@ai-ecoverse/slicc-browsers 1.9.1 → 1.10.0

package/README.md

@@ -65,7 +65,7 @@ Every feature builds for `wasm32-wasip1`.
 
 `guard-driver.mjs` is described under [Guard vectors](#guard-vectors).
 
-`protected.mjs` is the reference matcher for [protected origins](#protected-origins): `import { protectedOrigins } from '@ai-ecoverse/slicc-browsers/protected.mjs'`, then `protectedOrigins(catalog.protectedOrigins, extraOrigins)` returns `{ url(text), target({ url, previous, opener }), cookieDomain(domain), storageKey(key) }`, each a boolean. It needs only the WHATWG `URL`, so it runs in Node and in a browser.
+`protected.mjs` is the reference matcher for [protected origins](#protected-origins): `import { protectedOrigins } from '@ai-ecoverse/slicc-browsers/protected.mjs'`, then `protectedOrigins(catalog.protectedOrigins, extraOrigins)` returns `{ url(text), target({ url, previous, opener }), cookieDomain(domain), storageKey(key), unparseable(text) }`, each a boolean. `url(text)` uses the load/loaded-URL fail-closed rule; `url(text, { readOnly: true })` preserves the old parse-failure result for read-only keys and value redaction, and `storageKey(key)` uses that mode internally. `unparseable(text)` identifies parse or unwrap failures without changing whether a parsed origin is protected. It needs only the WHATWG `URL`, so it runs in Node and in a browser.
 
 ## `catalog.json`
 
@@ -94,7 +94,7 @@ Every feature builds for `wasm32-wasip1`.
   - `discardExceptions`: where the site pattern and the extra origins' hosts go, as a `list` of strings or as a `chrome-time-map`, a map from site to the time it was added (microseconds since 1601-01-01 UTC, as a decimal string);
   - `cleanExit`: values that mark the last exit clean;
   - `form` says where a key comes from: `six` (SLICC six's keys) or `chrome-154` (what Chrome 154 reads).
-- `protectedOrigins`: what browser control must never reach, see [Protected origins](#protected-origins). `domains` (`sliccy.ai`), `hosts` (`vault.sliccy.ai`), `schemes` (`https`, `http`), `innerSchemes` (`blob`, `filesystem`, `view-source`), `anySchemes` (`devtools`), `protectedSchemes` (`chrome`, `chrome-untrusted`, `chrome-search`, `chrome-native`, `chrome-distiller`, `chrome-experimental-site-token-provider`, `isolated-app`, `externalfile`, `content`, `chrome-extension`, `devtools`, `edge`, `brave`, `opera`, `vivaldi`, `arc`, `file`) with `schemeExceptions` (`chrome://newtab`, `chrome://new-tab-page`, `chrome-untrusted://new-tab-page`, `edge://newtab`, `brave://newtab`, `opera://startpage`), `aboutScheme` (`chrome`), `targetTypes` (`browser_ui`), `inheriting` (`about:blank`, `about:srcdoc`), and `refusal`, the text of a refusal.
+- `protectedOrigins`: what browser control must never reach, see [Protected origins](#protected-origins). `domains` (`sliccy.ai`), `hosts` (`vault.sliccy.ai`), `schemes` (`https`, `http`), `innerSchemes` (`blob`, `filesystem`, `view-source`), `anySchemes` (`devtools`), `protectedSchemes` (`chrome`, `chrome-untrusted`, `chrome-search`, `chrome-native`, `chrome-distiller`, `chrome-experimental-site-token-provider`, `isolated-app`, `externalfile`, `content`, `chrome-extension`, `devtools`, `edge`, `brave`, `opera`, `vivaldi`, `arc`, `file`) with `schemeExceptions` (`chrome://newtab`, `chrome://new-tab-page`, `chrome-untrusted://new-tab-page`, `edge://newtab`, `brave://newtab`, `opera://startpage`), `aboutScheme` (`chrome`), `targetTypes` (`browser_ui`), `inheriting` (`about:blank`, `about:srcdoc`), `unparseable` (`protected`) with `unparseableRefusal`, and `refusal`, the text of a parsed protected-origin refusal.
 - `profiles`: SLICC profiles live in `<config dir>/<root>/<name>`, and a snap's in `~/snap/<snap>/common/<snapRoot>/<name>`. `legacyRoot` is the old root, never scanned; on macOS's case-insensitive volume it is SLICC six's root too. `sixProfilePattern` matches six's profile names, case-insensitively. `namePattern` is a valid profile name. `six` describes SLICC six's Chrome profiles (see [SLICC six's profiles](#slicc-sixs-profiles)):
   - `roots`: six's profile root per OS (`macos`, `linux`, `windows`), a `base` location followed by the `path` segments. The base is its `env` when that is set and not empty (any value, as six takes it), else `home` under the home dir.
   - `defaultName` (`browser-coding-agent-chrome`), `defaultPort` (5710) and `portSuffix` (`-{port}`): six's profile for its serve port `<port>` is `<root>/<defaultName>`, with `portSuffix` added for any port other than `defaultPort`.
@@ -106,8 +106,8 @@ Every feature builds for `wasm32-wasip1`.
 
 Browser control must never navigate to, open or attach to a target on seven's own origin, or read or write its cookies or storage: not slicc-cli's `cdp` relay, not slicc-cdp's `playwright-cli`, not slicc-agent. `protectedOrigins` in `catalog.json` says what is protected, and every implementation runs the vectors in `protected.json`.
 
-**URLs.** A URL is parsed the way the WHATWG URL Standard (and so the browser) parses it, so `https:\\seven.sliccy.ai`, a tab or newline inside the URL, `%2E`, `。` and full-width letters all reach seven. In Go and Rust that takes a WHATWG parser, not `net/url`. A URL that doesn't parse isn't protected; the browser doesn't load it either. Then:
-1. While its scheme is one of `innerSchemes`, the rest of the URL after `<scheme>:` takes its place, at most 8 times: `blob:https://seven.sliccy.ai/<uuid>` is `https://seven.sliccy.ai/<uuid>`.
+**URLs.** A URL is parsed the way the WHATWG URL Standard (and so the browser) parses it, so `https:\\seven.sliccy.ai`, a tab or newline inside the URL, `%2E`, `。` and full-width letters all reach seven. In Go and Rust that takes a WHATWG parser, not `net/url`. A URL the guard’s WHATWG parser cannot parse is **protected** wherever the guard judges a URL the browser will load or has loaded: `unparseable: "protected"` in both `catalog.json.protectedOrigins` and `protected.json`. Chrome’s parser is not interchangeable with the guard’s parser; in particular it can load `http://exa%20mple.sliccy.ai/` even though the WHATWG parser rejects the decoded space. Then:
+1. While its scheme is one of `innerSchemes`, the rest of the URL after `<scheme>:` takes its place, at most 8 times: `blob:https://seven.sliccy.ai/<uuid>` is `https://seven.sliccy.ai/<uuid>`. A failing inner parse, or a URL still wrapped after the eighth unwrap, is unparseable and protected.
 2. A scheme in `anySchemes` is protected whatever follows: a DevTools front end (`devtools://`) can be inspecting seven.
 3. A scheme in `protectedSchemes` is protected like seven, whatever follows, except the `scheme://host` pairs in `schemeExceptions` (the new tab pages), on any path. Match the parsed scheme and exact host, never a raw URL prefix: `chrome-untrusted://new-tab-page/one-google-bar?paramsencoded=` is excepted, but `chrome-untrusted://new-tab-page.evil/` and `chrome-untrusted://other/` remain protected. Chrome's new tab embeds the excepted untrusted host, and `chrome://new-tab-page/` can commit as itself when opened directly:
    - Chrome's privileged UI (`chrome://settings`, `chrome://password-manager`, `chrome-untrusted://…`, `devtools://`) and the same UI in the catalog's other Chromium browsers (`edge://settings/passwords`, `edge://wallet`, `brave://`, `opera://`, `vivaldi://`, `arc://`), since a client attaches to whatever browser answers;
@@ -149,6 +149,12 @@ A guard must refuse navigation, creation and attach on protected schemes, includ
 
