@ai-ecoverse/slicc-browsers 1.8.3 → 1.8.5

package/README.md

@@ -94,7 +94,7 @@ Every feature builds for `wasm32-wasip1`.
   - `discardExceptions`: where the site pattern and the extra origins' hosts go, as a `list` of strings or as a `chrome-time-map`, a map from site to the time it was added (microseconds since 1601-01-01 UTC, as a decimal string);
   - `cleanExit`: values that mark the last exit clean;
   - `form` says where a key comes from: `six` (SLICC six's keys) or `chrome-154` (what Chrome 154 reads).
-- `protectedOrigins`: what browser control must never reach, see [Protected origins](#protected-origins). `domains` (`sliccy.ai`), `hosts` (`vault.sliccy.ai`), `schemes` (`https`, `http`), `innerSchemes` (`blob`, `filesystem`, `view-source`), `anySchemes` (`devtools`), `protectedSchemes` (`chrome`, `chrome-untrusted`, `chrome-extension`, `devtools`, `edge`, `brave`, `opera`, `vivaldi`, `arc`, `file`) with `schemeExceptions` (`chrome://newtab`, `chrome://new-tab-page`, `chrome-untrusted://new-tab-page`, `edge://newtab`, `brave://newtab`, `opera://startpage`), `aboutScheme` (`chrome`), `targetTypes` (`browser_ui`), `inheriting` (`about:blank`, `about:srcdoc`), and `refusal`, the text of a refusal.
+- `protectedOrigins`: what browser control must never reach, see [Protected origins](#protected-origins). `domains` (`sliccy.ai`), `hosts` (`vault.sliccy.ai`), `schemes` (`https`, `http`), `innerSchemes` (`blob`, `filesystem`, `view-source`), `anySchemes` (`devtools`), `protectedSchemes` (`chrome`, `chrome-untrusted`, `chrome-search`, `chrome-native`, `chrome-distiller`, `chrome-experimental-site-token-provider`, `isolated-app`, `externalfile`, `content`, `chrome-extension`, `devtools`, `edge`, `brave`, `opera`, `vivaldi`, `arc`, `file`) with `schemeExceptions` (`chrome://newtab`, `chrome://new-tab-page`, `chrome-untrusted://new-tab-page`, `edge://newtab`, `brave://newtab`, `opera://startpage`), `aboutScheme` (`chrome`), `targetTypes` (`browser_ui`), `inheriting` (`about:blank`, `about:srcdoc`), and `refusal`, the text of a refusal.
 - `profiles`: SLICC profiles live in `<config dir>/<root>/<name>`, and a snap's in `~/snap/<snap>/common/<snapRoot>/<name>`. `legacyRoot` is the old root, never scanned; on macOS's case-insensitive volume it is SLICC six's root too. `sixProfilePattern` matches six's profile names, case-insensitively. `namePattern` is a valid profile name. `six` describes SLICC six's Chrome profiles (see [SLICC six's profiles](#slicc-sixs-profiles)):
   - `roots`: six's profile root per OS (`macos`, `linux`, `windows`), a `base` location followed by the `path` segments. The base is its `env` when that is set and not empty (any value, as six takes it), else `home` under the home dir.
   - `defaultName` (`browser-coding-agent-chrome`), `defaultPort` (5710) and `portSuffix` (`-{port}`): six's profile for its serve port `<port>` is `<root>/<defaultName>`, with `portSuffix` added for any port other than `defaultPort`.
@@ -120,8 +120,35 @@ Browser control must never navigate to, open or attach to a target on seven's ow
 
 This is wider than the rule for finding seven (`seven.originHostPattern`, which leaves out the `excludedLabels` and `excludedLabelPrefixes`—`www`, `vault`, `vault-preview`, `get`, `mcpcat`, `echo`, and any `vault-*` prefix). Every `sliccy.ai` host shares the `sliccy.ai` cookies, and cookies ignore the port and, without `Secure`, the scheme. SLICC six lives on `www.sliccy.ai` and the apex, and its cookies matter. `*.kernel.localhost` is not protected: each port is its own origin, and the agent's own servers live there. An extra origin is matched exactly, so `http://127.0.0.1:5710` doesn't protect `http://127.0.0.1:5711`.
 
+**Chromium scheme audit.** Checked [content scheme registration](https://github.com/chromium/chromium/blob/d0bfaae35fa745d9dee525dc4ff6617b1551dbe7/content/common/url_schemes.cc) and [Chrome additional schemes](https://github.com/chromium/chromium/blob/d0bfaae35fa745d9dee525dc4ff6617b1551dbe7/chrome/common/chrome_content_client.cc), including platform-specific registrations:
+
+| Scheme | Decision and reason |
+| --- | --- |
+| `chrome` | Protected: browser WebUI, with only the catalog's exact new-tab host exceptions. |
+| `chrome-untrusted` | Protected: browser-owned isolated UI resources, except the exact `new-tab-page` host. |
+| `chrome-search` | Protected: Instant/search-provider UI and profile resources, including `local-ntp`, `most-visited` and `remote-ntp`; hiding targets is not refusal. |
+| `chrome-native` | Protected: browser UI rendered by platform-native widgets instead of HTML. |
+| `chrome-distiller` | Protected: browser-generated reader-mode documents, which may contain content distilled from a protected document. |
+| `chrome-error` | Not scheme-wide protected: generic network-error documents hold no protected document content; ordinary errors must remain readable and recoverable. |
+| `isolated-app` | Protected: installed isolated web apps have app-specific storage and privileged capabilities outside ordinary web origins. |
+| `devtools` | Protected already: a DevTools front end can inspect a protected target. |
+| `chrome-extension` | Protected already: extension documents and workers can contain credentials and browser privileges. |
+| `chrome-experimental-site-token-provider` | Protected: an internal data source issues site-specific tokens. |
+| `externalfile` | Protected: ChromeOS local/external file access must not bypass the `file` fence. |
+| `file` | Protected already: local files must not bypass the agent's file-system fence. |
+| `content` | Protected: Android local content-provider access must not bypass the `file` fence. |
+| `android-app` | Not scheme-wide protected: Android app/referrer identity, not a browser UI document; extra-origin rules still apply. |
+| `googlechrome` | Not scheme-wide protected: an external launch alias, not registered as a privileged document scheme by these entry points. |
+| `view-source`, `blob`, `filesystem` | Not blindly scheme-wide protected: existing recursive inner-origin rules protect what they wrap. |
+| `about` | Not blindly scheme-wide protected: existing Chromium alias rewriting protects UI while retaining inheriting blank/srcdoc URLs. |
+| `http`, `https`, `data`, `javascript`, `ws`, `wss`, `mailto`, `webcal` | Not scheme-wide protected: ordinary web, inline content, transport or external handlers, not privileged browser UI. |
+
+A guard must refuse navigation, creation and attach on protected schemes, including protected frames of an otherwise ordinary tab, rather than merely hiding them from discovery. `chrome-error` is deliberately not a protected scheme: ordinary DNS, connection and certificate failures produce that same generic document, so scheme-wide refusal would prevent reattaching to an ordinary error tab. Error pages hold no secrets from the failed document. This does not permit opening or attaching to a protected origin: guards still fail protected navigations before commit and enforce protected-target provenance; C1–C5 observer-only `unreachableUrl`, history and network block evidence is unchanged.
+
 **New-tab checks (1.8.2).** In fresh default profiles on macOS, Chrome for Testing 156.0.8078.4 (Playwright build 1248) and Chrome 155.0.8059.82 commit `chrome://newtab/` to `chrome://new-tab-page/` and embed `chrome-untrusted://new-tab-page/one-google-bar?paramsencoded=` as an out-of-process frame. Direct `chrome://new-tab-page/` also commits as itself. Edge 155.0.4283.60 commits `edge://newtab/` to `https://ntp.msn.com/edge/ntp` with an `about:blank` child and no internal-scheme child observed; directly opening `edge://ntp/` returns `ERR_INVALID_URL`. These observations are for fresh default profiles, not every browser configuration. Brave, Opera and Vivaldi were not installed locally, and this repository's CI installs only Chromium, so their redirects and internal frames were not verified and no additional exceptions are inferred. Incognito Chrome and Edge new tabs omit the ordinary new tab's frame tree; the reachability vector therefore uses the default context.
 
