, `trigger` or `child`), and `clients` lists each client's pending CDP calls as `{ method, session, ageMs }` (`client`, plus `unguarded` when it is a separate client). With `rowTimeoutMs`, a row still running after that many milliseconds fails on its own. Its `errors` hold `row timed out after <ms>ms: <the in-flight view>`, `inFlight` holds the view, and the clients that `clientFactory` made for it are closed. The run then goes on to the next row. It is off by default, and a client passed as `client` is never closed.
+
+`log(row)` receives completed rows. Besides `control`, `guarded`, `live`, `why` and `errors`, a row may carry `ran` (steps that ran on one leg only) and `notes` (settles skipped because their registration was refused). Both are informational: they explain a row's verdict, and adopters (bios, slicc-cli, slicc-cdp) must not count them as failures, or as passes. The verdict is `control`, `guarded` and `live`. A variant supplies the wait before an
 explicit `Target.detachFromTarget` step and for a `settle.variant` step.
 
 Every runnable vector has a declarative `liveCheck`; every observation has a
@@ -439,7 +443,7 @@ A six endpoint has tier `six`, whatever its seven tabs. **A program never choose
 
 ## Output schema 1
 
-`schema/browsers.schema.json` describes `slicc browsers --json`, which `playwright-cli list --json` also prints. [slicc-cli's README](https://github.com/ai-ecoverse/slicc-cli#slicc-browsers---json---cdp-url---no-bundle-scan) is the authoritative spec for it; this schema is a copy and follows it. Fields can be added; `source` is one of `devtools-active-port`, `flag`, `probe` and `process`. `tier` is 1 to 6, and `six: true` marks an endpoint in SLICC six's profile (tier 6).
+`schema/browsers.schema.json` describes `slicc browsers --json`, which `playwright-cli list --json` also prints. [slicc-cli's README](https://github.com/ai-ecoverse/slicc-cli#slicc-browsers---json---cdp-url---no-bundle-scan) is the authoritative spec for it; this schema is a copy and follows it. Fields can be added; `source` is one of `devtools-active-port`, `flag`, `probe` and `process`. `tier` is 1 to 6, and `six: true` marks an endpoint in SLICC six's profile (tier 6). An endpoint may carry `tabs`: every page target except those on protected origins. Seven's own tabs are protected, so they are in `sevenTabs` only, never in `tabs`. `playwright-cli list --json` prints it, and a corpus case that checks it needs `tabs`.
 
 ## The corpus
 
@@ -447,7 +451,7 @@ Each case is a fake machine: a home tree, `DevToolsActivePort` files, fake `/jso
 
 **`case.json`:**
 - `description`, and `os?`: the OSes the case runs on (`darwin`, `linux`, `windows`; default all).
-- `needs`: what a program must support to run the case: `user-data-dirs` (`DevToolsActivePort` in browsers' default user-data dirs), `seven-profiles` (in the profile roots), `flag` (`--cdp` URLs), `process`, `probe` (port probes, `slicc` only), `origins` (extra seven origins), `installed` (ranking installed browsers), `six` (finding and marking SLICC six's profiles). A program skips a case that needs something it doesn't do.
+- `needs`: what a program must support to run the case: `user-data-dirs` (`DevToolsActivePort` in browsers' default user-data dirs), `seven-profiles` (in the profile roots), `flag` (`--cdp` URLs), `process`, `probe` (port probes), `origins` (extra seven origins), `installed` (ranking installed browsers), `six` (finding and marking SLICC six's profiles), `tabs` (each endpoint's `tabs` list). A program skips a case that needs something it doesn't do.
 - `env?`: environment variables for discovery, which sees nothing else from the real environment.
 - `files?`: file contents by path. Every path starts with a token.
 - `cdp?`, `origins?`, `probePorts?`: `--cdp` URLs, extra seven origins, and the ports to probe.
@@ -508,7 +512,7 @@ for case in corpus().cases {
 
