@ai-ecoverse/slicc-browsers 1.9.0 → 1.9.2

package/README.md

@@ -172,7 +172,7 @@ Every CDP guard runs the vectors in `guard-vectors.json` (schema `schema/guard-v
 - `C5.continue-request` and `C5.continue-response`, added next to `C5.document`;
 - the `C8` rows for privileged pages: `C8.navigate` (a page navigates to `chrome://settings`, `chrome://password-manager`, an extension page or `file:///`; refused), `C8.view-source` (the same through `view-source:`; refused), `C8.create` (`Target.createTarget` straight on those pages; refused), `C8.browser-ui-listed` (`Target.getTargets` lists no `browser_ui` target) and `C8.browser-ui-attach` (`Target.attachToTarget` by a `browser_ui` target's id; refused). All five have an unguarded control, since the guard refuses them only on the privileged target. Two cases aren't rows, because Chrome itself blocks them, so an unguarded client can't tell a guard from none: a page's `window.open('chrome://settings')`, and an `about:` alias such as `about:settings`, which `Page.navigate` and `Target.createTarget` both turn into `about:blank#blocked`. The `about:` aliases are in `protected.json` instead.
 
-The `C9` foreign extension isolated-world family requires `extensionWorld`: a browser hosting a foreign content-script extension on the ordinary fixture page. `C9.world-hidden` requires the page default context to remain visible after `Runtime.enable`, while the extension context and Runtime/Debugger identifiers remain hidden without cutting or detaching the session. `C9.world-select` probes numeric and unique context selectors, object and argument handles, promises, properties, named bindings and DOM node resolution; each guarded command must fail with the `slicc: refused:` prefix, never an ordinary browser error. `C9.world-debugger` pauses inside that content script: the control must reach its frame, while the guard must refuse or hide it. `C9.page-drivable` evaluates `self.origin`, captures a DOM snapshot and dispatches an Input click on the same ordinary page; cutting the entire session fails this regression row. All four use an unguarded control, the default browser context and observer discovery of the real extension world, not an invented isolated world. Protected default contexts remain session-cutting evidence; hiding a foreign isolated world does not weaken any seven-origin row.
+The `C9` foreign extension isolated-world family requires `extensionWorld`: a browser hosting a foreign content-script extension on the ordinary fixture page. `C9.world-hidden` requires the page default context to remain visible after `Runtime.enable`, while the extension context and Runtime/Debugger identifiers remain hidden without cutting or detaching the session. `C9.world-select` probes numeric and unique context selectors, object and argument handles, promises, properties, named bindings and DOM node resolution; each command selecting the hidden world must fail with the `slicc: refused:` prefix, never an ordinary browser error. Numeric guesses also sweep ids 1–32: an id not exposed to this client must be refused, while every exposed numeric context must remain usable; none of those guarded probes may reach the fixture content-script marker. The marker combines the content script’s global lexical `root` binding with its extension-id DOM marker and `chrome.runtime.id`, and is independently required to be absent from the page default world. `C9.world-debugger` pauses inside that content script: the control must reach its frame, while the guard must refuse or hide it. `C9.page-drivable` evaluates `self.origin`, captures a DOM snapshot and dispatches an Input click on the same ordinary page; cutting the entire session fails this regression row. All four use an unguarded control, the default browser context and observer discovery of the real extension world, not an invented isolated world. Protected default contexts remain session-cutting evidence; hiding a foreign isolated world does not weaken any seven-origin row.
 
 The integration launcher loads shared-web 1.25.1’s harness extension exactly once through `Extensions.loadUnpacked` (`ankmbodmgimjemnojmeddfcdlbocolob`), whose content script runs on HTTP(S) pages. shared-web 1.25.1 also loads it by default in its own harness. A transport unable to host a foreign content-script extension omits `extensionWorld` and reports `not-supported:extensionWorld`; an advertised capability with no observed world fails, rather than silently skipping.
 
@@ -237,7 +237,7 @@ Popups are observed by `Target.targetCreated` with the opener's `openerId`, or b
 - `/plant`: sets the canary;
 - `/beacon`, and `/log?n=`, which returns `{ hits, beacons }`.
 