+**Privileged-scheme follow-up checks.** With the expanded catalog, fresh default-profile Chrome for Testing 156.0.8078.4 on macOS again committed both NTP entry points to `chrome://new-tab-page/`, with an `about:blank` background child and only `chrome-untrusted://new-tab-page/one-google-bar?paramsencoded=` as its internal-scheme OOPIF. `C8.newtab` passed both attach and ordinary-navigation legs; no `chrome-search` exceptions are added or inferred for other profile/search-provider configurations. Direct `Page.navigate` to `chrome-search://most-visited/` returned `net::ERR_INVALID_URL` and committed `chrome-error://chromewebdata/` with that exact `unreachableUrl`, confirming why `C8.chrome-search` distinguishes a browser response from a guard refusal rather than requiring a successful search-document commit. The catalog-adopting emulator passed every C8 protection row; plain clients failed them, and removing only `chrome-search` from the adopted catalog failed the new row. C1.href, C2.302, C3.popup-self-nav, all tested C4 iframe process layouts and C5.document passed their guarded and control legs with the expanded schemes; plain clients passed controls and failed protection expectations. Those HTTP fixtures deliberately protect only the seven host, leaving their same-site control host ordinary, while adopting every internal-scheme rule unchanged.
+
 **The vault.** `vault.sliccy.ai` is in `hosts` by name, and vault branch previews (`vault-preview.sliccy.ai`, `vault-*.sliccy.ai`) are covered by the `sliccy.ai` domain rule. `sliccy.ai` already covers them all, but vault must stay protected even if `domains` ever changes: the vault must never be a CDP target for agent tools. The one exception is slicc-cli's own pairing attach for the vault, which is the CLI's own connection and not browser control handed to the agent.
 
 **Targets.** A target whose `TargetInfo.type` is one of `targetTypes` (`browser_ui`, Chrome's own UI such as `chrome://omnibox-popup.top-chrome/`) is always protected, whatever its URL. Otherwise a target's effective origin is its URL's (`TargetInfo.url`), except when the URL inherits the origin of whoever made the document: the empty URL, and `inheriting` with any query or fragment. Such a target is protected when it was protected before this URL (a seven tab that went to `about:blank` keeps seven's origin), or when its opener (`openerId`, else `openerFrameId`) is protected or unknown, for an opener closed before the program saw it. The URL, `openerFrameId` and `browserContextId` alone can't tell: a blank popup that seven opens has seven's origin and the URL `about:blank`. A program that holds a session to the target also has the document's real origin: the main frame's `securityOrigin` in `Page.frameNavigated`, and the default context's `origin` in `Runtime.executionContextCreated`. When one of those is protected, the target is protected too, until a URL with an origin of its own replaces it.
@@ -143,14 +170,20 @@ Every CDP guard runs the vectors in `guard-vectors.json` (schema `schema/guard-v
 - slicc-cdp's `test/integration/guard-vectors.json` at `4907a45`, where its `E1`, `E2`, `E3`, `E5` and `B2` are renamed `E1.onload`, `E2.binding`, `E3.bypass-csp`, `E5.console` and `B2.headers`;
 - the cert lane's E and B rows;
 - `C5.continue-request` and `C5.continue-response`, added next to `C5.document`;
-- the `C8` rows for privileged pages: `C8.navigate` (a page navigates to `chrome://settings`, `chrome://password-manager`, an extension page or `file:///`; refused), `C8.view-source` (the same through `view-source:`; refused), `C8.create` (`Target.createTarget` straight on those pages; refused), `C8.browser-ui-listed` (`Target.getTargets` lists no `browser_ui` target) and `C8.browser-ui-attach` (`Target.attachToTarget` by a `browser_ui` target's id; refused). All four have an unguarded control, since the guard refuses them only on the privileged target. Two cases aren't rows, because Chrome itself blocks them, so an unguarded client can't tell a guard from none: a page's `window.open('chrome://settings')`, and an `about:` alias such as `about:settings`, which `Page.navigate` and `Target.createTarget` both turn into `about:blank#blocked`. The `about:` aliases are in `protected.json` instead.
+- the `C8` rows for privileged pages: `C8.navigate` (a page navigates to `chrome://settings`, `chrome://password-manager`, an extension page or `file:///`; refused), `C8.view-source` (the same through `view-source:`; refused), `C8.create` (`Target.createTarget` straight on those pages; refused), `C8.browser-ui-listed` (`Target.getTargets` lists no `browser_ui` target) and `C8.browser-ui-attach` (`Target.attachToTarget` by a `browser_ui` target's id; refused). All five have an unguarded control, since the guard refuses them only on the privileged target. Two cases aren't rows, because Chrome itself blocks them, so an unguarded client can't tell a guard from none: a page's `window.open('chrome://settings')`, and an `about:` alias such as `about:settings`, which `Page.navigate` and `Target.createTarget` both turn into `about:blank#blocked`. The `about:` aliases are in `protected.json` instead.
+
+`C8.chrome-search` requests `chrome-search://most-visited/` through `Page.navigate` and requires an explicit guard refusal. Its unguarded control requires a CDP response, not a successful document commit: Chrome can answer with `errorText` when that internal data source is unavailable outside an Instant process. Browser-side load failure is not a guard refusal, and merely hiding the target must fail this row.
+
+The `C8.newtab` reachability control attaches through the guard to a settled ordinary new tab, including its internal frames, then navigates that same tab to an ordinary document. Both legs must succeed, including without a guard. It requires `chromeUrlsAttach`, so an extension transport reports it as `skip` with `not-supported:chromeUrlsAttach`. The C8 protection rows expect a refusal on the guarded leg and run their controls unguarded, so they don't require it and still run on extension transports. It uses the default browser context, since an incognito new tab omits the ordinary new tab's internal frames. It covers `chrome://newtab/` and directly opened `chrome://new-tab-page/`.
+
+`C8.network-error` and `C8.iframe-error` are ordinary-error reachability controls: request the configured `network-error` URL (default `http://nonexistent.invalid/`) directly or in an ordinary iframe, observe a failed Document request, reattach to the settled tab, evaluate and snapshot its document, then navigate the same tab to an ordinary document. Both control and guarded legs must pass. The failing URL is unchanged on the control, rather than replaced with a healthy origin, and the rows require `browserSession` but not `chromeUrlsAttach`. With Chrome for Testing 156.0.8078.4, scheme-wide `chrome-error` protection made the direct-error row fail both legs because reattachment was refused; removing it passed both rows, with readable DOM and successful recovery. The old emulator still allowed the cross-process iframe parent because the iframe TargetInfo kept the failing HTTP URL, but that layout-specific behavior is not grounds for protecting the error scheme. Plain-client controls and reachability legs also passed both rows.
 