 **Privileged-scheme follow-up checks.** With the expanded catalog, fresh default-profile Chrome for Testing 156.0.8078.4 on macOS again committed both NTP entry points to `chrome://new-tab-page/`, with an `about:blank` background child and only `chrome-untrusted://new-tab-page/one-google-bar?paramsencoded=` as its internal-scheme OOPIF. `C8.newtab` passed both attach and ordinary-navigation legs; no `chrome-search` exceptions are added or inferred for other profile/search-provider configurations. Direct `Page.navigate` to `chrome-search://most-visited/` returned `net::ERR_INVALID_URL` and committed `chrome-error://chromewebdata/` with that exact `unreachableUrl`, confirming why `C8.chrome-search` distinguishes a browser response from a guard refusal rather than requiring a successful search-document commit. The catalog-adopting emulator passed every C8 protection row; plain clients failed them, and removing only `chrome-search` from the adopted catalog failed the new row. C1.href, C2.302, C3.popup-self-nav, all tested C4 iframe process layouts and C5.document passed their guarded and control legs with the expanded schemes; plain clients passed controls and failed protection expectations. Those HTTP fixtures deliberately protect only the seven host, leaving their same-site control host ordinary, while adopting every internal-scheme rule unchanged.
 
+**Unparseable URL boundaries.** Fail closed on command destinations: navigation and target creation, the URL and `userTypedURL` of a selected history entry, `Fetch.continueRequest` and legacy interception overrides, `Network.loadNetworkResource`, PWA install/launch, and cookie-command URLs when no domain is supplied. Also fail closed on security-relevant Chrome-reported URLs: targets, main-frame `securityOrigin`, execution-context origins, requests/redirect responses, web sockets and web transports, and service-worker scopes/scripts. A protected default execution context still cuts its session; a protected foreign isolated world stays hidden. This is not a rule to reject arbitrary strings a guard merely reads: storage-command origin keys, storage keys/cache ids, script/stack URLs, generic value redaction and storage events retain the old not-protected result for a parse failure. Cookie domains remain suffix matches, so `exa%20mple.sliccy.ai` is already covered.
+
+The empty string is exempt (`Target.createTarget`’s blank page, an empty history `userTypedURL`, or no override); opaque-origin spellings `null` and `://` are exempt too. `about:blank` still inherits provenance, so those exemptions never erase an already protected opener or target. A failing `about:` alias is judged as the original `about:` URL, not as a parse failure. `unparseableRefusal` is exactly `slicc: refused: slicc can't parse this URL, so it could be a protected page`; a URL the guard can parse and finds protected uses its ordinary refusal instead. IDNA validation differs between WHATWG implementations: Node accepts some punycode spellings that the Go parser rejects; the canonical `.sliccy.ai` spellings remain protected by the domain rule either way.
+
+The deliberate cost includes otherwise ordinary `http://<U+200D>.example/` and `https://exa mple.com/`: an unparseable URL is not an ordinary-origin allowlist exception. The vectors include space/percent-space, U+200D/punycode and invalid-punycode `.sliccy.ai` forms; malformed hosts, ports and IPv6; failed wrappers and unwrap-limit exhaustion; and the explicit exemptions and read-only storage-key controls.
+
 **The vault.** `vault.sliccy.ai` is in `hosts` by name, and vault branch previews (`vault-preview.sliccy.ai`, `vault-*.sliccy.ai`) are covered by the `sliccy.ai` domain rule. `sliccy.ai` already covers them all, but vault must stay protected even if `domains` ever changes: the vault must never be a CDP target for agent tools. The one exception is slicc-cli's own pairing attach for the vault, which is the CLI's own connection and not browser control handed to the agent.
 
 **Targets.** A target whose `TargetInfo.type` is one of `targetTypes` (`browser_ui`, Chrome's own UI such as `chrome://omnibox-popup.top-chrome/`) is always protected, whatever its URL. Otherwise a target's effective origin is its URL's (`TargetInfo.url`), except when the URL inherits the origin of whoever made the document: the empty URL, and `inheriting` with any query or fragment. Such a target is protected when it was protected before this URL (a seven tab that went to `about:blank` keeps seven's origin), or when its opener (`openerId`, else `openerFrameId`) is protected or unknown, for an opener closed before the program saw it. The URL, `openerFrameId` and `browserContextId` alone can't tell: a blank popup that seven opens has seven's origin and the URL `about:blank`. A program that holds a session to the target also has the document's real origin: the main frame's `securityOrigin` in `Page.frameNavigated`, and the default context's `origin` in `Runtime.executionContextCreated`. When one of those is protected, the target is protected too, until a URL with an origin of its own replaces it.
@@ -161,7 +167,7 @@ A same-site frame shares its parent's process and has no target of its own. Ever
 
 **Refusals** carry the text in `refusal`, `slicc: refused: target is on seven's origin`.
 
-**`protected.json`** (schema `schema/protected.schema.json`): `origins`, the extra origins every vector runs with; `urls` (`url`, `protected`); `targets` (`url`, `type?`, the target's `TargetInfo.type`; `previous?`, whether the target was protected before; `opener?`, `protected`, `unprotected` or `unknown`, and no `opener` for a target without one; `protected`); `cookieDomains` (`domain`, `protected`); `storageKeys` (`key`, `protected`). `npm run validate` runs every vector through `protected.mjs`, and no vector uses a port from 9222 to 9229.
+**`protected.json`** (schema `schema/protected.schema.json`): `unparseable` (`protected`) and `unparseableRefusal`, in step with the catalog; `origins`, the extra origins every vector runs with; `urls` (`url`, `protected`); `targets` (`url`, `type?`, the target's `TargetInfo.type`; `previous?`, whether the target was protected before; `opener?`, `protected`, `unprotected` or `unknown`, and no `opener` for a target without one; `protected`); `cookieDomains` (`domain`, `protected`); `storageKeys` (`key`, `protected`). `npm run validate` runs every vector through `protected.mjs`, and no vector uses a port from 9222 to 9229.
 
