@ai-ecoverse/slicc-browsers 1.8.5 → 1.9.0

package/README.md

@@ -172,6 +172,10 @@ Every CDP guard runs the vectors in `guard-vectors.json` (schema `schema/guard-v
 - `C5.continue-request` and `C5.continue-response`, added next to `C5.document`;
 - the `C8` rows for privileged pages: `C8.navigate` (a page navigates to `chrome://settings`, `chrome://password-manager`, an extension page or `file:///`; refused), `C8.view-source` (the same through `view-source:`; refused), `C8.create` (`Target.createTarget` straight on those pages; refused), `C8.browser-ui-listed` (`Target.getTargets` lists no `browser_ui` target) and `C8.browser-ui-attach` (`Target.attachToTarget` by a `browser_ui` target's id; refused). All five have an unguarded control, since the guard refuses them only on the privileged target. Two cases aren't rows, because Chrome itself blocks them, so an unguarded client can't tell a guard from none: a page's `window.open('chrome://settings')`, and an `about:` alias such as `about:settings`, which `Page.navigate` and `Target.createTarget` both turn into `about:blank#blocked`. The `about:` aliases are in `protected.json` instead.
 
+The `C9` foreign extension isolated-world family requires `extensionWorld`: a browser hosting a foreign content-script extension on the ordinary fixture page. `C9.world-hidden` requires the page default context to remain visible after `Runtime.enable`, while the extension context and Runtime/Debugger identifiers remain hidden without cutting or detaching the session. `C9.world-select` probes numeric and unique context selectors, object and argument handles, promises, properties, named bindings and DOM node resolution; each guarded command must fail with the `slicc: refused:` prefix, never an ordinary browser error. `C9.world-debugger` pauses inside that content script: the control must reach its frame, while the guard must refuse or hide it. `C9.page-drivable` evaluates `self.origin`, captures a DOM snapshot and dispatches an Input click on the same ordinary page; cutting the entire session fails this regression row. All four use an unguarded control, the default browser context and observer discovery of the real extension world, not an invented isolated world. Protected default contexts remain session-cutting evidence; hiding a foreign isolated world does not weaken any seven-origin row.
+
+The integration launcher loads shared-web 1.25.1’s harness extension exactly once through `Extensions.loadUnpacked` (`ankmbodmgimjemnojmeddfcdlbocolob`), whose content script runs on HTTP(S) pages. shared-web 1.25.1 also loads it by default in its own harness. A transport unable to host a foreign content-script extension omits `extensionWorld` and reports `not-supported:extensionWorld`; an advertised capability with no observed world fails, rather than silently skipping.
+
 `C8.chrome-search` requests `chrome-search://most-visited/` through `Page.navigate` and requires an explicit guard refusal. Its unguarded control requires a CDP response, not a successful document commit: Chrome can answer with `errorText` when that internal data source is unavailable outside an Instant process. Browser-side load failure is not a guard refusal, and merely hiding the target must fail this row.
 
 The `C8.newtab` reachability control attaches through the guard to a settled ordinary new tab, including its internal frames, then navigates that same tab to an ordinary document. Both legs must succeed, including without a guard. It requires `chromeUrlsAttach`, so an extension transport reports it as `skip` with `not-supported:chromeUrlsAttach`. The C8 protection rows expect a refusal on the guarded leg and run their controls unguarded, so they don't require it and still run on extension transports. It uses the default browser context, since an incognito new tab omits the ordinary new tab's internal frames. It covers `chrome://newtab/` and directly opened `chrome://new-tab-page/`.
@@ -185,7 +189,7 @@ A client may register `Fetch.enable` patterns naming a protected origin in eithe
 - `setVersion`: the package version. The release flow stamps it into the npm package and the crate (`scripts/set-crate-version.mjs`). In git, and so in the Go module, it reads `0.0.0`; Go code gets the version from the module.
 - `targets`: the names a runner maps to a scheme, host and port: `seven`, `vault`, `vault-x` (a vault branch preview), `apex`, `own` (the client page's origin, `{client}`), `ordinary`, `ordinary-same-site`, `chrome-newtab`, `chrome-new-tab-page`, `chrome-settings`, `chrome-passwords`, `chrome-search`, `network-error`, `chrome-extension-page` and `file-root`. Each has a `description` and, for the protected ones, a default `host`. `chrome-newtab` (`chrome://newtab/`), `chrome-new-tab-page` (`chrome://new-tab-page/`), `chrome-settings` (`chrome://settings/`), `chrome-passwords` (`chrome://password-manager/`), `chrome-search` (`chrome-search://most-visited/`), `network-error` (`http://nonexistent.invalid/`), `chrome-extension-page` (a page of Chrome's built-in PDF viewer extension) and `file-root` (`file:///`) carry a `url`, which the runner uses unless `targets` maps the name to something else. No other URL in the file is one a runner must use.