-The `C8.newtab` reachability control attaches through the guard to a settled ordinary new tab, including its internal frames, then navigates that same tab to an ordinary document. Both legs must succeed, including without a guard. It requires `chromeUrlsAttach`, so an extension transport reports it as `skip` with `not-supported:chromeUrlsAttach`. The other C8 rows expect a refusal on the guarded leg and run their controls unguarded, so they don't require it and still run on extension transports. It uses the default browser context, since an incognito new tab omits the ordinary new tab's internal frames. It covers `chrome://newtab/` and directly opened `chrome://new-tab-page/`.
+A client may register `Fetch.enable` patterns naming a protected origin in either of two conformant ways: the guard allows registration but never pauses or forwards protected requests to the client and refuses continue, fulfil or fail calls for request ids it did not hand out; or the guard refuses registration with its declared refusal text. Setup calls explicitly naming a protected placeholder are refusable with `refusal.onlyProtected: true`, and interception-dependent observations depend on that refusal. Wildcard and ordinary-only patterns do not receive this exemption. The ordinary-origin control still runs through the guard and must succeed.
 
 **Top level.**
 - `schemaVersion` (1): guards pin it.
 - `setVersion`: the package version. The release flow stamps it into the npm package and the crate (`scripts/set-crate-version.mjs`). In git, and so in the Go module, it reads `0.0.0`; Go code gets the version from the module.
-- `targets`: the names a runner maps to a scheme, host and port: `seven`, `vault`, `vault-x` (a vault branch preview), `apex`, `own` (the client page's origin, `{client}`), `ordinary`, `ordinary-same-site`, `chrome-newtab`, `chrome-new-tab-page`, `chrome-settings`, `chrome-passwords`, `chrome-extension-page` and `file-root`. Each has a `description` and, for the protected ones, a default `host`. `chrome-newtab` (`chrome://newtab/`), `chrome-new-tab-page` (`chrome://new-tab-page/`), `chrome-settings` (`chrome://settings/`), `chrome-passwords` (`chrome://password-manager/`), `chrome-extension-page` (a page of Chrome's built-in PDF viewer extension) and `file-root` (`file:///`) carry a `url`, which the runner uses unless `targets` maps the name to something else. No other URL in the file is one a runner must use.
+- `targets`: the names a runner maps to a scheme, host and port: `seven`, `vault`, `vault-x` (a vault branch preview), `apex`, `own` (the client page's origin, `{client}`), `ordinary`, `ordinary-same-site`, `chrome-newtab`, `chrome-new-tab-page`, `chrome-settings`, `chrome-passwords`, `chrome-search`, `network-error`, `chrome-extension-page` and `file-root`. Each has a `description` and, for the protected ones, a default `host`. `chrome-newtab` (`chrome://newtab/`), `chrome-new-tab-page` (`chrome://new-tab-page/`), `chrome-settings` (`chrome://settings/`), `chrome-passwords` (`chrome://password-manager/`), `chrome-search` (`chrome-search://most-visited/`), `network-error` (`http://nonexistent.invalid/`), `chrome-extension-page` (a page of Chrome's built-in PDF viewer extension) and `file-root` (`file:///`) carry a `url`, which the runner uses unless `targets` maps the name to something else. No other URL in the file is one a runner must use.
 - `variants`: the detach variants in ms. `prompt` and `lagging` are documented; a runner may add others, such as `lagging-8s`, and reports the name it ran.
 - `capabilities`: what a transport may lack. `autoAttach` covers `Target.setAutoAttach`, `children` steps and child sessions; `browserSession` covers calls on the browser session; `browserContexts` covers `Target.createBrowserContext` and `Target.disposeBrowserContext`; `chromeUrlsAttach` means the transport can attach to and drive `chrome://` pages. CDP over a DevTools port can; `chrome.debugger` can't, since Chrome refuses it every `chrome://` page, even with `--extensions-on-chrome-urls`.
 - `placeholders`: every `{name}` used in the vectors, with what it stands for. `{client}` is the client page's origin, which the runner maps.
@@ -160,7 +193,7 @@ The `C8.newtab` reachability control attaches through the guard to a settled ord
 - `kind`: `cdp` (runnable steps) or `text` (rows in words, which runners report as `not-run`, never `pass`);
 - `scope`: `any`, or the one guard the vector is for;
 - `setup` and `trigger`, both lists of steps;
-- `targets`: the protected targets it runs against;
+- `targets`: the protected or reachability targets it runs against;
 - `requires?`: the capabilities it needs, the union of its steps' and observations' `requires`. A runner whose transport lacks one reports the vector as `skip` with the reason `not-supported:<capability>`. A row with a `page-or-browser` cookie step that would carry a `browserContextId` reports `not-supported:browserSession` without a browser session, because that parameter is only allowed on the browser target;
 - `observe?`: each observed name, as `{ "means", "dependsOn"?, "requires"?, "eitherWhen"? }`. `dependsOn` lists the refusals the observation depends on (see Refusals). `eitherWhen` is a check: when it holds on the guarded leg, that observation's expectation becomes `"either"` there (see Design-dependent outcomes);
 - `live`: the liveness check;
@@ -169,7 +202,7 @@ The `C8.newtab` reachability control attaches through the guard to a settled ord
 