 Go 1.26, Rust stable with `wasm32-wasip1`, Node ≥ 24.
 - `npm run corpus` regenerates `corpus.json` from `corpus/`; the pre-commit hook and CI fail when it's stale.
-- `npm run validate` checks `catalog.json`, `corpus.json`, `protected.json` and `guard-vectors.json` against the schemas, runs the protected-origin vectors through `protected.mjs`, and checks what a schema can't say: unique ids, bundle ids and names, known Windows roots, rising tiers, compiling patterns, known tokens, tier order, `sevenOpen`, `six` and `auto` in each `expected.json`, and no port from 9222 to 9229.
+- `npm run validate` checks `catalog.json`, `corpus.json`, `protected.json` and `guard-vectors.json` against the schemas, runs the protected-origin vectors through `protected.mjs`, and checks what a schema can't say: unique ids, bundle ids and names, known Windows roots, rising tiers, compiling patterns, known tokens, tier order, `sevenOpen`, `tabs` (which holds no entry of `sevenTabs`), `six` and `auto` in each `expected.json`, and no port from 9222 to 9229.
 - `npm run lint`: the slicc lint tools (Biome, no comments, no unit tests in git, `AGENTS.md`), `gofmt`, `go mod tidy -diff`, `go vet`, golangci-lint, `cargo fmt --check` and clippy.
 - `npm test`: `validate`, the Go tests in `test/integration/`, and `cargo test --all-features`.
 - `npm run build`: the Go module, the crate (also for `wasm32-wasip1`), and `npm pack --dry-run`.

package/corpus.json

@@ -664,6 +664,124 @@
         ]
       }
     },
+    {
+      "name": "endpoint-tabs",
+      "case": {
+        "description": "tabs lists every page target except those on protected origins; seven's own tabs are only in sevenTabs, and iframes, workers and other protected pages are left out",
+        "needs": [
+          "flag",
+          "tabs"
+        ],
+        "cdp": [
+          "127.0.0.1:9331"
+        ],
+        "http": {
+          "127.0.0.1:9331": {
+            "version": {
+              "Browser": "Chrome/154.0.8037.98",
+              "Protocol-Version": "1.3",
+              "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.8037.98 Safari/537.36",
+              "V8-Version": "15.4.79.1",
+              "WebKit-Version": "537.36 (@a1b2c3)",
+              "webSocketDebuggerUrl": "ws://127.0.0.1:9331/devtools/browser/t1"
+            },
+            "list": [
+              {
+                "id": "P1",
+                "type": "page",
+                "url": "https://lars.sliccy.ai/",
+                "title": "seven",
+                "webSocketDebuggerUrl": "ws://127.0.0.1/devtools/page/P1"
+              },
+              {
+                "id": "P2",
+                "type": "page",
+                "url": "https://example.test/docs",
+                "title": "docs",
+                "webSocketDebuggerUrl": "ws://127.0.0.1/devtools/page/P2"
+              },
+              {
+                "id": "P3",
+                "type": "page",
+                "url": "https://www.sliccy.ai/",
+                "title": "SLICC",
+                "webSocketDebuggerUrl": "ws://127.0.0.1/devtools/page/P3"
+              },
+              {
+                "id": "P4",
+                "type": "page",
+                "url": "https://vault.sliccy.ai/",
+                "title": "vault",
+                "webSocketDebuggerUrl": "ws://127.0.0.1/devtools/page/P4"
+              },
+              {
+                "id": "P5",
+                "type": "page",
+                "url": "about:blank",
+                "title": "",
+                "webSocketDebuggerUrl": "ws://127.0.0.1/devtools/page/P5"
+              },
+              {
+                "id": "P6",
+                "type": "iframe",
+                "url": "https://example.test/frame",
+                "title": "frame",
+                "webSocketDebuggerUrl": "ws://127.0.0.1/devtools/page/P6"
+              },
+              {
+                "id": "P7",
+                "type": "service_worker",
+                "url": "https://example.test/sw.js",
+                "title": "worker",
+                "webSocketDebuggerUrl": "ws://127.0.0.1/devtools/page/P7"
+              }
+            ]
+          }
+        }
+      },
+      "expected": {
+        "schema": 1,
+        "minChromium": 116,
+        "entries": [
+          {
+            "id": "cdp:127.0.0.1:9331",
+            "kind": "endpoint",
+            "tier": 1,
+            "name": "Chrome",
+            "version": "154.0.8037.98",
+            "endpoint": {
+              "cdp": "http://127.0.0.1:9331",
+              "webSocketDebuggerUrl": "ws://127.0.0.1:9331/devtools/browser/t1",
+              "name": "Chrome",
+              "version": "154.0.8037.98",
+              "product": "Chrome/154.0.8037.98",
+              "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.8037.98 Safari/537.36",
+              "source": "flag",
+              "sevenOpen": true,
+              "sevenTabs": [
+                {
+                  "id": "P1",
+                  "url": "https://lars.sliccy.ai/",
+                  "title": "seven"
+                }
+              ],
+              "tabs": [
+                {
+                  "id": "P2",
+                  "url": "https://example.test/docs",
+                  "title": "docs"
+                },
+                {
+                  "id": "P5",
+                  "url": "about:blank",
+                  "title": ""
+                }
+              ]
+            }
+          }
+        ]
+      }
+    },
     {
       "name": "extra-origins",
       "case": {