 ## Guard vectors
 
@@ -172,9 +178,11 @@ Every CDP guard runs the vectors in `guard-vectors.json` (schema `schema/guard-v
 - `C5.continue-request` and `C5.continue-response`, added next to `C5.document`;
 - the `C8` rows for privileged pages: `C8.navigate` (a page navigates to `chrome://settings`, `chrome://password-manager`, an extension page or `file:///`; refused), `C8.view-source` (the same through `view-source:`; refused), `C8.create` (`Target.createTarget` straight on those pages; refused), `C8.browser-ui-listed` (`Target.getTargets` lists no `browser_ui` target) and `C8.browser-ui-attach` (`Target.attachToTarget` by a `browser_ui` target's id; refused). All five have an unguarded control, since the guard refuses them only on the privileged target. Two cases aren't rows, because Chrome itself blocks them, so an unguarded client can't tell a guard from none: a page's `window.open('chrome://settings')`, and an `about:` alias such as `about:settings`, which `Page.navigate` and `Target.createTarget` both turn into `about:blank#blocked`. The `about:` aliases are in `protected.json` instead.
 
-The `C9` foreign extension isolated-world family requires `extensionWorld`: a browser hosting a foreign content-script extension on the ordinary fixture page. `C9.world-hidden` requires the page default context to remain visible after `Runtime.enable`, while the extension context and Runtime/Debugger identifiers remain hidden without cutting or detaching the session. `C9.world-select` probes numeric and unique context selectors, object and argument handles, promises, properties, named bindings and DOM node resolution; each guarded command must fail with the `slicc: refused:` prefix, never an ordinary browser error. `C9.world-debugger` pauses inside that content script: the control must reach its frame, while the guard must refuse or hide it. `C9.page-drivable` evaluates `self.origin`, captures a DOM snapshot and dispatches an Input click on the same ordinary page; cutting the entire session fails this regression row. All four use an unguarded control, the default browser context and observer discovery of the real extension world, not an invented isolated world. Protected default contexts remain session-cutting evidence; hiding a foreign isolated world does not weaken any seven-origin row.
+The `C9` foreign extension isolated-world family requires `extensionWorld`: a browser hosting a foreign content-script extension on the ordinary fixture page. `C9.world-hidden` requires the page default context to remain visible after `Runtime.enable`, while the extension context and Runtime/Debugger identifiers remain hidden without cutting or detaching the session. `C9.world-select` probes numeric and unique context selectors, object and argument handles, promises, properties, named bindings and DOM node resolution; each command selecting the hidden world must fail with the `slicc: refused:` prefix, never an ordinary browser error. Numeric guesses also sweep ids 1–32: an id not exposed to this client must be refused, while every exposed numeric context must remain usable; none of those guarded probes may reach the fixture content-script marker. The marker combines the content script’s global lexical `root` binding with its extension-id DOM marker and `chrome.runtime.id`, and is independently required to be absent from the page default world. `C9.world-debugger` pauses inside that content script: the control must reach its frame, while the guard must refuse or hide it. `C9.page-drivable` evaluates `self.origin`, captures a DOM snapshot and dispatches an Input click on the same ordinary page; cutting the entire session fails this regression row. All four use an unguarded control, the default browser context and observer discovery of the real extension world, not an invented isolated world. Protected default contexts remain session-cutting evidence; hiding a foreign isolated world does not weaken any seven-origin row.
 
-The integration launcher loads shared-web 1.25.1’s harness extension exactly once through `Extensions.loadUnpacked` (`ankmbodmgimjemnojmeddfcdlbocolob`), whose content script runs on HTTP(S) pages. shared-web 1.25.1 also loads it by default in its own harness. A transport unable to host a foreign content-script extension omits `extensionWorld` and reports `not-supported:extensionWorld`; an advertised capability with no observed world fails, rather than silently skipping.
+The integration launcher loads shared-web 1.25.2’s harness extension exactly once through `Extensions.loadUnpacked` (`ankmbodmgimjemnojmeddfcdlbocolob`), whose content script runs on HTTP(S) pages. shared-web 1.25.2 also loads it by default in its own harness. A transport unable to host a foreign content-script extension omits `extensionWorld` and reports `not-supported:extensionWorld`; an advertised capability with no observed world fails, rather than silently skipping.
+
+`C8.unparseable` probes both raw and canonical space/U+200D/invalid-punycode URLs through creation and navigation. Every guarded destination needs a matched refusal. Its unguarded controls record `document` or `native-rejection` outcomes, including Chrome builds that reject raw U+200D instead of committing it. Both raw and encoded-space forms must commit real fixture documents, because that is the proven cookie leak. An independent observer loads the encoded-space document and confirms it shares a uniquely seeded `.sliccy.ai` cookie; the guarded client must neither list nor attach to it, read its cookie, query that cookie by URL, nor cause a cookie-bearing destination request. The guard does not erase the observer’s private browser state. The row requires `browserSession`, uses the default context, and cleans up its own targets and cookie. The HTTP fixture accepts Chrome’s encoded-space Host header without reparsing it as a WHATWG origin.
 
 `C8.chrome-search` requests `chrome-search://most-visited/` through `Page.navigate` and requires an explicit guard refusal. Its unguarded control requires a CDP response, not a successful document commit: Chrome can answer with `errorText` when that internal data source is unavailable outside an Instant process. Browser-side load failure is not a guard refusal, and merely hiding the target must fail this row.
 
@@ -237,7 +245,9 @@ Popups are observed by `Target.targetCreated` with the opener's `openerId`, or b
 - `/plant`: sets the canary;
 - `/beacon`, and `/log?n=`, which returns `{ hits, beacons }`.
 