 **Steps** are declarative and transport-neutral. Any step can take `on` (`control` or `guarded`), which runs it on that leg only.
 Any `cdp`, `page` or `children` step can take `requires`, the capabilities it needs: `autoAttach` for `Target.setAutoAttach`, `children` and `session: "child"`, `browserSession` for `session: "browser"`, `browserContexts` for `Target.createBrowserContext` and `Target.disposeBrowserContext`, and `chromeUrlsAttach` for a step that must attach to a `chrome://` page to pass.
-- `{ "cdp": method, "params"?, "session"?, "as"?, "refusable"?, "refusal"? }`: a CDP call. It runs on the page session by default, on the browser with `browser`, on either with `page-or-browser` (the driver uses the page session), or on the current auto-attached target with `child`. `as` names its outcome. `refusable: true` with `refusal: { "match" }` (a regular expression for the error message or code) marks a call that a guard may refuse at registration.
+- `{ "cdp": method, "params"?, "session"?, "as"?, "refusable"?, "refusal"? }`: a CDP call. It runs on the page session by default, on the browser with `browser`, on either with `page-or-browser` (the driver uses the page session), or on the current auto-attached target with `child`. `as` names its outcome. `refusable: true` with `refusal: { "match", "onlyProtected"? }` (a regular expression for the error message or code) marks a call that a guard may refuse at registration.
 - `{ "page": action, … }`:
   - `tab`: a new tab at `url`, in `context`, which becomes the page. `background` defaults to `true`;
   - `navigate`: go to `url` and wait for the load;
@@ -202,7 +235,7 @@ Popups are observed by `Target.targetCreated` with the opener's `openerId`, or b
 
 **The control rule.** Every vector has a control on an ordinary origin: the same setup and trigger against an unprotected origin must succeed. A missing or failing control fails the id. With `via: "guard"`, the control runs through the guard. With `via: "unguarded"`, the runner runs setup and trigger through its own CDP against the ordinary origin and against the protected stand-in, and both must show the effect. The runner reports the control's transport as `via`.
 
-**Refusals.** Each refusable step has a refusal name: its `as`, or `refused.<i>`, where `i` is its index in the vector's steps, setup then trigger, with each `children` step's steps right after it, counted from 0 before `on` is applied. When a guard refuses the step and the error matches `refusal.match`, the runner sets that name to `true` in the leg's observations. On that leg, an observation whose `dependsOn` lists the name is skipped; every other observation is checked as usual. A guard that refuses the step on every origin passes in one of two ways: through the guard, with the step refused on both legs, or with an unguarded control and the guard's matched refusal on the guarded leg. With `via: "guard"`, a refusal on one leg only fails that leg. The comparison only counts steps that ran on both legs. A step that ran on one leg only (for example a `children` step on the control's popup, when the guarded leg never gets that popup attached) doesn't fail the row by itself, and the row reports it in `ran`, as `{ "refused.5": "control-only" }` or `"guarded-only"`. Observations that depend on such a step follow their `dependsOn` on each leg. A refusable step that fails without a matching refusal, for example with an internal error or a timeout, is not a refusal: it fails the row with `<name> failed without a refusal: <message>`. A step skipped because an earlier step failed therefore never passes through `ran`, and only a matched refusal skips the observations that depend on it. A guard that allows the step must pass its control through the guard.
+**Refusals.** Each refusable step has a refusal name: its `as`, or `refused.<i>`, where `i` is its index in the vector's steps, setup then trigger, with each `children` step's steps right after it, counted from 0 before `on` is applied. When a guard refuses the step and the error matches `refusal.match`, the runner sets that name to `true` in the leg's observations. On that leg, an observation whose `dependsOn` lists the name is skipped; every other observation is checked as usual. A guard that refuses the step on every origin passes in one of two ways: through the guard, with the step refused on both legs, or with an unguarded control and the guard's matched refusal on the guarded leg. With `via: "guard"`, a refusal on one leg only fails that leg, unless the step declares `refusal.onlyProtected: true`: its matched refusal on the guarded leg alone is conformant, and its dependent observations are skipped there. Refusing such a step on the control always fails the control, even if both legs are refused. Without that flag, refusal symmetry is unchanged. The comparison only counts steps that ran on both legs. A step that ran on one leg only (for example a `children` step on the control's popup, when the guarded leg never gets that popup attached) doesn't fail the row by itself, and the row reports it in `ran`, as `{ "refused.5": "control-only" }` or `"guarded-only"`. Observations that depend on such a step follow their `dependsOn` on each leg. A refusable step that fails without a matching refusal, for example with an internal error or a timeout, is not a refusal: it fails the row with `<name> failed without a refusal: <message>`. A step skipped because an earlier step failed therefore never passes through `ran`, and only a matched refusal skips the observations that depend on it. A guard that allows the step must pass its control through the guard.
 
 **Liveness.** A runner checks `live` through its own CDP, never through the guard path: either the protected document loaded (title, marker or URL), or the guard returned its own refusal for a refusable step. A failing `live` fails the id.
 
@@ -286,7 +319,7 @@ extension on `chrome.debugger` leaves it out, so `C8.newtab` is skipped with
 `not-supported:chromeUrlsAttach`. `capabilities.scope` selects owner-specific rows.
 