package/guard-runner.mjs

@@ -385,12 +385,21 @@ class Execution {
     }
   }
 
+  async createContext() {
+    const client = this.reader ?? this.client;
+    try {
+      return (await client.send('Target.createBrowserContext', {})).browserContextId;
+    } catch (error) {
+      const message = String(error?.message ?? error);
+      if (!/timed? ?out/i.test(message)) throw error;
+      this.notes.push(`Target.createBrowserContext retried once after: ${message}`);
+      return (await client.send('Target.createBrowserContext', {})).browserContextId;
+    }
+  }
+
   async seed() {
     if (supported(['browserContexts'], this.options.capabilities)) {
-      const { browserContextId } = await (this.reader ?? this.client).send(
-        'Target.createBrowserContext',
-        {}
-      );
+      const browserContextId = await this.createContext();
       this.vars.context = browserContextId;
       this.contexts.push(browserContextId);
     }
@@ -414,7 +423,7 @@ class Execution {
   }
 
   async pump() {
-    while (!this.stopped) {
+    while (!this.stopped && !this.clients.flight?.abandoned) {
       for (const event of this.client.events.slice(this.eventStart)) {
         if (this.processed.has(event)) continue;
         this.processed.add(event);
@@ -546,32 +555,47 @@ class Execution {
       .some((e) => e.method === 'Target.detachedFromTarget' && e.params?.sessionId === session);
   }
 
+  record(step, out, session, phase, gone) {
+    const refused =
+      !gone &&
+      (step.refusable
+        ? isRefusal(out, step)
+        : /refused/.test(String(out.error?.message ?? out.error)));
+    this.trace.push({
+      phase,
+      declared: Boolean(step.refusable),
+      session,
+      out,
+      refused,
+      ...(gone ? { detached: true } : {}),
+    });
+    if (step.refusable) this.refused[step.refusal.name] = refused;
+    if (step.refusable && !out.ok && !refused && !gone)
+      this.errors.push(
+        `${step.refusal.name} failed without a refusal: ${String(out.error?.message ?? out.error)}`
+      );
+    if (step.as && !out.result?.pending) this.calls[step.as] = out;
+    if (step.cdp) (this.calls.$cdp ??= []).push({ method: step.cdp, ...out });
+  }
+
   async execute(list, childSession, phase = 'child') {
     if (phase === 'trigger') await this.childrenSettled();
-    for (const raw of list) {
+    for (const [index, raw] of list.entries()) {
+      if (this.clients.flight)
+        Object.assign(this.clients.flight, { leg: this.side, phase, step: index });
       const step = expand(raw, this.vars);
       if (!supported(step.requires, this.options.capabilities) || step.text) continue;
       if (!childSession && step.session === 'child') await this.childrenSettled();
       const session = childSession ?? this.session(step.session);
       const out = await this.operation(step, session, phase);
       if (!out) continue;
-      const gone = Boolean(childSession) && !out.ok && this.detached(childSession);
-      const refused =
-        !gone &&
-        (step.refusable
-          ? isRefusal(out, step)
-          : /refused/.test(String(out.error?.message ?? out.error)));
-      this.trace.push({
-        phase,
-        declared: Boolean(step.refusable),
-        session,
+      this.record(
+        step,
         out,
-        refused,
-        ...(gone ? { detached: true } : {}),
-      });
-      if (step.refusable) this.refused[step.refusal.name] = refused;
-      if (step.as && !out.result?.pending) this.calls[step.as] = out;
-      if (step.cdp) (this.calls.$cdp ??= []).push({ method: step.cdp, ...out });
+        session,
+        phase,
+        Boolean(childSession) && !out.ok && this.detached(childSession)
+      );
       this.options.debug?.({ step, out, side: this.side });
     }
   }
@@ -608,7 +632,7 @@ class Execution {
     const refused = () => (settle.dependsOn ?? []).some((name) => this.refused[name]);
     const skipped = () => {
       this.notes.push(
-        `settle:skipped-refused ${settle.beacon ? `beacon ${settle.beacon}` : settle.title ? `title ${settle.title}` : 'load'}`
+        `settle:skipped-refused ${settle.beacon ? `beacon ${settle.beacon}` : settle.served ? `request ${settle.served}` : settle.title ? `title ${settle.title}` : 'load'}`
       );
     };
     if (refused()) return skipped();
@@ -619,6 +643,7 @@ class Execution {
     }
     const met = await this.poll(async () => {
       if (refused()) return true;
+      if (settle.served) return this.requestCheck({ served: settle.served, tagged: false });
       if (settle.beacon)
         return (
           (await this.requestCheck({ beacon: settle.beacon }, this.actionRequestStart)) &&
@@ -639,7 +664,7 @@ class Execution {
     if (refused()) return skipped();
     if (settle.required && !met)
       this.errors.push(
-        `settle: no ${settle.beacon ? `beacon from ${settle.beacon}` : settle.title ? `title ${settle.title}` : 'load'} within ${settle.ms ?? 1500}ms`
+        `settle: no ${settle.beacon ? `beacon from ${settle.beacon}` : settle.served ? `request for ${settle.served}` : settle.title ? `title ${settle.title}` : 'load'} within ${settle.ms ?? 1500}ms`
       );
   }
 