 - `variants`: the detach variants in ms. `prompt` and `lagging` are documented; a runner may add others, such as `lagging-8s`, and reports the name it ran.
-- `capabilities`: what a transport may lack. `autoAttach` covers `Target.setAutoAttach`, `children` steps and child sessions; `browserSession` covers calls on the browser session; `browserContexts` covers `Target.createBrowserContext` and `Target.disposeBrowserContext`; `chromeUrlsAttach` means the transport can attach to and drive `chrome://` pages. CDP over a DevTools port can; `chrome.debugger` can't, since Chrome refuses it every `chrome://` page, even with `--extensions-on-chrome-urls`.
+- `capabilities`: what a transport may lack. `autoAttach` covers `Target.setAutoAttach`, `children` steps and child sessions; `browserSession` covers calls on the browser session; `browserContexts` covers `Target.createBrowserContext` and `Target.disposeBrowserContext`; `extensionWorld` means it can host a foreign content-script extension isolated world on the ordinary fixture; `chromeUrlsAttach` means the transport can attach to and drive `chrome://` pages. CDP over a DevTools port can; `chrome.debugger` can't, since Chrome refuses it every `chrome://` page, even with `--extensions-on-chrome-urls`.
 - `placeholders`: every `{name}` used in the vectors, with what it stands for. `{client}` is the client page's origin, which the runner maps.
 
 **A vector** has:
@@ -233,6 +237,8 @@ Popups are observed by `Target.targetCreated` with the opener's `openerId`, or b
 - `/plant`: sets the canary;
 - `/beacon`, and `/log?n=`, which returns `{ hits, beacons }`.
 
+`{ "extensionWorld": "hidden" | "select" | "debugger" | "drivable", "as": "world", "requires": ["extensionWorld"] }` runs the C9 compound probe on the current ordinary page. The runner attaches an independent observer to discover actual context ids, unique ids and names, and sends probes through the client session. Object handles are minted and validated on the unguarded control session, then replayed as guesses on the guarded leg; Chrome object handles and DOM node ids are session-local, so observer handles must never be mistaken for client handles. Numeric and unique context ids from the control are also replayed alongside fresh observer-discovered selectors. Every guarded replay needs an explicit refusal, including a stale handle (`not exposed`), rather than Chrome’s invalid-id error. Its result contains boolean evidence consumed by ordinary `result` checks. The unguarded leg validates those selectors against Chrome itself before guarded evidence can pass.
+
 **The control rule.** Every vector has a control on an ordinary origin: the same setup and trigger against an unprotected origin must succeed. A missing or failing control fails the id. With `via: "guard"`, the control runs through the guard. With `via: "unguarded"`, the runner runs setup and trigger through its own CDP against the ordinary origin and against the protected stand-in, and both must show the effect. The runner reports the control's transport as `via`.
 
 **Refusals.** Each refusable step has a refusal name: its `as`, or `refused.<i>`, where `i` is its index in the vector's steps, setup then trigger, with each `children` step's steps right after it, counted from 0 before `on` is applied. When a guard refuses the step and the error matches `refusal.match`, the runner sets that name to `true` in the leg's observations. On that leg, an observation whose `dependsOn` lists the name is skipped; every other observation is checked as usual. A guard that refuses the step on every origin passes in one of two ways: through the guard, with the step refused on both legs, or with an unguarded control and the guard's matched refusal on the guarded leg. With `via: "guard"`, a refusal on one leg only fails that leg, unless the step declares `refusal.onlyProtected: true`: its matched refusal on the guarded leg alone is conformant, and its dependent observations are skipped there. Refusing such a step on the control always fails the control, even if both legs are refused. Without that flag, refusal symmetry is unchanged. The comparison only counts steps that ran on both legs. A step that ran on one leg only (for example a `children` step on the control's popup, when the guarded leg never gets that popup attached) doesn't fail the row by itself, and the row reports it in `ran`, as `{ "refused.5": "control-only" }` or `"guarded-only"`. Observations that depend on such a step follow their `dependsOn` on each leg. A refusable step that fails without a matching refusal, for example with an internal error or a timeout, is not a refusal: it fails the row with `<name> failed without a refusal: <message>`. A step skipped because an earlier step failed therefore never passes through `ran`, and only a matched refusal skips the observations that depend on it. A guard that allows the step must pass its control through the guard.
@@ -571,7 +577,7 @@ for case in corpus().cases {
 Go 1.26, Rust stable with `wasm32-wasip1`, Node ≥ 24.