-`{ "extensionWorld": "hidden" | "select" | "debugger" | "drivable", "as": "world", "requires": ["extensionWorld"] }` runs the C9 compound probe on the current ordinary page. The runner attaches an independent observer to discover actual context ids, unique ids and names, and sends probes through the client session. Object handles are minted and validated on the unguarded control session, then replayed as guesses on the guarded leg; Chrome object handles and DOM node ids are session-local, so observer handles must never be mistaken for client handles. Numeric and unique context ids from the control are also replayed alongside fresh observer-discovered selectors. Every guarded replay needs an explicit refusal, including a stale handle (`not exposed`), rather than Chrome’s invalid-id error. Its result contains boolean evidence consumed by ordinary `result` checks. The unguarded leg validates those selectors against Chrome itself before guarded evidence can pass.
+`{ "extensionWorld": "hidden" | "select" | "debugger" | "drivable", "as": "world", "requires": ["extensionWorld"] }` runs the C9 compound probe on the current ordinary page. The runner attaches an independent observer to discover actual context ids, unique ids and names, and sends probes through the client session. Object handles are minted and validated on the unguarded control session, then replayed as guesses on the guarded leg; Chrome object handles and DOM node ids are session-local, so observer handles must never be mistaken for client handles. Numeric ids from the control are also replayed alongside fresh observer-discovered selectors, but numeric ids are local to a tab: a control id may name the next tab’s exposed default context, which must work and return no extension marker. The same-tab hidden world’s actual numeric id and every extension unique-id guess still require a matched refusal. Unknown numeric ids and stale object handles (`not exposed`) need explicit refusals rather than Chrome’s invalid-id errors. `guessesRefused` aggregates only required refusals; `guessesReached` must be false on the guarded leg, and `exposedContextsWork` must remain true. Its result contains boolean evidence consumed by ordinary `result` checks. The unguarded leg validates those selectors against Chrome itself before guarded evidence can pass.
 
 **The control rule.** Every vector has a control on an ordinary origin: the same setup and trigger against an unprotected origin must succeed. A missing or failing control fails the id. With `via: "guard"`, the control runs through the guard. With `via: "unguarded"`, the runner runs setup and trigger through its own CDP against the ordinary origin and against the protected stand-in, and both must show the effect. The runner reports the control's transport as `via`.
 
@@ -443,6 +443,9 @@ invocation: controls must pass and guarded protection expectations must fail; th
 target use `GUARD_TARGET=seven npm run test:guard-target`. The fixture also serves
 `/live` image requests from stand-in documents, independently of injected code.
 