-`{ "extensionWorld": "hidden" | "select" | "debugger" | "drivable", "as": "world", "requires": ["extensionWorld"] }` runs the C9 compound probe on the current ordinary page. The runner attaches an independent observer to discover actual context ids, unique ids and names, and sends probes through the client session. Object handles are minted and validated on the unguarded control session, then replayed as guesses on the guarded leg; Chrome object handles and DOM node ids are session-local, so observer handles must never be mistaken for client handles. Numeric and unique context ids from the control are also replayed alongside fresh observer-discovered selectors. Every guarded replay needs an explicit refusal, including a stale handle (`not exposed`), rather than Chrome’s invalid-id error. Its result contains boolean evidence consumed by ordinary `result` checks. The unguarded leg validates those selectors against Chrome itself before guarded evidence can pass.
+`{ "extensionWorld": "hidden" | "select" | "debugger" | "drivable", "as": "world", "requires": ["extensionWorld"] }` runs the C9 compound probe on the current ordinary page. The runner attaches an independent observer to discover actual context ids, unique ids and names, and sends probes through the client session. Discovery matches the expected fixture extension’s exact origin, never the first extension world: `run()`’s optional `extensionWorldId` defaults to shared-web’s harness id `ankmbodmgimjemnojmeddfcdlbocolob`. Multiple unrelated content-script worlds are ignored for fixture selection, while guards must still protect foreign worlds. A custom fixture must provide the same content-script marker contract. Object handles are minted and validated on the unguarded control session, then replayed as guesses on the guarded leg; Chrome object handles and DOM node ids are session-local, so observer handles must never be mistaken for client handles. Numeric ids from the control are also replayed alongside fresh observer-discovered selectors, but numeric ids are local to a tab: a control id may name the next tab’s exposed default context, which must work and return no extension marker. The same-tab hidden world’s actual numeric id and every extension unique-id guess still require a matched refusal. Unknown numeric ids and stale object handles (`not exposed`) need explicit refusals rather than Chrome’s invalid-id errors. `guessesRefused` aggregates only required refusals; `guessesReached` must be false on the guarded leg, and `exposedContextsWork` must remain true. Its result contains boolean evidence consumed by ordinary `result` checks. The unguarded leg validates those selectors against Chrome itself before guarded evidence can pass.
+
+`{ "unparseable": true, "as": "unparseable", "requires": ["browserSession"] }` runs the C8 malformed-URL compound probe on the current ordinary page: independent browser ground truth, raw/canonical destination commands, discovery/attach and cookie checks. Boolean evidence is consumed by ordinary `result` checks, with native Chrome outcomes retained in its diagnostics.
 
 **The control rule.** Every vector has a control on an ordinary origin: the same setup and trigger against an unprotected origin must succeed. A missing or failing control fails the id. With `via: "guard"`, the control runs through the guard. With `via: "unguarded"`, the runner runs setup and trigger through its own CDP against the ordinary origin and against the protected stand-in, and both must show the effect. The runner reports the control's transport as `via`.
 

package/catalog.json

@@ -738,6 +738,8 @@
     "aboutScheme": "chrome",
     "targetTypes": ["browser_ui"],
     "inheriting": ["about:blank", "about:srcdoc"],
+    "unparseable": "protected",
+    "unparseableRefusal": "slicc: refused: slicc can't parse this URL, so it could be a protected page",
     "refusal": "slicc: refused: target is on seven's origin"
   },
   "profiles": {

package/extension-world.mjs

@@ -1,12 +1,15 @@
 import { outcome } from './guard-driver.mjs';
 
+export const DEFAULT_EXTENSION_WORLD_ID = 'ankmbodmgimjemnojmeddfcdlbocolob';
+
 const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 const extension = (context) =>
   context?.origin?.startsWith('chrome-extension://') && !context.auxData?.isDefault;
-const marker = 'typeof chrome.runtime?.id === "string"';
+const marker =
+  'typeof root !== "undefined" && root === document.documentElement && root.dataset.sliccHarnessExtension === chrome.runtime.id';
 const refused = (out) => !out.ok && /^slicc: refused:/.test(out.error?.message ?? '');
 
-async function discover(reader, session) {
+async function discover(reader, session, extensionId) {
   const start = reader.events.length;
   await reader.send('Runtime.enable', {}, session);
   const deadline = Date.now() + 5000;
@@ -17,12 +20,13 @@ async function discover(reader, session) {
         (event) =>
           event.sessionId === session &&
           event.method === 'Runtime.executionContextCreated' &&
-          extension(event.params.context)
+          extension(event.params.context) &&
+          event.params.context.origin === `chrome-extension://${extensionId}`
       )?.params.context;
     if (world) return world;
     await pause(25);
   } while (Date.now() < deadline);
-  throw new Error('extensionWorld: no foreign content-script context');
+  throw new Error(`extensionWorld: no content-script context for ${extensionId}`);
 }
 
 async function drivable(client, session, live) {
@@ -174,7 +178,74 @@ function commands(world, objectId, promiseObjectId, nodeId) {
   ];
 }
 
-async function selectWorld({ client, session, world, side, controls, live }) {
+async function guessWorld({ client, session, world, handles, events }) {
+  const exposed = new Set(
+    events()
+      .filter((event) => event.method === 'Runtime.executionContextCreated')
+      .map((event) => event.params.context.id)
+  );
+  const ids = new Set([
+    ...Array.from({ length: 32 }, (_, index) => index + 1),
+    handles.world.id,
+    world.id,
+    ...exposed,
+  ]);
+  const numeric = [];
+  for (const id of ids) {
+    const probes = [
+      ['Runtime.evaluate', { contextId: id, expression: marker, returnByValue: true }],
+      [
+        'Runtime.callFunctionOn',
+        {
+          executionContextId: id,
+          functionDeclaration: `function(){return ${marker}}`,
+          returnByValue: true,
+        },
+      ],
+    ];
+    for (const [method, params] of probes) {
+      const out = await outcome(client.send(method, params, session));
+      numeric.push({
+        id,
+        method,
+        exposed: exposed.has(id),
+        refused: refused(out),
+        ok: out.ok && !out.result.exceptionDetails && typeof out.result.result?.value === 'boolean',
+        reached: out.ok && out.result.result?.value === true,
+      });
+    }
+  }
+  const unique = [];
+  for (const uniqueContextId of new Set([handles.world.uniqueId, world.uniqueId])) {
+    const out = await outcome(
+      client.send(
+        'Runtime.evaluate',
+        { uniqueContextId, expression: marker, returnByValue: true },
+        session
+      )
+    );
+    unique.push({
+      uniqueContextId,
+      refused: refused(out),
+      reached: out.ok && out.result.result?.value === true,
+    });
+  }
+  return {
+    guessesRefused:
+      numeric.filter((guess) => !guess.exposed).every((guess) => guess.refused) &&
+      unique.every((guess) => guess.refused),
+    guessesReached: [...numeric, ...unique].some((guess) => guess.reached),
+    exposedContextsWork: numeric
+      .filter((guess) => guess.exposed)
+      .every((guess) => guess.ok && !guess.refused),
+    numericGuesses: numeric,
+    uniqueGuesses: unique,
+    controlNumericId: handles.world.id,
+    hiddenNumericId: world.id,
+  };
+}
+
+async function selectWorld({ client, session, world, side, controls, live, events }) {
   let handles = controls.select;
   if (side === 'control') {
     const object = await client.send(
@@ -220,19 +291,11 @@ async function selectWorld({ client, session, world, side, controls, live }) {
               : true);
     result[`${name}Error`] = out.error?.message ?? out.result?.exceptionDetails?.text;
   }
-  const guesses = commands(
-    handles.world,
-    handles.objectId,
-    handles.promiseObjectId,
-    dom.result?.root.nodeId ?? 1
-  ).slice(0, 3);
-  result.guessesRefused = true;
-  result.guessesReached = true;
-  for (const [, method, params] of guesses) {
-    const out = await outcome(client.send(method, params, session));
-    result.guessesRefused &&= refused(out);
-    result.guessesReached &&= out.ok && out.result.result?.value === true;
-  }
+  Object.assign(result, await guessWorld({ client, session, world, handles, events }));
+  const pageMarker = await outcome(
+    client.send('Runtime.evaluate', { expression: marker, returnByValue: true }, session)
+  );
+  result.pageMarkerAbsent = pageMarker.ok && pageMarker.result.result?.value === false;
   result.alive = await live();
   return result;
 }
@@ -246,12 +309,13 @@ export async function extensionWorld({
   origin,
   side,
   controls,
+  extensionId = DEFAULT_EXTENSION_WORLD_ID,
 }) {
   const attached = await reader.send('Target.attachToTarget', { targetId, flatten: true });
   const observer = attached.sessionId;
   const seen = client.events.length;
   try {
-    const world = await discover(reader, observer);
+    const world = await discover(reader, observer, extensionId);
     const enabled = await outcome(client.send('Runtime.enable', {}, session));
     await pause(100);
     const events = () => client.events.slice(seen).filter((event) => event.sessionId === session);