 Map `ordinary`, `ordinary-same-site`, `seven`, `vault`, `vault-x`, `apex`, `own`
-and `client` to origins. `chrome-newtab`, `chrome-new-tab-page`, `chrome-settings`, `chrome-passwords`, `chrome-extension-page` and `file-root` default to their `url`.
+and `client` to origins. `chrome-newtab`, `chrome-new-tab-page`, `chrome-settings`, `chrome-passwords`, `chrome-search`, `network-error`, `chrome-extension-page` and `file-root` default to their `url`.
 `{browserUi}` is the id of one of Chrome's own `browser_ui` targets, which the runner looks up through
 its unguarded observer (or the client) before the row; a row that uses it fails when there is none.
 A vector with `"defaultContext": true` runs in the browser's default context even with the
@@ -538,7 +571,7 @@ for case in corpus().cases {
 Go 1.26, Rust stable with `wasm32-wasip1`, Node ≥ 24.
 - `npm run corpus` regenerates `corpus.json` from `corpus/`; the pre-commit hook and CI fail when it's stale.
 - `npm run validate` checks `catalog.json`, `corpus.json`, `protected.json` and `guard-vectors.json` against the schemas, runs the protected-origin vectors through `protected.mjs`, and checks what a schema can't say: unique ids, bundle ids and names, known Windows roots, rising tiers, compiling patterns, known tokens, tier order, `sevenOpen`, `tabs` (which holds no entry of `sevenTabs`), `six` and `auto` in each `expected.json`, and no port from 9222 to 9229.
-- Every gate prints one verdict line when it passes: `validate: PASS …`, `corpus: PASS <n> cases` (`node scripts/corpus.mjs --check`), `major-guard: PASS v<version> fits <module>`, and `guard-sweep: PASS 11 targets` (`npm run test:guard-sweep`). CI runs each through `scripts/gate.mjs --expect <regex> -- <command>`, which fails when the command exits non-zero or prints no matching line, so a silent or early exit never reads as a pass. `gate.mjs --expect <regex> --in <file>` checks a log instead; the release job uses it on semantic-release's log for the major-guard line. `npm run test:gates` tests the gates, including runs through a symlinked checkout and a symlinked script.
+- Every gate prints one verdict line when it passes: `validate: PASS …`, `corpus: PASS <n> cases` (`node scripts/corpus.mjs --check`), `major-guard: PASS v<version> fits <module>`, and `guard-sweep: PASS 13 targets` (`npm run test:guard-sweep`). CI runs each through `scripts/gate.mjs --expect <regex> -- <command>`, which fails when the command exits non-zero or prints no matching line, so a silent or early exit never reads as a pass. `gate.mjs --expect <regex> --in <file>` checks a log instead; the release job uses it on semantic-release's log for the major-guard line. `npm run test:gates` tests the gates, including runs through a symlinked checkout and a symlinked script.
 - `npm run lint`: the slicc lint tools (Biome, no comments, no unit tests in git, `AGENTS.md`), `gofmt`, `go mod tidy -diff`, `go vet`, golangci-lint, `cargo fmt --check` and clippy.
 - `npm test`: `validate`, the Go tests in `test/integration/`, and `cargo test --all-features`.
 - `npm run build`: the Go module, the crate (also for `wasm32-wasip1`), and `npm pack --dry-run`.

package/catalog.json

@@ -711,6 +711,13 @@
     "protectedSchemes": [
       "chrome",
       "chrome-untrusted",
+      "chrome-search",
+      "chrome-native",
+      "chrome-distiller",
+      "chrome-experimental-site-token-provider",
+      "isolated-app",
+      "externalfile",
+      "content",
       "chrome-extension",
       "devtools",
       "edge",

package/guard-driver.mjs

@@ -152,6 +152,32 @@ export function judge(vector, side, observed) {
   return { pass: mismatches.length === 0, refused, skipped, mismatches };
 }
 
+const ranOn = (observed, name) => typeof observed?.[name] === 'boolean';
+
+const refusalRuns = (vector, control, guarded) =>
+  Object.fromEntries(
+    refusals(vector)
+      .filter((name) => control && guarded && ranOn(control, name) !== ranOn(guarded, name))
+      .map((name) => [name, ranOn(control, name) ? 'control-only' : 'guarded-only'])
+  );
+
+const protectedRefusals = (vector) =>
+  new Set(
+    flatten(named([...(vector.setup ?? []), ...(vector.trigger ?? [])]))
+      .filter((step) => step.refusable && step.refusal.onlyProtected)
+      .map((step) => step.refusal.name)
+  );
+
+function controlRefusal(c, g, via, only, onlyProtected) {
+  if (!c) return 'no control';
+  if (c.refused.length > 0 && via !== 'guard') return 'an unguarded control was refused';
+  if (c.refused.some((name) => onlyProtected.has(name)))
+    return 'a protected-only step was refused on the control';
+  if (via === 'guard' && g && only(c, g).length > 0)
+    return `refused only on the control: ${only(c, g).join(', ')}`;
+  return null;
+}
+
 export function result(vector, run) {
   const row = {
     id: vector.id,
@@ -173,33 +199,22 @@ export function result(vector, run) {
   }
   const c = run.control ? judge(vector, 'control', run.control) : null;
   const g = run.guarded ? judge(vector, 'guarded', run.guarded) : null;
-  const ranOn = (observed, name) => typeof observed?.[name] === 'boolean';
   const both = (name) => ranOn(run.control, name) && ranOn(run.guarded, name);
   const only = (a, b) =>
     (a?.refused ?? []).filter((name) => both(name) && !(b?.refused ?? []).includes(name));
-  const ran = Object.fromEntries(
-    refusals(vector)
-      .filter(
-        (name) =>
-          run.control && run.guarded && ranOn(run.control, name) !== ranOn(run.guarded, name)
-      )
-      .map((name) => [name, ranOn(run.control, name) ? 'control-only' : 'guarded-only'])
-  );
+  const ran = refusalRuns(vector, run.control, run.guarded);
+  const onlyProtected = protectedRefusals(vector);
+  const protectedOnly = only(g, c).filter((name) => !onlyProtected.has(name));
   const why = [];
-  let control = c?.pass ? 'pass' : 'fail';
-  if (!c) why.push('no control');
-  else if (c.refused.length > 0 && row.via !== 'guard') {
-    control = 'fail';
-    why.push('an unguarded control was refused');
-  } else if (row.via === 'guard' && g && only(c, g).length > 0) {
-    control = 'fail';
-    why.push(`refused only on the control: ${only(c, g).join(', ')}`);
-  } else why.push(...c.mismatches.map((m) => `control ${m}`));
+  const refusal = controlRefusal(c, g, row.via, only, onlyProtected);
+  const control = c?.pass && !refusal ? 'pass' : 'fail';
+  if (refusal) why.push(refusal);
+  else why.push(...c.mismatches.map((m) => `control ${m}`));
   let guarded = g?.pass ? 'pass' : 'fail';
   if (!g) why.push('no guarded run');
-  else if (row.via === 'guard' && only(g, c).length > 0) {
+  else if (row.via === 'guard' && protectedOnly.length > 0) {
     guarded = 'fail';
-    why.push(`refused only on the protected target: ${only(g, c).join(', ')}`);
+    why.push(`refused only on the protected target: ${protectedOnly.join(', ')}`);
   } else if (row.via === 'unguarded' && g.refused.length > 0 && !c?.pass) {
     guarded = 'fail';
     why.push('refused on the protected target without a passing control');