 - `npm run corpus` regenerates `corpus.json` from `corpus/`; the pre-commit hook and CI fail when it's stale.
 - `npm run validate` checks `catalog.json`, `corpus.json`, `protected.json` and `guard-vectors.json` against the schemas, runs the protected-origin vectors through `protected.mjs`, and checks what a schema can't say: unique ids, bundle ids and names, known Windows roots, rising tiers, compiling patterns, known tokens, tier order, `sevenOpen`, `tabs` (which holds no entry of `sevenTabs`), `six` and `auto` in each `expected.json`, and no port from 9222 to 9229.
-- Every gate prints one verdict line when it passes: `validate: PASS …`, `corpus: PASS <n> cases` (`node scripts/corpus.mjs --check`), `major-guard: PASS v<version> fits <module>`, and `guard-sweep: PASS 13 targets` (`npm run test:guard-sweep`). CI runs each through `scripts/gate.mjs --expect <regex> -- <command>`, which fails when the command exits non-zero or prints no matching line, so a silent or early exit never reads as a pass. `gate.mjs --expect <regex> --in <file>` checks a log instead; the release job uses it on semantic-release's log for the major-guard line. `npm run test:gates` tests the gates, including runs through a symlinked checkout and a symlinked script.
+- Every gate prints one verdict line when it passes: `validate: PASS …`, `corpus: PASS <n> cases` (`node scripts/corpus.mjs --check`), `major-guard: PASS v<version> fits <module>`, and `guard-sweep: PASS 14 targets` (`npm run test:guard-sweep`). CI runs each through `scripts/gate.mjs --expect <regex> -- <command>`, which fails when the command exits non-zero or prints no matching line, so a silent or early exit never reads as a pass. `gate.mjs --expect <regex> --in <file>` checks a log instead; the release job uses it on semantic-release's log for the major-guard line. `npm run test:gates` tests the gates, including runs through a symlinked checkout and a symlinked script.
 - `npm run lint`: the slicc lint tools (Biome, no comments, no unit tests in git, `AGENTS.md`), `gofmt`, `go mod tidy -diff`, `go vet`, golangci-lint, `cargo fmt --check` and clippy.
 - `npm test`: `validate`, the Go tests in `test/integration/`, and `cargo test --all-features`.
 - `npm run build`: the Go module, the crate (also for `wasm32-wasip1`), and `npm pack --dry-run`.

package/extension-world.mjs

@@ -0,0 +1,316 @@
+import { outcome } from './guard-driver.mjs';
+
+const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const extension = (context) =>
+  context?.origin?.startsWith('chrome-extension://') && !context.auxData?.isDefault;
+const marker = 'typeof chrome.runtime?.id === "string"';
+const refused = (out) => !out.ok && /^slicc: refused:/.test(out.error?.message ?? '');
+
+async function discover(reader, session) {
+  const start = reader.events.length;
+  await reader.send('Runtime.enable', {}, session);
+  const deadline = Date.now() + 5000;
+  do {
+    const world = reader.events
+      .slice(start)
+      .find(
+        (event) =>
+          event.sessionId === session &&
+          event.method === 'Runtime.executionContextCreated' &&
+          extension(event.params.context)
+      )?.params.context;
+    if (world) return world;
+    await pause(25);
+  } while (Date.now() < deadline);
+  throw new Error('extensionWorld: no foreign content-script context');
+}
+
+async function drivable(client, session, live) {
+  const setup = await outcome(
+    client.send(
+      'Runtime.evaluate',
+      {
+        expression:
+          'document.body.innerHTML = `<button style="position:fixed;left:0;top:0;width:100px;height:100px" onclick="document.body.dataset.clicked=\'yes\'">C9 click</button>`',
+        returnByValue: true,
+      },
+      session
+    )
+  );
+  const snapshot = await outcome(
+    client.send('DOMSnapshot.captureSnapshot', { computedStyles: [] }, session)
+  );
+  const down = await outcome(
+    client.send(
+      'Input.dispatchMouseEvent',
+      { type: 'mousePressed', x: 20, y: 20, button: 'left', clickCount: 1 },
+      session
+    )
+  );
+  const up = await outcome(
+    client.send(
+      'Input.dispatchMouseEvent',
+      { type: 'mouseReleased', x: 20, y: 20, button: 'left', clickCount: 1 },
+      session
+    )
+  );
+  const click = await outcome(
+    client.send(
+      'Runtime.evaluate',
+      { expression: 'document.body.dataset.clicked', returnByValue: true },
+      session
+    )
+  );
+  return {
+    exists: true,
+    alive: await live(),
+    snapshot: snapshot.ok && snapshot.result.documents?.length > 0,