@@ -1138,8 +1163,87 @@ function variables(targets, target, side, slot, index) {
   return vars;
 }
 
-async function executeRow(job, opts, clients, set, slot, index) {
+function tracked(client, calls, name) {
+  if (!client || typeof client.send !== 'function') return client;
+  let next = 0;
+  const send = (method, params, sessionId) => {
+    const id = ++next;
+    calls.set(id, { name, method, session: sessionId, since: Date.now() });
+    return Promise.resolve()
+      .then(() => client.send(method, params, sessionId))
+      .finally(() => calls.delete(id));
+  };
+  return new Proxy(client, {
+    get(base, key) {
+      if (key === 'send') return send;
+      const value = Reflect.get(base, key);
+      return typeof value === 'function' ? value.bind(base) : value;
+    },
+  });
+}
+
+function view(flight, base, clients) {
+  const now = Date.now();
+  const pending = (name) =>
+    [...flight.calls.values()]
+      .filter((call) => call.name === name)
+      .map(({ method, session, since }) => ({ method, session, ageMs: now - since }));
+  return {
+    id: base.id,
+    target: base.target,
+    variant: base.variant,
+    leg: flight.leg,
+    phase: flight.phase,
+    step: flight.step,
+    clients: {
+      client: pending('client'),
+      ...(clients.unguarded && clients.unguarded !== clients.client
+        ? { unguarded: pending('unguarded') }
+        : {}),
+    },
+  };
+}
+
+async function watch(work, ms, snapshot) {
+  if (!ms) {
+    await work;
+    return undefined;
+  }
+  let timer;
+  const expired = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(snapshot()), ms);
+  });
+  const stuck = await Promise.race([work.then(() => undefined), expired]);
+  clearTimeout(timer);
+  return stuck;
+}
+
+async function timedOut(stuck, base, made, work, opts) {
+  const close = made.close;
+  made.close = undefined;
+  await close?.call(made);
+  work.catch(() => {});
+  const failed = {
+    ...base,
+    control: 'fail',
+    guarded: 'fail',
+    live: 'fail',
+    why: `row timed out after ${opts.rowTimeoutMs}ms`,
+    errors: [`row timed out after ${opts.rowTimeoutMs}ms: ${JSON.stringify(stuck)}`],
+    inFlight: stuck,
+  };
+  opts.log?.(failed);
+  return failed;
+}
+
+async function executeRow(job, opts, made, set, slot, index, flights) {
   const { target, variant } = job;
+  const calls = new Map();
+  const client = tracked(made.client, calls, 'client');
+  const unguarded =
+    made.unguarded === made.client ? client : tracked(made.unguarded, calls, 'unguarded');
+  const flight = { calls, leg: undefined, phase: undefined, step: undefined };
+  const clients = { ...made, client, unguarded, flight };
   const scoped = available(job.vector, target, opts.targets);
   const vector = scoped.vector ?? job.vector;
   const base = {
@@ -1197,20 +1301,30 @@ async function executeRow(job, opts, clients, set, slot, index) {
       reason: 'not-supported:unguarded-observer',
     };
   const legs = {};
-  for (const side of ['control', 'guarded']) {
-    try {
-      const vars = variables(opts.targets, target, side, slot, index);
-      legs[side] = await new Execution(
-        vector,
-        side,
-        opts,
-        clients,
-        vars,
-        set.variants[variant]
-      ).run();
-    } catch (error) {
-      legs[side] = { observed: {}, live: false, errors: [String(error.message ?? error)] };
+  flights.add({ flight, base, clients });
+  opts.onStart?.(base);
+  const sides = (async () => {
+    for (const side of ['control', 'guarded']) {
+      try {
+        const vars = variables(opts.targets, target, side, slot, index);
+        legs[side] = await new Execution(
+          vector,
+          side,
+          opts,
+          clients,
+          vars,
+          set.variants[variant]
+        ).run();
+      } catch (error) {
+        legs[side] = { observed: {}, live: false, errors: [String(error.message ?? error)] };
+      }
     }
+  })();
+  const stuck = await watch(sides, opts.rowTimeoutMs, () => view(flight, base, clients));
+  for (const entry of flights) if (entry.flight === flight) flights.delete(entry);
+  if (stuck) {
+    flight.abandoned = true;
+    return timedOut(stuck, base, made, sides, opts);
   }
   const row = {
     ...result(vector, {
@@ -1287,7 +1401,16 @@ function validate(set, opts) {
   return variants;
 }
 