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.8.3",
+  "setVersion": "1.8.5",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -61,6 +61,14 @@
       "url": "chrome://settings/",
       "description": "Chrome's settings page, a privileged chrome: page"
     },
+    "network-error": {
+      "url": "http://nonexistent.invalid/",
+      "description": "an ordinary URL with a failing DNS lookup, used on both reachability legs"
+    },
+    "chrome-search": {
+      "url": "chrome-search://most-visited/",
+      "description": "Chrome's internal search UI, including NTP search-provider resources"
+    },
     "chrome-passwords": {
       "url": "chrome://password-manager/",
       "description": "Chrome's password manager, a privileged chrome: page"
@@ -94,6 +102,7 @@
     "own": "the own target's origin, which is {client}",
     "ordinary": "the ordinary origin the run starts from",
     "ordinary-same-site": "the ordinary-same-site origin",
+    "network-error": "the ordinary failing-network URL, unchanged on the control",
     "client": "the client page's origin, which the runner maps",
     "cross": "another ordinary origin, cross-site with {ordinary}",
     "plain": "an ordinary destination origin, the control target",
@@ -7806,6 +7815,11 @@
                 "requestStage": "Response"
               }
             ]
+          },
+          "refusable": true,
+          "refusal": {
+            "match": "^slicc: refused",
+            "onlyProtected": true
           }
         },
         {
@@ -7875,6 +7889,7 @@
       "targets": ["seven", "vault", "vault-x", "apex"],
       "observe": {
         "candidates": {
+          "dependsOn": ["refused.2"],
           "means": "attempts is not empty",
           "check": {
             "result": "attempts",
@@ -7886,6 +7901,7 @@
           }
         },
         "refused": {
+          "dependsOn": ["refused.2"],
           "means": "every attempt was refused",
           "check": {
             "refused": ["attempts"],
@@ -7893,6 +7909,7 @@
           }
         },
         "answered": {
+          "dependsOn": ["refused.2"],
           "means": "body is 'real-{tag}'",
           "check": {
             "result": "body",
@@ -7902,6 +7919,7 @@
           }
         },
         "overridden": {
+          "dependsOn": ["refused.2"],
           "means": "the fetch reported the overridden response status",
           "check": {
             "result": "body",
@@ -12442,6 +12460,376 @@
         "observer": "unguarded"
       }
     },
+    {
+      "id": "C8.network-error",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "text": "an ordinary tab hits a network error; the error document must remain readable, attachable and navigable"
+        },
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?tag={tag}"
+        },
+        {
+          "cdp": "Page.enable"
+        },
+        {
+          "cdp": "Network.enable"
+        }
+      ],
+      "trigger": [
+        {
+          "page": "navigate",
+          "url": "{network-error}"
+        },
+        {
+          "settle": {
+            "ms": 2500
+          }
+        },
+        {
+          "cdp": "Target.attachToTarget",
+          "params": {
+            "targetId": "{pageTarget}",
+            "flatten": true
+          },
+          "session": "browser",
+          "as": "attach",
+          "requires": ["browserSession"]
+        },
+        {
+          "page": "eval",
+          "expression": "Boolean(document.body)",
+          "as": "read"
+        },
+        {
+          "cdp": "DOM.getDocument",
+          "params": {
+            "depth": 1
+          },
+          "as": "snapshot"
+        },
+        {
+          "page": "navigate",
+          "url": "{ordinary}/doc?tag={tag}",
+          "as": "navigate"
+        },
+        {
+          "settle": {
+            "title": "doc",
+            "ms": 5000,
+            "required": true
+          }
+        }
+      ],
+      "targets": ["network-error"],
+      "requires": ["browserSession"],
+      "observe": {
+        "errorSeen": {
+          "means": "Chrome reported a failed ordinary document request before the tab navigated away",
+          "check": {
+            "event": "Network.loadingFailed",
+            "where": {
+              "params": {
+                "type": "Document",
+                "errorText": {
+                  "$regex": "^net::ERR_"
+                }
+              }
+            },
+            "observer": "client"
+          }
+        },
+        "attached": {
+          "means": "the client can reattach to the settled ordinary error tab, including an error iframe",
+          "check": {
+            "result": "attach",
+            "path": "ok",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "readable": {
+          "means": "the client can evaluate the error document or its ordinary iframe parent",
+          "check": {
+            "result": "read",
+            "path": "result.result.value",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "snapshotted": {
+          "means": "the client can snapshot the error document or its ordinary iframe parent",
+          "check": {
+            "result": "snapshot",
+            "path": "result.root.nodeName",
+            "equals": "#document",
+            "observer": "client"
+          }
+        },
+        "navigated": {
+          "means": "the same tab reached an ordinary document through the client",
+          "check": {
+            "title": "doc",
+            "via": "unguarded",
+            "observer": "unguarded"
+          }
+        }
+      },
+      "live": "the client sees an ordinary network error and the observer sees recovery to an ordinary document",
+      "control": {
+        "origin": "ordinary",
+        "via": "guard",
+        "expected": {
+          "errorSeen": true,
+          "attached": true,
+          "readable": true,
+          "snapshotted": true,
+          "navigated": true
+        }
+      },
+      "expected": {
+        "errorSeen": true,
+        "attached": true,
+        "readable": true,
+        "snapshotted": true,
+        "navigated": true
+      },
+      "liveCheck": {
+        "title": "doc",
+        "via": "unguarded",
+        "observer": "unguarded"
+      }
+    },
+    {
+      "id": "C8.iframe-error",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "setup": [
+        {
+          "text": "an ordinary tab embeds an ordinary iframe whose network request fails; its parent must remain readable, attachable and navigable"
+        },
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?tag={tag}"
+        },