+    click: setup.ok && down.ok && up.ok && click.ok && click.result.result?.value === 'yes',
+  };
+}
+
+async function debuggerWorld({ client, reader, session, observer, world, events, live }) {
+  const debug = await outcome(client.send('Debugger.enable', {}, session));
+  const probe = outcome(
+    reader.send(
+      'Runtime.evaluate',
+      {
+        contextId: world.id,
+        expression:
+          'setTimeout(() => { debugger; globalThis.c9DebuggerReached = chrome.runtime.id; }, 0)',
+        returnByValue: true,
+      },
+      observer
+    )
+  );
+  const deadline = Date.now() + 1500;
+  while (
+    debug.ok &&
+    !events().some((event) => event.method === 'Debugger.paused') &&
+    Date.now() < deadline
+  )
+    await pause(25);
+  const paused = events().find((event) => event.method === 'Debugger.paused');
+  let reached = false;
+  let frameRefused = false;
+  if (paused?.params.callFrames?.[0]) {
+    const out = await outcome(
+      client.send(
+        'Debugger.evaluateOnCallFrame',
+        {
+          callFrameId: paused.params.callFrames[0].callFrameId,
+          expression: marker,
+          returnByValue: true,
+        },
+        session
+      )
+    );
+    reached = out.ok && out.result.result?.value === true;
+    frameRefused = refused(out);
+  }
+  await outcome(reader.send('Debugger.resume', {}, observer));
+  await outcome(client.send('Debugger.resume', {}, session));
+  const probeResult = await probe;
+  if (!probeResult.ok)
+    throw new Error(`extensionWorld debugger stimulus: ${probeResult.error?.message}`);
+  const exposed =
+    events().some(
+      (event) =>
+        event.method === 'Debugger.scriptParsed' && event.params.executionContextId === world.id
+    ) || Boolean(paused);
+  await outcome(client.send('Debugger.disable', {}, session));
+  return {
+    exists: true,
+    reachable: reached,
+    protected: refused(debug) || frameRefused || !exposed,
+    alive: await live(),
+  };
+}
+
+function commands(world, objectId, promiseObjectId, nodeId) {
+  return [
+    [
+      'contextId',
+      'Runtime.evaluate',
+      { contextId: world.id, expression: marker, returnByValue: true },
+    ],
+    [
+      'uniqueContextId',
+      'Runtime.evaluate',
+      { uniqueContextId: world.uniqueId, expression: marker, returnByValue: true },
+    ],
+    [
+      'executionContextId',
+      'Runtime.callFunctionOn',
+      {
+        executionContextId: world.id,
+        functionDeclaration: `function(){return ${marker}}`,
+        returnByValue: true,
+      },
+    ],
+    [
+      'objectId',
+      'Runtime.callFunctionOn',
+      {
+        objectId,
+        functionDeclaration: 'function(){return typeof this.chrome.runtime.id === "string"}',
+        returnByValue: true,
+      },
+    ],
+    [
+      'argument',
+      'Runtime.callFunctionOn',
+      {
+        objectId,
+        functionDeclaration: 'function(value){return typeof value.chrome.runtime.id === "string"}',
+        arguments: [{ objectId }],
+        returnByValue: true,
+      },
+    ],
+    ['promiseObjectId', 'Runtime.awaitPromise', { promiseObjectId, returnByValue: true }],
+    ['properties', 'Runtime.getProperties', { objectId, ownProperties: true }],
+    ['binding', 'Runtime.addBinding', { name: 'c9Binding', executionContextName: world.name }],
+    ['resolveNode', 'DOM.resolveNode', { nodeId, executionContextId: world.id }],
+  ];
+}
+
+async function selectWorld({ client, session, world, side, controls, live }) {
+  let handles = controls.select;
+  if (side === 'control') {
+    const object = await client.send(
+      'Runtime.evaluate',
+      { contextId: world.id, expression: 'globalThis', returnByValue: false },
+      session
+    );
+    const promise = await client.send(
+      'Runtime.evaluate',
+      {
+        contextId: world.id,
+        expression: 'Promise.resolve(chrome.runtime.id)',
+        returnByValue: false,
+      },
+      session
+    );
+    handles = { world, objectId: object.result.objectId, promiseObjectId: promise.result.objectId };
+    controls.select = handles;
+  }
+  if (!handles?.objectId || !handles?.promiseObjectId)
+    throw new Error('extensionWorld: control did not provide object handles');
+  const dom = await outcome(client.send('DOM.getDocument', {}, session));
+  const result = { exists: true };
+  for (const [name, method, params] of commands(
+    world,
+    handles.objectId,
+    handles.promiseObjectId,
+    dom.result?.root.nodeId ?? 1
+  )) {