-export async function run(set, options) {
+export function run(set, options) {
+  const flights = new Set();
+  const inFlight = () =>
+    [...flights].map(({ flight, base, clients }) => view(flight, base, clients));
+  const running = runAll(set, options, flights).then((done) => ({ ...done, inFlight }));
+  running.inFlight = inFlight;
+  return running;
+}
+
+async function runAll(set, options, flights) {
   const opts = { capabilities: {}, variant: Object.keys(set.variants), parallel: 1, ...options };
   const variants = validate(set, opts);
   const jobs = set.vectors.flatMap((vector) =>
@@ -1331,11 +1454,11 @@ export async function run(set, options) {
           });
           await previous;
           try {
-            results[index] = await executeRow(job, opts, clients, set, slot, index);
+            results[index] = await executeRow(job, opts, clients, set, slot, index, flights);
           } finally {
             done();
           }
-        } else results[index] = await executeRow(job, opts, clients, set, slot, index);
+        } else results[index] = await executeRow(job, opts, clients, set, slot, index, flights);
       } finally {
         await clients.close?.();
       }

package/guard-vectors.json

@@ -1,12 +1,17 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.7.7",
+  "setVersion": "1.7.8",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
       "ref": "2d5d98188667cd70180f825c7cba985399167732",
       "path": "test/integration/testdata/link/protect.js"
     },
+    {
+      "repo": "ai-ecoverse/slicc-cli",
+      "ref": "fe33052afd7bf94e98f38f85e95d29df7cb9e8c2",
+      "path": "test/integration/testdata/link/protect.js"
+    },
     {
       "repo": "ai-ecoverse/slicc-cdp",
       "ref": "4907a45d5ab8547483eaa013d4378deafe9f82d8",
@@ -4825,6 +4830,302 @@
         "observer": "client"
       }
     },
+    {
+      "id": "C3.redirect-popup-stays-out",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "text": "an allowed opener with auto-attach opens a popup on a redirect chain that ends on a page that later navigates itself to another path of its origin, then auto-attaches again without detaching"
+        },
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n=opener"
+        },
+        {
+          "cdp": "Target.setAutoAttach",
+          "params": {
+            "autoAttach": true,
+            "waitForDebuggerOnStart": true,
+            "flatten": true
+          },
+          "session": "browser",
+          "refusable": true,
+          "refusal": {
+            "match": "^slicc: refused"
+          },
+          "requires": ["autoAttach", "browserSession"]
+        },
+        {
+          "children": [
+            {
+              "cdp": "Page.enable"
+            }
+          ],
+          "where": {
+            "openerId": "page"
+          },
+          "requires": ["autoAttach"]
+        }
+      ],
+      "trigger": [
+        {
+          "page": "open",
+          "url": "{target}/page?k=deferred&defer=3000&n={tag}&to={target}/doc?n={tag}-later",
+          "hops": [
+            {
+              "origin": "{ordinary}",
+              "code": 302
+            },
+            {
+              "origin": "{cross}",
+              "code": 307
+            }
+          ]
+        },
+        {
+          "settle": {
+            "served": "{target}/doc?n={tag}-later",
+            "ms": 15000,
+            "required": true
+          }
+        },
+        {
+          "cdp": "Target.setAutoAttach",
+          "params": {
+            "autoAttach": true,
+            "waitForDebuggerOnStart": false,
+            "flatten": true
+          },
+          "session": "browser",
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          },
+          "requires": ["autoAttach", "browserSession"]
+        },
+        {
+          "wait": 1000
+        },
+        {
+          "cdp": "Target.setAutoAttach",
+          "params": {
+            "autoAttach": false,
+            "waitForDebuggerOnStart": false,
+            "flatten": true
+          },
+          "session": "browser",
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          },
+          "requires": ["autoAttach", "browserSession"]
+        }
+      ],
+      "targets": ["seven", "vault", "vault-x", "apex"],
+      "requires": ["autoAttach", "browserSession"],
+      "observe": {
+        "committed": {
+          "means": "the stand-in served the popup's first page on {target}",
+          "dependsOn": [],
+          "check": {