package/fixture-server.mjs

@@ -76,11 +76,28 @@ function route(req, url, send, html) {
   return send(404, 'missing', 'text/plain');
 }
 
+function requestURL(req, scheme) {
+  const origin = `${scheme}://${req.headers.host}`;
+  try {
+    return new URL(req.url, origin);
+  } catch {
+    const path = new URL(req.url, `${scheme}://fixture.invalid`);
+    return {
+      pathname: path.pathname,
+      searchParams: path.searchParams,
+      href: `${origin}${path.pathname}${path.search}${path.hash}`,
+      origin,
+      host: req.headers.host,
+      hostname: req.headers.host.replace(/:\d+$/, ''),
+    };
+  }
+}
+
 export async function fixtureServer({ host = '127.0.0.1', port = 0, tls, latency } = {}) {
   let entries = [];
   const scheme = tls ? 'https' : 'http';
   const handler = (req, res) => {
-    const url = new URL(req.url, `${scheme}://${req.headers.host}`);
+    const url = requestURL(req, scheme);
     entries.push({
       url: url.href,
       method: req.method,

package/guard-runner.mjs

@@ -11,6 +11,7 @@ import {
   result,
   steps,
 } from './guard-driver.mjs';
+import { unparseableURLs } from './unparseable-url.mjs';
 
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 const namedResultMs = 10000;
@@ -600,8 +601,10 @@ class Execution {
       this.errors.push(
         `${step.refusal.name} failed without a refusal: ${String(out.error?.message ?? out.error)}`
       );
-    if (step.extensionWorld && !out.ok)
-      this.errors.push(`extensionWorld: ${out.error?.message ?? 'probe failed'}`);
+    if ((step.extensionWorld || step.unparseable) && !out.ok)
+      this.errors.push(
+        `${step.unparseable ? 'unparseable' : 'extensionWorld'}: ${out.error?.message ?? 'probe failed'}`
+      );
     if (step.as && !out.result?.pending) this.calls[step.as] = out;
     if (step.cdp) (this.calls.$cdp ??= []).push({ method: step.cdp, ...out });
   }
@@ -651,6 +654,18 @@ class Execution {
       await this.settle(step.settle);
       return;
     }
+    if (step.unparseable)
+      return outcome(
+        unparseableURLs({
+          client: this.client,
+          reader: this.reader,
+          session,
+          targetId: this.pageTarget,
+          origin: this.vars.ordinary,
+          tag: this.vars.tag,
+          fixture: this.options.fixture,
+        })
+      );
     if (step.extensionWorld)
       return outcome(
         extensionWorld({
@@ -662,6 +677,7 @@ class Execution {
           origin: this.vars.ordinary,
           side: this.side,
           controls: (this.clients.extensionWorldControls ??= {}),
+          extensionId: this.options.extensionWorldId,
         })
       );
     if (step.guess) return this.guess(step.guess, session);