+    const out = await outcome(client.send(method, params, session));
+    result[`${name}Refused`] = refused(out);
+    result[`${name}Reached`] =
+      out.ok &&
+      !out.result.exceptionDetails &&
+      (['contextId', 'uniqueContextId', 'executionContextId', 'objectId', 'argument'].includes(name)
+        ? out.result.result?.value === true
+        : name === 'promiseObjectId'
+          ? typeof out.result.result?.value === 'string'
+          : name === 'properties'
+            ? out.result.result?.some((property) => property.name === 'chrome')
+            : name === 'resolveNode'
+              ? Boolean(out.result.object?.objectId)
+              : true);
+    result[`${name}Error`] = out.error?.message ?? out.result?.exceptionDetails?.text;
+  }
+  const guesses = commands(
+    handles.world,
+    handles.objectId,
+    handles.promiseObjectId,
+    dom.result?.root.nodeId ?? 1
+  ).slice(0, 3);
+  result.guessesRefused = true;
+  result.guessesReached = true;
+  for (const [, method, params] of guesses) {
+    const out = await outcome(client.send(method, params, session));
+    result.guessesRefused &&= refused(out);
+    result.guessesReached &&= out.ok && out.result.result?.value === true;
+  }
+  result.alive = await live();
+  return result;
+}
+
+export async function extensionWorld({
+  client,
+  reader,
+  session,
+  targetId,
+  mode,
+  origin,
+  side,
+  controls,
+}) {
+  const attached = await reader.send('Target.attachToTarget', { targetId, flatten: true });
+  const observer = attached.sessionId;
+  const seen = client.events.length;
+  try {
+    const world = await discover(reader, observer);
+    const enabled = await outcome(client.send('Runtime.enable', {}, session));
+    await pause(100);
+    const events = () => client.events.slice(seen).filter((event) => event.sessionId === session);
+    const live = async () => {
+      const out = await outcome(
+        client.send('Runtime.evaluate', { expression: 'self.origin', returnByValue: true }, session)
+      );
+      return (
+        out.ok &&
+        out.result.result?.value === origin &&
+        !out.result.exceptionDetails &&
+        !client.events
+          .slice(seen)
+          .some(
+            (event) =>
+              event.method === 'Target.detachedFromTarget' && event.params.sessionId === session
+          )
+      );
+    };
+    if (mode === 'hidden') {
+      await outcome(client.send('Debugger.enable', {}, session));
+      await reader.send(
+        'Runtime.evaluate',
+        {
+          contextId: world.id,
+          expression: 'console.log("C9 isolated world", globalThis); globalThis',
+          returnByValue: false,
+        },
+        observer
+      );
+      await pause(100);
+      const leaked = events().filter((event) => /^(Runtime|Debugger)\./.test(event.method));
+      const leaks = leaked.some(
+        (event) =>
+          event.params.executionContextId === world.id ||
+          event.params.executionContextUniqueId === world.uniqueId ||
+          JSON.stringify(event.params).includes(world.uniqueId) ||
+          extension(event.params.context) ||
+          (event.method === 'Runtime.consoleAPICalled' &&
+            event.params.args?.some((arg) => arg.objectId))
+      );
+      const listed = leaked.some(
+        (event) =>
+          event.method === 'Runtime.executionContextCreated' && extension(event.params.context)
+      );
+      const defaultSeen = leaked.some(
+        (event) =>
+          event.method === 'Runtime.executionContextCreated' &&
+          event.params.context.auxData?.isDefault &&
+          event.params.context.origin === origin
+      );
+      await outcome(client.send('Debugger.disable', {}, session));
+      return { exists: true, listed, leaks, defaultSeen, alive: enabled.ok && (await live()) };
+    }
+    const input = { client, reader, session, observer, world, events, live, side, controls };
+    if (mode === 'drivable') return await drivable(client, session, live);
+    if (mode === 'debugger') return await debuggerWorld(input);
+    return await selectWorld(input);
+  } finally {
+    await outcome(reader.send('Target.detachFromTarget', { sessionId: observer }));
+  }
+}

package/guard-runner.mjs

@@ -1,3 +1,4 @@
+import { extensionWorld } from './extension-world.mjs';
 import {
   beacon,
   canary,
@@ -15,6 +16,7 @@ const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 const namedResultMs = 10000;
 const observeMs = 5000;
 const q = JSON.stringify;
+
 const at = (value, path = '') =>
   path
     .split('.')