+        {
+          "cdp": "Page.enable"
+        },
+        {
+          "cdp": "Network.enable"
+        }
+      ],
+      "trigger": [
+        {
+          "page": "framed",
+          "from": "{ordinary}",
+          "url": "{network-error}"
+        },
+        {
+          "settle": {
+            "ms": 2500
+          }
+        },
+        {
+          "cdp": "Target.attachToTarget",
+          "params": {
+            "targetId": "{pageTarget}",
+            "flatten": true
+          },
+          "session": "browser",
+          "as": "attach",
+          "requires": ["browserSession"]
+        },
+        {
+          "page": "eval",
+          "expression": "Boolean(document.body)",
+          "as": "read"
+        },
+        {
+          "cdp": "DOM.getDocument",
+          "params": {
+            "depth": 1
+          },
+          "as": "snapshot"
+        },
+        {
+          "page": "navigate",
+          "url": "{ordinary}/doc?tag={tag}",
+          "as": "navigate"
+        },
+        {
+          "settle": {
+            "title": "doc",
+            "ms": 5000,
+            "required": true
+          }
+        }
+      ],
+      "targets": ["network-error"],
+      "requires": ["browserSession"],
+      "observe": {
+        "errorSeen": {
+          "means": "Chrome reported a failed ordinary document request before the tab navigated away",
+          "check": {
+            "event": "Network.loadingFailed",
+            "where": {
+              "params": {
+                "type": "Document",
+                "errorText": {
+                  "$regex": "^net::ERR_"
+                }
+              }
+            },
+            "observer": "client"
+          }
+        },
+        "attached": {
+          "means": "the client can reattach to the settled ordinary error tab, including an error iframe",
+          "check": {
+            "result": "attach",
+            "path": "ok",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "readable": {
+          "means": "the client can evaluate the error document or its ordinary iframe parent",
+          "check": {
+            "result": "read",
+            "path": "result.result.value",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "snapshotted": {
+          "means": "the client can snapshot the error document or its ordinary iframe parent",
+          "check": {
+            "result": "snapshot",
+            "path": "result.root.nodeName",
+            "equals": "#document",
+            "observer": "client"
+          }
+        },
+        "navigated": {
+          "means": "the same tab reached an ordinary document through the client",
+          "check": {
+            "title": "doc",
+            "via": "unguarded",
+            "observer": "unguarded"
+          }
+        }
+      },
+      "live": "the client sees an ordinary network error and the observer sees recovery to an ordinary document",
+      "control": {
+        "origin": "ordinary",
+        "via": "guard",
+        "expected": {
+          "errorSeen": true,
+          "attached": true,
+          "readable": true,
+          "snapshotted": true,
+          "navigated": true
+        }
+      },
+      "expected": {
+        "errorSeen": true,
+        "attached": true,
+        "readable": true,
+        "snapshotted": true,
+        "navigated": true
+      },
+      "liveCheck": {
+        "title": "doc",
+        "via": "unguarded",
+        "observer": "unguarded"
+      }
+    },
+    {
+      "id": "C8.chrome-search",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "defaultContext": true,
+      "setup": [
+        {
+          "text": "a plain tab requests an internal search UI URL; Chrome may return an unavailable data-source error, but the guard must refuse before forwarding"
+        },
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n={tag}"
+        },
+        {
+          "cdp": "Page.enable"
+        }
+      ],
+      "trigger": [
+        {
+          "cdp": "Page.navigate",
+          "params": {
+            "url": "{target}"
+          },
+          "as": "nav",
+          "refusable": true,
+          "refusal": {
+            "match": "refused"
+          }
+        }
+      ],
+      "targets": ["chrome-search"],
+      "observe": {
+        "accepted": {
+          "means": "Chrome answered Page.navigate rather than a guard refusal, even if its internal data source is unavailable",
+          "dependsOn": ["nav"],
+          "check": {
+            "result": "nav",
+            "path": "ok",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "refused": {
+          "means": "the navigation was refused",
+          "dependsOn": [],
+          "check": {
+            "refused": ["nav"],
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the guard returned its explicit refusal, or Chrome answered the forwarded navigation request",
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "accepted": true,
+          "refused": false
+        }
+      },
+      "expected": {
+        "accepted": false,
+        "refused": true
+      },
+      "liveCheck": {
+        "any": [
+          {
+            "refused": ["nav"],
+            "observer": "client"
+          },
+          {
+            "result": "nav",
+            "path": "ok",
+            "equals": true,
+            "observer": "client"
+          }
+        ],
+        "observer": "client"
+      }
+    },
     {
       "id": "C8.navigate",
       "family": "C",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.8.3",
+  "version": "1.8.5",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,14 +65,14 @@
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish",
     "release": "semantic-release",
     "test:guard": "npm run test:guard-integration && npm run test:guard-sweep",
-    "test:guard-integration": "node --test test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-scales.test.mjs",
+    "test:guard-integration": "node --test test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-scales.test.mjs",
     "test:guard-sweep": "node scripts/test-guards.mjs",
     "test:gates": "node --test test/integration/gates.test.mjs",
     "test:guard-target": "node --test test/integration/guard-runner.test.mjs",
     "test:unit:guard": "node --experimental-test-coverage --test --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-lines=100 test/unit/guard-*.test.mjs"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-shared-web": "1.23.2",
+    "@ai-ecoverse/slicc-shared-web": "1.24.2",
     "@biomejs/biome": "2.5.15",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",