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.9.1",
+  "setVersion": "1.10.0",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -118,6 +118,195 @@
     "browserUi": "the id of one of Chrome's own browser_ui targets, which the runner looks up with its own CDP"
   },
   "vectors": [
+    {
+      "id": "C8.unparseable",
+      "family": "C",
+      "kind": "cdp",
+      "scope": "any",
+      "defaultContext": true,
+      "setup": [
+        {
+          "page": "tab",
+          "url": "{ordinary}/doc?n={tag}-ordinary"
+        }
+      ],
+      "trigger": [
+        {
+          "unparseable": true,
+          "as": "unparseable",
+          "requires": ["browserSession"]
+        }
+      ],
+      "targets": ["ordinary"],
+      "requires": ["browserSession"],
+      "observe": {
+        "live": {
+          "means": "unparseable URL protection live",
+          "check": {
+            "result": "unparseable",
+            "path": "result.live",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "createRefused": {
+          "means": "unparseable URL protection createRefused",
+          "check": {
+            "result": "unparseable",
+            "path": "result.createRefused",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "navigateRefused": {
+          "means": "unparseable URL protection navigateRefused",
+          "check": {
+            "result": "unparseable",
+            "path": "result.navigateRefused",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "listed": {
+          "means": "unparseable URL protection listed",
+          "check": {
+            "result": "unparseable",
+            "path": "result.listed",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "attached": {
+          "means": "unparseable URL protection attached",
+          "check": {
+            "result": "unparseable",
+            "path": "result.attached",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "attachRefused": {
+          "means": "unparseable URL protection attachRefused",
+          "check": {
+            "result": "unparseable",
+            "path": "result.attachRefused",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "readCookie": {
+          "means": "unparseable URL protection readCookie",
+          "check": {
+            "result": "unparseable",
+            "path": "result.readCookie",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "cookieRefused": {
+          "means": "unparseable URL protection cookieRefused",
+          "check": {
+            "result": "unparseable",
+            "path": "result.cookieRefused",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "cookieDelivered": {
+          "means": "unparseable URL protection cookieDelivered",
+          "check": {
+            "result": "unparseable",
+            "path": "result.cookieDelivered",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "cookieRequest": {
+          "means": "unparseable URL protection cookieRequest",
+          "check": {
+            "result": "unparseable",
+            "path": "result.cookieRequest",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "createAnswered": {
+          "means": "Chrome answers the raw and canonical URL probes without a guard refusal, including native invalid-URL responses",
+          "check": {
+            "result": "unparseable",
+            "path": "result.createAnswered",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "navigateAnswered": {
+          "means": "Chrome answers the raw and canonical URL probes without a guard refusal, including native invalid-URL responses",
+          "check": {
+            "result": "unparseable",
+            "path": "result.navigateAnswered",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "spaceCreated": {
+          "means": "the encoded-space fixture URL commits a real document unguarded",
+          "check": {
+            "result": "unparseable",
+            "path": "result.spaceCreated",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "spaceNavigated": {
+          "means": "the encoded-space fixture URL commits a real document unguarded",
+          "check": {
+            "result": "unparseable",
+            "path": "result.spaceNavigated",
+            "equals": true,
+            "observer": "client"
+          }
+        }
+      },
+      "live": "the independent observer loads a real Chrome document on the encoded-space host with a seeded seven cookie",
+      "liveCheck": {
+        "result": "unparseable",
+        "path": "result.live",
+        "equals": true,
+        "observer": "client"
+      },
+      "control": {
+        "origin": "ordinary",
+        "via": "unguarded",
+        "expected": {
+          "live": true,
+          "createRefused": false,
+          "navigateRefused": false,
+          "listed": true,
+          "attached": true,
+          "attachRefused": false,
+          "readCookie": true,
+          "cookieRefused": false,
+          "cookieDelivered": true,
+          "cookieRequest": true,
+          "createAnswered": true,
+          "navigateAnswered": true,
+          "spaceCreated": true,
+          "spaceNavigated": true
+        }
+      },
+      "expected": {
+        "live": true,
+        "createRefused": true,
+        "navigateRefused": true,
+        "listed": false,
+        "attached": false,
+        "attachRefused": true,
+        "readCookie": false,
+        "cookieRefused": true,
+        "cookieDelivered": false,
+        "cookieRequest": false
+      }
+    },
     {
       "id": "C9.world-hidden",
       "family": "C",
@@ -415,7 +604,7 @@
           }
         },
         "guessesRefused": {
-          "means": "numeric and unique context ids guessed from the successful control leg",
+          "means": "numeric ids 1..32 not exposed to this client, the same-tab hidden numeric id and extension unique-id guesses receive matched refusals; exposed numeric ids need not be refused",
           "check": {
             "result": "world",
             "path": "result.guessesRefused",
@@ -424,13 +613,31 @@
           }
         },
         "guessesReached": {
-          "means": "numeric and unique context ids guessed from the successful control leg",
+          "means": "numeric sweeps and extension unique-id guesses reach the content-script-only marker on the control, never on the guarded leg",
           "check": {
             "result": "world",
             "path": "result.guessesReached",
             "equals": true,
             "observer": "client"
           }
+        },
+        "exposedContextsWork": {
+          "means": "every numeric context id exposed to this client remains usable",
+          "check": {
+            "result": "world",
+            "path": "result.exposedContextsWork",
+            "equals": true,
+            "observer": "client"
+          }
+        },
+        "pageMarkerAbsent": {
+          "means": "the fixture content-script marker is absent from the page default world",
+          "check": {
+            "result": "world",
+            "path": "result.pageMarkerAbsent",
+            "equals": true,
+            "observer": "client"
+          }
         }
       },
       "live": "the observer confirms a foreign extension isolated world exists on an ordinary page",
@@ -465,7 +672,9 @@
           "resolveNodeRefused": false,
           "resolveNodeReached": true,
           "guessesRefused": false,
-          "guessesReached": true
+          "guessesReached": true,
+          "exposedContextsWork": true,
+          "pageMarkerAbsent": true
         }
       },
       "expected": {
@@ -480,7 +689,10 @@
         "propertiesRefused": true,
         "bindingRefused": true,
         "resolveNodeRefused": true,
-        "guessesRefused": true
+        "guessesRefused": true,
+        "exposedContextsWork": true,
+        "pageMarkerAbsent": true,
+        "guessesReached": false
       }
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.9.1",
+  "version": "1.10.0",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -51,7 +51,8 @@
     "schema",
     "guard-runner.mjs",
     "fixture-server.mjs",
-    "extension-world.mjs"
+    "extension-world.mjs",
+    "unparseable-url.mjs"
   ],
   "scripts": {
     "prepare": "lefthook install",
@@ -66,14 +67,14 @@
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish",
     "release": "semantic-release",
     "test:guard": "npm run test:guard-integration && npm run test:guard-sweep",
-    "test:guard-integration": "node --test --test-concurrency=2 test/integration/guard-lifecycle.test.mjs test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-worlds.test.mjs test/integration/guard-scales.test.mjs",
+    "test:guard-integration": "node --test --test-concurrency=2 test/integration/guard-lifecycle.test.mjs test/integration/guard-fit.test.mjs test/integration/guard-chain.test.mjs test/integration/guard-validation.test.mjs test/integration/guard-liveness.test.mjs test/integration/guard-observations.test.mjs test/integration/guard-child-latency.test.mjs test/integration/guard-adoption.test.mjs test/integration/guard-scoping.test.mjs test/integration/guard-late-pause.test.mjs test/integration/guard-legs.test.mjs test/integration/guard-fetch-enable.test.mjs test/integration/guard-diagnostics.test.mjs test/integration/guard-chrome.test.mjs test/integration/guard-worlds.test.mjs test/integration/guard-world-discovery.test.mjs test/integration/guard-world-guesses.test.mjs test/integration/guard-unparseable.test.mjs test/integration/guard-scales.test.mjs",
     "test:guard-sweep": "node scripts/test-guards.mjs",
     "test:gates": "node --test test/integration/gates.test.mjs",
     "test:guard-target": "node --test test/integration/guard-runner.test.mjs",
     "test:unit:guard": "node --experimental-test-coverage --test --test-coverage-include=guard-runner.mjs --test-coverage-include=fixture-server.mjs --test-coverage-lines=100 test/unit/guard-*.test.mjs"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-shared-web": "1.25.1",
+    "@ai-ecoverse/slicc-shared-web": "1.25.2",
     "@biomejs/biome": "2.5.15",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",