@@ -598,6 +600,8 @@ class Execution {
       this.errors.push(
         `${step.refusal.name} failed without a refusal: ${String(out.error?.message ?? out.error)}`
       );
+    if (step.extensionWorld && !out.ok)
+      this.errors.push(`extensionWorld: ${out.error?.message ?? 'probe failed'}`);
     if (step.as && !out.result?.pending) this.calls[step.as] = out;
     if (step.cdp) (this.calls.$cdp ??= []).push({ method: step.cdp, ...out });
   }
@@ -647,6 +651,19 @@ class Execution {
       await this.settle(step.settle);
       return;
     }
+    if (step.extensionWorld)
+      return outcome(
+        extensionWorld({
+          client: this.client,
+          reader: this.reader,
+          session,
+          targetId: this.pageTarget,
+          mode: step.extensionWorld,
+          origin: this.vars.ordinary,
+          side: this.side,
+          controls: (this.clients.extensionWorldControls ??= {}),
+        })
+      );
     if (step.guess) return this.guess(step.guess, session);
     if (step.cdp) return this.cdp(step, session);
     if (step.page) return this.page(step, session, phase);

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.8.5",
+  "setVersion": "1.9.0",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -90,6 +90,7 @@
     "autoAttach": "Target.setAutoAttach, the children steps and child sessions",
     "browserSession": "CDP calls on the browser session",
     "browserContexts": "Target.createBrowserContext and Target.disposeBrowserContext",
+    "extensionWorld": "a browser hosting a foreign content-script extension isolated world on the ordinary fixture page",
     "chromeUrlsAttach": "attaching to and driving chrome:// pages, which CDP over a DevTools port can and chrome.debugger can't"
   },
   "placeholders": {
@@ -117,6 +118,537 @@
     "browserUi": "the id of one of Chrome's own browser_ui targets, which the runner looks up with its own CDP"
   },
   "vectors": [
+    {
+      "id": "C9.world-hidden",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "defaultContext": true,
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/blank"
+        }
+      ],
+      "trigger": [
+        {
+          "extensionWorld": "hidden",
+          "as": "world",
+          "requires": ["extensionWorld"]
+        }
+      ],
+      "targets": ["ordinary"],
+      "requires": ["extensionWorld"],
+      "observe": {
+        "exists": {
+          "means": "foreign extension world exists",
+          "check": {
+            "result": "world",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "listed": {
+          "means": "foreign extension world listed",
+          "check": {
+            "result": "world",
+            "path": "result.listed",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "leaks": {
+          "means": "foreign extension world leaks",
+          "check": {
+            "result": "world",
+            "path": "result.leaks",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "defaultSeen": {
+          "means": "foreign extension world defaultSeen",
+          "check": {
+            "result": "world",
+            "path": "result.defaultSeen",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "alive": {
+          "means": "foreign extension world alive",
+          "check": {
+            "result": "world",
+            "path": "result.alive",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the observer confirms a foreign extension isolated world exists on an ordinary page",
+      "liveCheck": {
+        "result": "world",
+        "path": "result.exists",
+        "equals": true,
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "exists": true,
+          "listed": true,
+          "leaks": true,
+          "defaultSeen": true,
+          "alive": true
+        }
+      },
+      "expected": {
+        "exists": true,
+        "listed": false,
+        "leaks": false,
+        "defaultSeen": true,
+        "alive": true
+      }
+    },
+    {
+      "id": "C9.world-select",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "defaultContext": true,
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/blank"
+        }
+      ],
+      "trigger": [
+        {
+          "extensionWorld": "select",
+          "as": "world",
+          "requires": ["extensionWorld"]
+        }
+      ],
+      "targets": ["ordinary"],
+      "requires": ["extensionWorld"],
+      "observe": {
+        "exists": {
+          "means": "foreign extension world exists",
+          "check": {
+            "result": "world",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "alive": {
+          "means": "foreign extension world alive",
+          "check": {
+            "result": "world",
+            "path": "result.alive",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "contextIdRefused": {
+          "means": "foreign extension world contextIdRefused",
+          "check": {
+            "result": "world",
+            "path": "result.contextIdRefused",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "uniqueContextIdRefused": {
+          "means": "foreign extension world uniqueContextIdRefused",
+          "check": {
+            "result": "world",
+            "path": "result.uniqueContextIdRefused",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "executionContextIdRefused": {
+          "means": "foreign extension world executionContextIdRefused",
+          "check": {
+            "result": "world",
+            "path": "result.executionContextIdRefused",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "objectIdRefused": {
+          "means": "foreign extension world objectIdRefused",
+          "check": {
+            "result": "world",
+            "path": "result.objectIdRefused",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "argumentRefused": {
+          "means": "foreign extension world argumentRefused",
+          "check": {
+            "result": "world",
+            "path": "result.argumentRefused",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "promiseObjectIdRefused": {