+            "served": "/page",
+            "origin": "{target}",
+            "observer": "fixture"
+          }
+        },
+        "navigatedLater": {
+          "means": "the popup navigated itself to {target}/doc?n={tag}-later",
+          "dependsOn": [],
+          "check": {
+            "served": "{target}/doc?n={tag}-later",
+            "observer": "fixture"
+          }
+        },
+        "attached": {
+          "means": "the client got Target.attachedToTarget for the popup on {target}, at open or later",
+          "dependsOn": ["refused.2"],
+          "requires": ["autoAttach"],
+          "check": {
+            "attached": "{target}",
+            "session": "child",
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the runner's own CDP sees {target}'s document load (title, marker or URL), or the guard returned its refusal for a refusable step",
+      "control": {
+        "origin": "ordinary",
+        "via": "guard",
+        "expected": {
+          "committed": true,
+          "navigatedLater": true,
+          "attached": true
+        }
+      },
+      "expected": {
+        "committed": true,
+        "navigatedLater": true,
+        "attached": false
+      },
+      "liveCheck": {
+        "any": [
+          {
+            "loaded": "{target}/doc?n={tag}-later",
+            "observer": "fixture"
+          },
+          {
+            "registration": "any",
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      }
+    },
+    {
+      "id": "C3.direct-popup-stays-out",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "text": "an allowed opener with auto-attach opens a popup straight on a page that later navigates itself to another path of its origin, then auto-attaches again without detaching"
+        },
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n=opener"
+        },
+        {
+          "cdp": "Target.setAutoAttach",
+          "params": {
+            "autoAttach": true,
+            "waitForDebuggerOnStart": true,
+            "flatten": true
+          },
+          "session": "browser",
+          "refusable": true,
+          "refusal": {
+            "match": "^slicc: refused"
+          },
+          "requires": ["autoAttach", "browserSession"]
+        },
+        {
+          "children": [
+            {
+              "cdp": "Page.enable"
+            }
+          ],
+          "where": {
+            "openerId": "page"
+          },
+          "requires": ["autoAttach"]
+        }
+      ],
+      "trigger": [
+        {
+          "page": "open",
+          "url": "{target}/page?k=deferred&defer=3000&n={tag}&to={target}/doc?n={tag}-later"
+        },
+        {
+          "settle": {
+            "served": "{target}/doc?n={tag}-later",
+            "ms": 15000,
+            "required": true
+          }
+        },
+        {
+          "cdp": "Target.setAutoAttach",
+          "params": {
+            "autoAttach": true,
+            "waitForDebuggerOnStart": false,
+            "flatten": true
+          },
+          "session": "browser",
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          },
+          "requires": ["autoAttach", "browserSession"]
+        },
+        {
+          "wait": 1000
+        },
+        {
+          "cdp": "Target.setAutoAttach",
+          "params": {
+            "autoAttach": false,
+            "waitForDebuggerOnStart": false,
+            "flatten": true
+          },
+          "session": "browser",
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          },
+          "requires": ["autoAttach", "browserSession"]
+        }
+      ],
+      "targets": ["seven", "vault", "vault-x", "apex"],
+      "requires": ["autoAttach", "browserSession"],
+      "observe": {
+        "committed": {
+          "means": "the stand-in served the popup's first page on {target}",
+          "dependsOn": [],
+          "check": {
+            "served": "/page",
+            "origin": "{target}",
+            "observer": "fixture"
+          }
+        },
+        "navigatedLater": {
+          "means": "the popup navigated itself to {target}/doc?n={tag}-later",
+          "dependsOn": [],
+          "check": {
+            "served": "{target}/doc?n={tag}-later",
+            "observer": "fixture"
+          }
+        },
+        "attached": {
+          "means": "the client got Target.attachedToTarget for the popup on {target}, at open or later",
+          "dependsOn": ["refused.2"],
+          "requires": ["autoAttach"],
+          "check": {
+            "attached": "{target}",