package/protected.json

@@ -1,7 +1,89 @@
 {
   "schema": 1,
+  "unparseable": "protected",
+  "unparseableRefusal": "slicc: refused: slicc can't parse this URL, so it could be a protected page",
   "origins": ["http://127.0.0.1:5710", "https://seven.example.test"],
   "urls": [
+    {
+      "url": "http://exa mple.sliccy.ai/",
+      "protected": true
+    },
+    {
+      "url": "http://exa%20mple.sliccy.ai/",
+      "protected": true
+    },
+    {
+      "url": "http://‍.sliccy.ai/",
+      "protected": true
+    },
+    {
+      "url": "http://xn--1ug.sliccy.ai/",
+      "protected": true
+    },
+    {
+      "url": "http://xn--a.sliccy.ai/",
+      "protected": true
+    },
+    {
+      "url": "http://[::1",
+      "protected": true
+    },
+    {
+      "url": "http://",
+      "protected": true
+    },
+    {
+      "url": "http://a:99999/",
+      "protected": true
+    },
+    {
+      "url": "http://1.2.3.4.5/",
+      "protected": true
+    },
+    {
+      "url": "http://%zz/",
+      "protected": true
+    },
+    {
+      "url": "http://[1::2::3]/",
+      "protected": true
+    },
+    {
+      "url": "http://a^b/",
+      "protected": true
+    },
+    {
+      "url": "blob:http://[::1",
+      "protected": true
+    },
+    {
+      "url": "http://‍.example/",
+      "protected": true
+    },
+    {
+      "url": "https://exa mple.com/",
+      "protected": true
+    },
+    {
+      "url": "https://exa%20mple.com/",
+      "protected": true
+    },
+    {
+      "url": "view-source:view-source:view-source:view-source:view-source:view-source:view-source:view-source:view-source:https://example.com/",
+      "protected": true
+    },
+    {
+      "url": "null",
+      "protected": false
+    },
+    {
+      "url": "://",
+      "protected": false
+    },
+    {
+      "url": "view-source:view-source:view-source:view-source:view-source:view-source:view-source:view-source:https://example.com/",
+      "protected": false
+    },
     {
       "url": "https://seven.sliccy.ai/",
       "protected": true
@@ -264,7 +346,7 @@
     },
     {
       "url": "blob:null/0b9e0f6c",
-      "protected": false
+      "protected": true
     },
     {
       "url": "blob:https://example.com/0b9e0f6c",
@@ -300,15 +382,15 @@
     },
     {
       "url": "https://",
-      "protected": false
+      "protected": true
     },
     {
       "url": "seven.sliccy.ai",
-      "protected": false
+      "protected": true
     },
     {
       "url": "not a url",
-      "protected": false
+      "protected": true
     },
     {
       "url": "https://vault-preview.sliccy.ai/",
@@ -656,6 +738,74 @@
     }
   ],
   "targets": [
+    {
+      "url": "http://exa mple.sliccy.ai/",
+      "protected": true
+    },
+    {
+      "url": "http://exa%20mple.sliccy.ai/",
+      "protected": true
+    },
+    {
+      "url": "http://‍.sliccy.ai/",
+      "protected": true
+    },
+    {
+      "url": "http://xn--1ug.sliccy.ai/",
+      "protected": true
+    },
+    {
+      "url": "http://xn--a.sliccy.ai/",
+      "protected": true
+    },
+    {
+      "url": "http://[::1",
+      "protected": true
+    },
+    {
+      "url": "http://",
+      "protected": true
+    },
+    {
+      "url": "http://a:99999/",
+      "protected": true
+    },
+    {
+      "url": "http://1.2.3.4.5/",
+      "protected": true
+    },
+    {
+      "url": "http://%zz/",
+      "protected": true
+    },
+    {
+      "url": "http://[1::2::3]/",
+      "protected": true
+    },
+    {
+      "url": "http://a^b/",
+      "protected": true
+    },
+    {
+      "url": "blob:http://[::1",
+      "protected": true
+    },
+    {
+      "url": "http://‍.example/",
+      "protected": true
+    },
+    {
+      "url": "https://exa mple.com/",
+      "protected": true
+    },
+    {
+      "url": "https://exa%20mple.com/",
+      "protected": true
+    },
+    {
+      "url": "view-source:view-source:view-source:view-source:view-source:view-source:view-source:view-source:view-source:https://example.com/",
+      "protected": true
+    },
     {
       "url": "chrome-search://private/",
       "type": "iframe",
@@ -978,6 +1128,26 @@
     }
   ],
   "storageKeys": [
+    {
+      "key": "http://[::1",
+      "protected": false
+    },
+    {
+      "key": "https://exa mple.com/",
+      "protected": false
+    },
+    {
+      "key": "blob:http://[::1",
+      "protected": false
+    },
+    {
+      "key": "view-source:view-source:view-source:view-source:view-source:view-source:view-source:view-source:view-source:https://seven.sliccy.ai/",
+      "protected": false
+    },
+    {
+      "key": "https://example.com/^0http://[::1",
+      "protected": false
+    },
     {
       "key": "https://seven.sliccy.ai/",
       "protected": true

package/protected.mjs

@@ -40,9 +40,13 @@ export function protectedOrigins(rules, extraOrigins = []) {
     return parse(`${rules.aboutScheme}://${u.pathname}${u.search}${u.hash}`) ?? u;
   };
 
-  const url = (text) => {
+  const exempt = (text) => text === '' || text === 'null' || text === '://';
+  const failed = (u) => !u || rules.innerSchemes.includes(scheme(u));
+  const unparseable = (text) => !exempt(text) && failed(unwrap(parse(text)));
+
+  const url = (text, { readOnly = false } = {}) => {
     const u = alias(unwrap(parse(text)));
-    if (!u) return false;
+    if (failed(u)) return rules.unparseable === 'protected' && !readOnly && !exempt(text);
     const s = scheme(u);
     if (rules.anySchemes.includes(s)) return true;
     if ((rules.protectedSchemes ?? []).includes(s))
@@ -80,8 +84,10 @@ export function protectedOrigins(rules, extraOrigins = []) {
 
   const storageKey = (key) => {
     const [first, ...rest] = key.split('^');
-    return [first, ...rest.filter((p) => p.startsWith('0')).map((p) => p.slice(1))].some(url);
+    return [first, ...rest.filter((p) => p.startsWith('0')).map((p) => p.slice(1))].some((text) =>
+      url(text, { readOnly: true })
+    );
   };
 
-  return { url, target, cookieDomain, storageKey };
+  return { url, target, cookieDomain, storageKey, unparseable };
 }

package/schema/catalog.schema.json

@@ -185,6 +185,8 @@
         "aboutScheme",
         "targetTypes",
         "inheriting",
+        "unparseable",
+        "unparseableRefusal",
         "refusal"
       ],
       "properties": {
@@ -225,6 +227,10 @@
           "uniqueItems": true,
           "items": { "type": "string", "pattern": "^about:[a-z]+$" }
         },
+        "unparseable": { "const": "protected" },
+        "unparseableRefusal": {
+          "const": "slicc: refused: slicc can't parse this URL, so it could be a protected page"
+        },
         "refusal": { "$ref": "#/$defs/name" }
       }
     },

package/schema/guard-vectors.schema.json

@@ -427,6 +427,26 @@
     },
     "step": {
       "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["unparseable", "as", "requires"],
+          "properties": {
+            "unparseable": {
+              "const": true
+            },
+            "as": {
+              "$ref": "#/$defs/name"
+            },
+            "requires": {
+              "$ref": "#/$defs/requires",
+              "type": "array",
+              "contains": {
+                "const": "browserSession"
+              }
+            }
+          }
+        },
         {
           "type": "object",
           "additionalProperties": false,