package/protected.json

@@ -326,6 +326,146 @@
       "url": "chrome://settings/",
       "protected": true
     },
+    {
+      "url": "chrome-search://local-ntp/",
+      "protected": true
+    },
+    {
+      "url": "view-source:chrome-search://local-ntp/",
+      "protected": true
+    },
+    {
+      "url": "https://ordinary.example.test/?next=chrome-search%3A%2F%2Flocal-ntp%2F",
+      "protected": false
+    },
+    {
+      "url": "chrome-search://most-visited/",
+      "protected": true
+    },
+    {
+      "url": "view-source:chrome-search://most-visited/",
+      "protected": true
+    },
+    {
+      "url": "https://ordinary.example.test/?next=chrome-search%3A%2F%2Fmost-visited%2F",
+      "protected": false
+    },
+    {
+      "url": "chrome-search://remote-ntp/",
+      "protected": true
+    },
+    {
+      "url": "view-source:chrome-search://remote-ntp/",
+      "protected": true
+    },
+    {
+      "url": "https://ordinary.example.test/?next=chrome-search%3A%2F%2Fremote-ntp%2F",
+      "protected": false
+    },
+    {
+      "url": "chrome-search://new-tab-page/",
+      "protected": true
+    },
+    {
+      "url": "view-source:chrome-search://new-tab-page/",
+      "protected": true
+    },
+    {
+      "url": "https://ordinary.example.test/?next=chrome-search%3A%2F%2Fnew-tab-page%2F",
+      "protected": false
+    },
+    {
+      "url": "chrome-native://newtab/",
+      "protected": true
+    },
+    {
+      "url": "view-source:chrome-native://newtab/",
+      "protected": true
+    },
+    {
+      "url": "https://ordinary.example.test/?next=chrome-native%3A%2F%2Fnewtab%2F",
+      "protected": false
+    },
+    {
+      "url": "chrome-distiller://reader/?url=https://example.test/",
+      "protected": true
+    },
+    {
+      "url": "view-source:chrome-distiller://reader/?url=https://example.test/",
+      "protected": true
+    },
+    {
+      "url": "https://ordinary.example.test/?next=chrome-distiller%3A%2F%2Freader%2F%3Furl%3Dhttps%3A%2F%2Fexample.test%2F",
+      "protected": false
+    },
+    {
+      "url": "chrome-error://chromewebdata/",
+      "protected": false
+    },
+    {
+      "url": "view-source:chrome-error://chromewebdata/",
+      "protected": false
+    },
+    {
+      "url": "https://ordinary.example.test/?next=chrome-error%3A%2F%2Fchromewebdata%2F",
+      "protected": false
+    },
+    {
+      "url": "chrome-experimental-site-token-provider://token/",
+      "protected": true
+    },
+    {
+      "url": "view-source:chrome-experimental-site-token-provider://token/",
+      "protected": true
+    },
+    {
+      "url": "https://ordinary.example.test/?next=chrome-experimental-site-token-provider%3A%2F%2Ftoken%2F",
+      "protected": false
+    },
+    {
+      "url": "isolated-app://app-id/",
+      "protected": true
+    },
+    {
+      "url": "view-source:isolated-app://app-id/",
+      "protected": true
+    },
+    {
+      "url": "https://ordinary.example.test/?next=isolated-app%3A%2F%2Fapp-id%2F",
+      "protected": false
+    },
+    {
+      "url": "externalfile://downloads/private.txt",
+      "protected": true
+    },
+    {
+      "url": "view-source:externalfile://downloads/private.txt",
+      "protected": true
+    },
+    {
+      "url": "https://ordinary.example.test/?next=externalfile%3A%2F%2Fdownloads%2Fprivate.txt",
+      "protected": false
+    },
+    {
+      "url": "content://provider/private.txt",
+      "protected": true
+    },
+    {
+      "url": "view-source:content://provider/private.txt",
+      "protected": true
+    },
+    {
+      "url": "https://ordinary.example.test/?next=content%3A%2F%2Fprovider%2Fprivate.txt",
+      "protected": false
+    },
+    {
+      "url": "android-app://com.example/https/example.test/",
+      "protected": false
+    },
+    {
+      "url": "googlechrome://example.test/",
+      "protected": false
+    },
     {
       "url": "chrome://settings/passwords",
       "protected": true
@@ -516,6 +656,86 @@
     }
   ],
   "targets": [
+    {
+      "url": "chrome-search://private/",
+      "type": "iframe",
+      "protected": true
+    },
+    {
+      "url": "https://ordinary.example.test/chrome-search",
+      "type": "page",
+      "protected": false
+    },
+    {
+      "url": "chrome-native://private/",
+      "type": "iframe",
+      "protected": true
+    },
+    {
+      "url": "https://ordinary.example.test/chrome-native",
+      "type": "page",
+      "protected": false
+    },
+    {
+      "url": "chrome-distiller://private/",
+      "type": "iframe",
+      "protected": true
+    },
+    {
+      "url": "https://ordinary.example.test/chrome-distiller",
+      "type": "page",
+      "protected": false
+    },
+    {
+      "url": "chrome-error://private/",
+      "type": "iframe",
+      "protected": false
+    },
+    {
+      "url": "https://ordinary.example.test/chrome-error",
+      "type": "page",
+      "protected": false
+    },
+    {
+      "url": "chrome-experimental-site-token-provider://private/",
+      "type": "iframe",
+      "protected": true
+    },
+    {
+      "url": "https://ordinary.example.test/chrome-experimental-site-token-provider",
+      "type": "page",
+      "protected": false
+    },
+    {
+      "url": "isolated-app://private/",
+      "type": "iframe",
+      "protected": true
+    },
+    {
+      "url": "https://ordinary.example.test/isolated-app",
+      "type": "page",
+      "protected": false
+    },
+    {
+      "url": "externalfile://private/",
+      "type": "iframe",
+      "protected": true
+    },
+    {
+      "url": "https://ordinary.example.test/externalfile",
+      "type": "page",
+      "protected": false
+    },
+    {
+      "url": "content://private/",
+      "type": "iframe",
+      "protected": true
+    },
+    {
+      "url": "https://ordinary.example.test/content",
+      "type": "page",
+      "protected": false
+    },
     {
       "url": "https://seven.sliccy.ai/",
       "protected": true

package/schema/guard-vectors.schema.json

@@ -170,6 +170,8 @@
         "chrome-new-tab-page",
         "chrome-settings",
         "chrome-passwords",
+        "chrome-search",
+        "network-error",
         "chrome-extension-page",
         "file-root"
       ]
@@ -456,6 +458,9 @@
               "additionalProperties": false,
               "required": ["match"],
               "properties": {
+                "onlyProtected": {
+                  "type": "boolean"
+                },
                 "match": {
                   "type": "string",
                   "minLength": 1