+            "session": "child",
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the runner's own CDP sees {target}'s document load (title, marker or URL), or the guard returned its refusal for a refusable step",
+      "control": {
+        "origin": "ordinary",
+        "via": "guard",
+        "expected": {
+          "committed": true,
+          "navigatedLater": true,
+          "attached": true
+        }
+      },
+      "expected": {
+        "committed": true,
+        "navigatedLater": true,
+        "attached": false
+      },
+      "liveCheck": {
+        "any": [
+          {
+            "loaded": "{target}/doc?n={tag}-later",
+            "observer": "fixture"
+          },
+          {
+            "registration": "any",
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      }
+    },
     {
       "id": "C4.static-cross-site",
       "family": "C",
@@ -5458,11 +5759,24 @@
           "means": "a child frame is a chrome-error page for {target}/doc?n={tag}",
           "dependsOn": ["refused.8"],
           "check": {
-            "result": "frameTree",
-            "path": "result",
-            "equals": {
-              "$regex": "chrome-error://"
-            },
+            "any": [
+              {
+                "result": "frameTree",
+                "path": "result",
+                "equals": {
+                  "$regex": "chrome-error://"
+                },
+                "observer": "client"
+              },
+              {
+                "frameBlocked": {
+                  "url": "{target}/doc?n={tag}",
+                  "session": "page",
+                  "frame": true
+                },
+                "observer": "unguarded"
+              }
+            ],
             "observer": "client"
           }
         }
@@ -5690,11 +6004,24 @@
           "means": "a child frame is a chrome-error page for {target}/doc?n={tag}",
           "dependsOn": ["refused.8"],
           "check": {
-            "result": "frameTree",
-            "path": "result",
-            "equals": {
-              "$regex": "chrome-error://"
-            },
+            "any": [
+              {
+                "result": "frameTree",
+                "path": "result",
+                "equals": {
+                  "$regex": "chrome-error://"
+                },
+                "observer": "client"
+              },
+              {
+                "frameBlocked": {
+                  "url": "{target}/doc?n={tag}",
+                  "session": "page",
+                  "frame": true
+                },
+                "observer": "unguarded"
+              }
+            ],
             "observer": "client"
           }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.7.7",
+  "version": "1.7.8",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,7 +65,7 @@
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish",
     "release": "semantic-release",
     "test:guard": "npm run test:guard-integration && npm run test:guard-sweep",
-    "test:guard-integration": "node --test test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs",
+    "test:guard-integration": "node --test test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-diagnostics.test.mjs",
     "test:guard-sweep": "node scripts/test-guards.mjs",
     "test:guard-target": "node --test test/integration/guard-runner.test.mjs",
     "test:unit:guard": "node --experimental-test-coverage --test --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-lines=100 test/unit/guard-*.test.mjs"

package/schema/browsers.schema.json

@@ -75,7 +75,8 @@
         "wsOnly": { "const": true },
         "six": { "const": true },
         "sevenOpen": { "type": "boolean" },
-        "sevenTabs": { "type": "array", "items": { "$ref": "#/$defs/tab" } }
+        "sevenTabs": { "type": "array", "items": { "$ref": "#/$defs/tab" } },
+        "tabs": { "type": "array", "items": { "$ref": "#/$defs/tab" } }
       }
     },
     "installed": {

package/schema/corpus.schema.json

@@ -47,7 +47,8 @@
               "probe",
               "origins",
               "installed",
-              "six"
+              "six",
+              "tabs"
             ]
           }
         },

package/schema/guard-vectors.schema.json

@@ -582,6 +582,9 @@
                 "beacon": {
                   "type": "string"
                 },
+                "served": {
+                  "type": "string"
+                },
                 "title": {
                   "type": "string"
                 },