+The integration launcher owns each Chrome process group and temporary profile. `close()` terminates the group, escalates to SIGKILL if necessary and removes the profile; node:test workers also register an after hook for every launch. Process exit, uncaught errors, SIGINT, SIGTERM and SIGHUP reap tracked groups synchronously. An independent POSIX watchdog watches the runner’s pipe and reaps Chrome and its profile even if the runner receives SIGKILL. `launch(fixture, { signal })` also accepts a test’s AbortSignal for timeout cleanup. `guard-lifecycle.test.mjs` interrupts real runner subprocesses and checks every Chrome PID returned by CDP’s `SystemInfo.getProcessInfo` plus profile removal, without consulting a host-wide process list.
+
+
 ```js
 import set from '@ai-ecoverse/slicc-browsers/guard-vectors.json' with { type: 'json' };
 import { run } from '@ai-ecoverse/slicc-browsers/guard-runner';

package/extension-world.mjs

@@ -3,7 +3,8 @@ import { outcome } from './guard-driver.mjs';
 const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 const extension = (context) =>
   context?.origin?.startsWith('chrome-extension://') && !context.auxData?.isDefault;
-const marker = 'typeof chrome.runtime?.id === "string"';
+const marker =
+  'typeof root !== "undefined" && root === document.documentElement && root.dataset.sliccHarnessExtension === chrome.runtime.id';
 const refused = (out) => !out.ok && /^slicc: refused:/.test(out.error?.message ?? '');
 
 async function discover(reader, session) {
@@ -174,7 +175,74 @@ function commands(world, objectId, promiseObjectId, nodeId) {
   ];
 }
 
-async function selectWorld({ client, session, world, side, controls, live }) {
+async function guessWorld({ client, session, world, handles, events }) {
+  const exposed = new Set(
+    events()
+      .filter((event) => event.method === 'Runtime.executionContextCreated')
+      .map((event) => event.params.context.id)
+  );
+  const ids = new Set([
+    ...Array.from({ length: 32 }, (_, index) => index + 1),
+    handles.world.id,
+    world.id,
+    ...exposed,
+  ]);
+  const numeric = [];
+  for (const id of ids) {
+    const probes = [
+      ['Runtime.evaluate', { contextId: id, expression: marker, returnByValue: true }],
+      [
+        'Runtime.callFunctionOn',
+        {
+          executionContextId: id,
+          functionDeclaration: `function(){return ${marker}}`,
+          returnByValue: true,
+        },
+      ],
+    ];
+    for (const [method, params] of probes) {
+      const out = await outcome(client.send(method, params, session));
+      numeric.push({
+        id,
+        method,
+        exposed: exposed.has(id),
+        refused: refused(out),
+        ok: out.ok && !out.result.exceptionDetails && typeof out.result.result?.value === 'boolean',
+        reached: out.ok && out.result.result?.value === true,
+      });
+    }
+  }
+  const unique = [];
+  for (const uniqueContextId of new Set([handles.world.uniqueId, world.uniqueId])) {
+    const out = await outcome(
+      client.send(
+        'Runtime.evaluate',
+        { uniqueContextId, expression: marker, returnByValue: true },
+        session
+      )
+    );
+    unique.push({
+      uniqueContextId,
+      refused: refused(out),
+      reached: out.ok && out.result.result?.value === true,
+    });
+  }
+  return {
+    guessesRefused:
+      numeric.filter((guess) => !guess.exposed).every((guess) => guess.refused) &&
+      unique.every((guess) => guess.refused),
+    guessesReached: [...numeric, ...unique].some((guess) => guess.reached),
+    exposedContextsWork: numeric
+      .filter((guess) => guess.exposed)
+      .every((guess) => guess.ok && !guess.refused),
+    numericGuesses: numeric,
+    uniqueGuesses: unique,
+    controlNumericId: handles.world.id,
+    hiddenNumericId: world.id,
+  };
+}
+
+async function selectWorld({ client, session, world, side, controls, live, events }) {
   let handles = controls.select;
   if (side === 'control') {
     const object = await client.send(
@@ -220,19 +288,11 @@ async function selectWorld({ client, session, world, side, controls, live }) {
               : true);
     result[`${name}Error`] = out.error?.message ?? out.result?.exceptionDetails?.text;
   }
-  const guesses = commands(
-    handles.world,
-    handles.objectId,
-    handles.promiseObjectId,
-    dom.result?.root.nodeId ?? 1
-  ).slice(0, 3);
-  result.guessesRefused = true;
-  result.guessesReached = true;
-  for (const [, method, params] of guesses) {
-    const out = await outcome(client.send(method, params, session));
-    result.guessesRefused &&= refused(out);
-    result.guessesReached &&= out.ok && out.result.result?.value === true;
-  }
+  Object.assign(result, await guessWorld({ client, session, world, handles, events }));
+  const pageMarker = await outcome(
+    client.send('Runtime.evaluate', { expression: marker, returnByValue: true }, session)
+  );
+  result.pageMarkerAbsent = pageMarker.ok && pageMarker.result.result?.value === false;
   result.alive = await live();
   return result;
 }

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.9.0",
+  "setVersion": "1.9.2",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -415,7 +415,7 @@
           }
         },
         "guessesRefused": {
-          "means": "numeric and unique context ids guessed from the successful control leg",
+          "means": "numeric ids 1..32 not exposed to this client, the same-tab hidden numeric id and extension unique-id guesses receive matched refusals; exposed numeric ids need not be refused",
           "check": {
             "result": "world",
             "path": "result.guessesRefused",
@@ -424,13 +424,31 @@
           }
         },
         "guessesReached": {
-          "means": "numeric and unique context ids guessed from the successful control leg",
+          "means": "numeric sweeps and extension unique-id guesses reach the content-script-only marker on the control, never on the guarded leg",
           "check": {
             "result": "world",
             "path": "result.guessesReached",
             "equals": true,
             "observer": "client"
           }
+        },
+        "exposedContextsWork": {
+          "means": "every numeric context id exposed to this client remains usable",
+          "check": {
+            "result": "world",
+            "path": "result.exposedContextsWork",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "pageMarkerAbsent": {
+          "means": "the fixture content-script marker is absent from the page default world",
+          "check": {
+            "result": "world",
+            "path": "result.pageMarkerAbsent",
+            "equals": true,
+            "observer": "client"
+          }
         }
       },
       "live": "the observer confirms a foreign extension isolated world exists on an ordinary page",
@@ -465,7 +483,9 @@
           "resolveNodeRefused": false,
           "resolveNodeReached": true,
           "guessesRefused": false,
-          "guessesReached": true
+          "guessesReached": true,
+          "exposedContextsWork": true,
+          "pageMarkerAbsent": true
         }
       },
       "expected": {
@@ -480,7 +500,10 @@
         "propertiesRefused": true,
         "bindingRefused": true,
         "resolveNodeRefused": true,
-        "guessesRefused": true
+        "guessesRefused": true,
+        "exposedContextsWork": true,
+        "pageMarkerAbsent": true,
+        "guessesReached": false
       }
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.9.0",
+  "version": "1.9.2",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -66,7 +66,7 @@
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish",
     "release": "semantic-release",
     "test:guard": "npm run test:guard-integration && npm run test:guard-sweep",
-    "test:guard-integration": "node --test --test-concurrency=2 test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-worlds.test.mjs test/integration/guard-scales.test.mjs",
+    "test:guard-integration": "node --test --test-concurrency=2 test/integration/guard-lifecycle.test.mjs test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-worlds.test.mjs test/integration/guard-world-guesses.test.mjs test/integration/guard-scales.test.mjs",
     "test:guard-sweep": "node scripts/test-guards.mjs",
     "test:gates": "node --test test/integration/gates.test.mjs",
     "test:guard-target": "node --test test/integration/guard-runner.test.mjs",