+          "means": "foreign extension world promiseObjectIdRefused",
+          "check": {
+            "result": "world",
+            "path": "result.promiseObjectIdRefused",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "propertiesRefused": {
+          "means": "foreign extension world propertiesRefused",
+          "check": {
+            "result": "world",
+            "path": "result.propertiesRefused",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "bindingRefused": {
+          "means": "foreign extension world bindingRefused",
+          "check": {
+            "result": "world",
+            "path": "result.bindingRefused",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "resolveNodeRefused": {
+          "means": "foreign extension world resolveNodeRefused",
+          "check": {
+            "result": "world",
+            "path": "result.resolveNodeRefused",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "contextIdReached": {
+          "means": "foreign extension world contextIdReached",
+          "check": {
+            "result": "world",
+            "path": "result.contextIdReached",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "uniqueContextIdReached": {
+          "means": "foreign extension world uniqueContextIdReached",
+          "check": {
+            "result": "world",
+            "path": "result.uniqueContextIdReached",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "executionContextIdReached": {
+          "means": "foreign extension world executionContextIdReached",
+          "check": {
+            "result": "world",
+            "path": "result.executionContextIdReached",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "objectIdReached": {
+          "means": "foreign extension world objectIdReached",
+          "check": {
+            "result": "world",
+            "path": "result.objectIdReached",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "argumentReached": {
+          "means": "foreign extension world argumentReached",
+          "check": {
+            "result": "world",
+            "path": "result.argumentReached",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "promiseObjectIdReached": {
+          "means": "foreign extension world promiseObjectIdReached",
+          "check": {
+            "result": "world",
+            "path": "result.promiseObjectIdReached",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "propertiesReached": {
+          "means": "foreign extension world propertiesReached",
+          "check": {
+            "result": "world",
+            "path": "result.propertiesReached",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "bindingReached": {
+          "means": "foreign extension world bindingReached",
+          "check": {
+            "result": "world",
+            "path": "result.bindingReached",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "resolveNodeReached": {
+          "means": "foreign extension world resolveNodeReached",
+          "check": {
+            "result": "world",
+            "path": "result.resolveNodeReached",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "guessesRefused": {
+          "means": "numeric and unique context ids guessed from the successful control leg",
+          "check": {
+            "result": "world",
+            "path": "result.guessesRefused",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "guessesReached": {
+          "means": "numeric and unique context ids guessed from the successful control leg",
+          "check": {
+            "result": "world",
+            "path": "result.guessesReached",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the observer confirms a foreign extension isolated world exists on an ordinary page",
+      "liveCheck": {
+        "result": "world",
+        "path": "result.exists",
+        "equals": true,
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "exists": true,
+          "alive": true,
+          "contextIdRefused": false,
+          "contextIdReached": true,
+          "uniqueContextIdRefused": false,
+          "uniqueContextIdReached": true,
+          "executionContextIdRefused": false,
+          "executionContextIdReached": true,
+          "objectIdRefused": false,
+          "objectIdReached": true,
+          "argumentRefused": false,
+          "argumentReached": true,
+          "promiseObjectIdRefused": false,
+          "promiseObjectIdReached": true,
+          "propertiesRefused": false,
+          "propertiesReached": true,
+          "bindingRefused": false,
+          "bindingReached": true,
+          "resolveNodeRefused": false,
+          "resolveNodeReached": true,
+          "guessesRefused": false,
+          "guessesReached": true
+        }
+      },
+      "expected": {
+        "exists": true,
+        "alive": true,
+        "contextIdRefused": true,
+        "uniqueContextIdRefused": true,
+        "executionContextIdRefused": true,
+        "objectIdRefused": true,
+        "argumentRefused": true,
+        "promiseObjectIdRefused": true,
+        "propertiesRefused": true,
+        "bindingRefused": true,
+        "resolveNodeRefused": true,
+        "guessesRefused": true
+      }
+    },
+    {
+      "id": "C9.world-debugger",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "defaultContext": true,
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/blank"
+        }
+      ],
+      "trigger": [
+        {
+          "extensionWorld": "debugger",
+          "as": "world",
+          "requires": ["extensionWorld"]
+        }
+      ],
+      "targets": ["ordinary"],
+      "requires": ["extensionWorld"],
+      "observe": {
+        "exists": {
+          "means": "foreign extension world exists",
+          "check": {
+            "result": "world",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "reachable": {
+          "means": "foreign extension world reachable",
+          "check": {
+            "result": "world",
+            "path": "result.reachable",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "protected": {
+          "means": "foreign extension world protected",
+          "check": {
+            "result": "world",
+            "path": "result.protected",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "alive": {
+          "means": "foreign extension world alive",
+          "check": {
+            "result": "world",
+            "path": "result.alive",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the observer confirms a foreign extension isolated world exists on an ordinary page",
+      "liveCheck": {
+        "result": "world",
+        "path": "result.exists",
+        "equals": true,
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "exists": true,
+          "reachable": true,
+          "protected": false,
+          "alive": true
+        }
+      },
+      "expected": {
+        "exists": true,
+        "reachable": false,
+        "protected": true,
+        "alive": true
+      }
+    },
+    {
+      "id": "C9.page-drivable",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "defaultContext": true,
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/blank"
+        }
+      ],
+      "trigger": [
+        {
+          "extensionWorld": "drivable",
+          "as": "world",
+          "requires": ["extensionWorld"]
+        }
+      ],
+      "targets": ["ordinary"],
+      "requires": ["extensionWorld"],
+      "observe": {
+        "exists": {
+          "means": "foreign extension world exists",
+          "check": {
+            "result": "world",
+            "path": "result.exists",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "alive": {
+          "means": "foreign extension world alive",
+          "check": {
+            "result": "world",
+            "path": "result.alive",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "snapshot": {
+          "means": "foreign extension world snapshot",
+          "check": {
+            "result": "world",
+            "path": "result.snapshot",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "click": {
+          "means": "foreign extension world click",
+          "check": {
+            "result": "world",
+            "path": "result.click",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the observer confirms a foreign extension isolated world exists on an ordinary page",
+      "liveCheck": {
+        "result": "world",
+        "path": "result.exists",
+        "equals": true,
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "exists": true,
+          "alive": true,
+          "snapshot": true,
+          "click": true
+        }
+      },
+      "expected": {
+        "exists": true,
+        "alive": true,
+        "snapshot": true,
+        "click": true
+      }
+    },
     {
       "id": "C1.script-nav",
       "family": "C",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.8.5",
+  "version": "1.9.0",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -50,7 +50,8 @@
     "seven.mjs",
     "schema",
     "guard-runner.mjs",
-    "fixture-server.mjs"
+    "fixture-server.mjs",
+    "extension-world.mjs"
   ],
   "scripts": {
     "prepare": "lefthook install",
@@ -65,19 +66,19 @@
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish",
     "release": "semantic-release",
     "test:guard": "npm run test:guard-integration && npm run test:guard-sweep",
-    "test:guard-integration": "node --test test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-scales.test.mjs",
+    "test:guard-integration": "node --test --test-concurrency=2 test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-worlds.test.mjs test/integration/guard-scales.test.mjs",
     "test:guard-sweep": "node scripts/test-guards.mjs",
     "test:gates": "node --test test/integration/gates.test.mjs",
     "test:guard-target": "node --test test/integration/guard-runner.test.mjs",
     "test:unit:guard": "node --experimental-test-coverage --test --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-lines=100 test/unit/guard-*.test.mjs"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-shared-web": "1.24.2",
+    "@ai-ecoverse/slicc-shared-web": "1.25.1",
     "@biomejs/biome": "2.5.15",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
     "lefthook": "2.2.1",
-    "semantic-release": "25.0.9",
-    "playwright-core": "1.64.1"
+    "playwright-core": "1.64.1",
+    "semantic-release": "25.0.9"
   }
 }

package/schema/guard-vectors.schema.json

@@ -81,7 +81,13 @@
     "capabilities": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["autoAttach", "browserSession", "browserContexts", "chromeUrlsAttach"],
+      "required": [
+        "autoAttach",
+        "browserSession",
+        "browserContexts",
+        "chromeUrlsAttach",
+        "extensionWorld"
+      ],
       "properties": {
         "autoAttach": {
           "type": "string",
@@ -95,6 +101,7 @@
           "type": "string",
           "minLength": 1
         },
+        "extensionWorld": { "type": "string", "minLength": 1 },
         "chromeUrlsAttach": {
           "type": "string",
           "minLength": 1
@@ -121,7 +128,13 @@
   },
   "$defs": {
     "capability": {
-      "enum": ["autoAttach", "browserSession", "browserContexts", "chromeUrlsAttach"]
+      "enum": [
+        "autoAttach",
+        "browserSession",
+        "browserContexts",
+        "chromeUrlsAttach",
+        "extensionWorld"
+      ]
     },
     "requires": {
       "type": "array",
@@ -161,6 +174,7 @@
     },
     "target": {
       "enum": [
+        "ordinary",
         "seven",
         "vault",
         "vault-x",
@@ -413,6 +427,22 @@
     },
     "step": {
       "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["extensionWorld", "as", "requires"],
+          "properties": {
+            "extensionWorld": {
+              "enum": ["hidden", "select", "debugger", "drivable"]
+            },
+            "as": {
+              "$ref": "#/$defs/name"
+            },
+            "requires": {
+              "$ref": "#/$defs/requires"
+            }
+          }
+        },
         {
           "type": "object",
           "additionalProperties": false,