package/schema/protected.schema.json

@@ -4,9 +4,22 @@
   "title": "slicc-browsers protected-origin test vectors, schema 1",
   "type": "object",
   "additionalProperties": false,
-  "required": ["schema", "origins", "urls", "targets", "cookieDomains", "storageKeys"],
+  "required": [
+    "schema",
+    "unparseable",
+    "unparseableRefusal",
+    "origins",
+    "urls",
+    "targets",
+    "cookieDomains",
+    "storageKeys"
+  ],
   "properties": {
     "schema": { "const": 1 },
+    "unparseable": { "const": "protected" },
+    "unparseableRefusal": {
+      "const": "slicc: refused: slicc can't parse this URL, so it could be a protected page"
+    },
     "origins": { "type": "array", "items": { "type": "string", "minLength": 1 } },
     "urls": {
       "type": "array",

package/unparseable-url.mjs

@@ -0,0 +1,203 @@
+import { outcome } from './guard-driver.mjs';
+
+const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const refused = (out) => !out.ok && /^slicc: refused:/.test(out.error?.message ?? '');
+const hosts = [
+  ['exa mple.sliccy.ai', 'exa%20mple.sliccy.ai'],
+  ['exa%20mple.sliccy.ai', 'exa%20mple.sliccy.ai'],
+  ['\u200d.sliccy.ai', 'xn--1ug.sliccy.ai'],
+  ['xn--1ug.sliccy.ai', 'xn--1ug.sliccy.ai'],
+  ['xn--a.sliccy.ai', 'xn--a.sliccy.ai'],
+];
+
+async function document(reader, targetId, expected, allowNativeRejection = false) {
+  const { sessionId } = await reader.send('Target.attachToTarget', { targetId, flatten: true });
+  try {
+    const deadline = Date.now() + 5000;
+    let last;
+    let targetURL;
+    do {
+      const { targetInfo } = await reader.send('Target.getTargetInfo', { targetId });
+      targetURL = targetInfo.url;
+      if (targetInfo.url !== expected) {
+        last = { url: targetInfo.url, title: targetInfo.title };
+        await pause(25);
+        continue;
+      }
+      if (allowNativeRejection) {
+        const { frameTree } = await reader.send('Page.getFrameTree', {}, sessionId);
+        if (frameTree.frame.unreachableUrl || frameTree.frame.url.startsWith('chrome-error:'))
+          return { nativeRejected: true, url: frameTree.frame.url };
+      }
+      const out = await outcome(
+        reader.send(
+          'Runtime.evaluate',
+          {
+            expression: '({ title: document.title, href: location.href, cookie: document.cookie })',
+            returnByValue: true,
+          },
+          sessionId
+        )
+      );
+      const value = out.result?.result?.value;
+      last = value ?? out;
+      if (out.ok && value?.title === 'doc' && value.href === expected) return value;
+      await pause(25);
+    } while (Date.now() < deadline);
+    if (allowNativeRejection && ['', 'about:blank', 'about:blank#blocked'].includes(targetURL))
+      return { nativeRejected: true, url: last?.url ?? '' };
+    throw new Error(
+      `unparseable: Chrome did not load a fixture document at ${expected}: ${JSON.stringify(last)}`
+    );
+  } finally {
+    await outcome(reader.send('Target.detachFromTarget', { sessionId }));
+  }
+}
+
+async function documentOutcome(reader, targetId, expected, out, strict) {
+  if (refused(out)) return 'guard-refusal';
+  if (!out.ok || out.result.errorText || !targetId) return 'native-rejection';
+  const loaded = await document(reader, targetId, expected, !strict);
+  return loaded.nativeRejected ? 'native-rejection' : 'document';
+}
+
+async function destinations({ client, reader, root, tag, targets, session, targetId }) {
+  const result = {
+    createRefused: true,
+    navigateRefused: true,
+    createAnswered: true,
+    navigateAnswered: true,
+    spaceCreated: true,
+    spaceNavigated: true,
+    responses: [],
+  };
+  const invalid = (out) =>
+    out.error?.code === -32000 && /invalid URL/i.test(out.error?.message ?? '');
+  for (const [index, [input, canonical]] of hosts.entries()) {
+    const strict = canonical === 'exa%20mple.sliccy.ai';
+    const base = `${root.protocol}//${canonical}:${root.port}/doc?n=${tag}`;
+    const created = await outcome(
+      client.send('Target.createTarget', {
+        url: `${root.protocol}//${input}:${root.port}/doc?n=${tag}-create-${index}`,
+        background: true,
+      })
+    );
+    result.createRefused &&= refused(created);
+    result.createAnswered &&= (created.ok && Boolean(created.result.targetId)) || invalid(created);
+    if (created.result?.targetId) targets.add(created.result.targetId);
+    const createOutcome = await documentOutcome(
+      reader,
+      created.result?.targetId,
+      `${base}-create-${index}`,
+      created,
+      strict
+    );
+    const navigated = await outcome(
+      client.send(
+        'Page.navigate',
+        { url: `${root.protocol}//${input}:${root.port}/doc?n=${tag}-navigate-${index}` },
+        session
+      )
+    );
+    result.navigateRefused &&= refused(navigated);
+    result.navigateAnswered &&= navigated.ok || invalid(navigated);
+    const navigateOutcome = await documentOutcome(
+      reader,
+      targetId,
+      `${base}-navigate-${index}`,
+      navigated,
+      strict
+    );
+    if (strict) {
+      result.spaceCreated &&= createOutcome === 'document';
+      result.spaceNavigated &&= navigateOutcome === 'document';
+    }
+    result.responses.push({ input, canonical, created, navigated, createOutcome, navigateOutcome });
+    await outcome(
+      client.send(
+        'Page.navigate',
+        { url: `${root.origin}/doc?n=${tag}-ordinary-${index}` },
+        session
+      )
+    );
+  }
+  return result;
+}
+
+export async function unparseableURLs({ client, reader, session, targetId, origin, tag, fixture }) {
+  const root = new URL(origin);
+  const cookie = `seven-unparseable-${tag}`;
+  const value = `secret-${tag}`;
+  const targets = new Set();
+  let observer;
+  try {
+    await reader.send('Storage.setCookies', {
+      cookies: [{ name: cookie, value, domain: '.sliccy.ai', path: '/', secure: false }],
+    });
+    const url = `${root.protocol}//exa%20mple.sliccy.ai:${root.port}/doc?n=${tag}-observer`;
+    const { targetId: probeId } = await reader.send('Target.createTarget', {
+      url,
+      background: true,
+    });
+    targets.add(probeId);
+    const ground = await document(reader, probeId, url);
+    observer = (await reader.send('Target.attachToTarget', { targetId: probeId, flatten: true }))
+      .sessionId;
+    const listed = await outcome(client.send('Target.getTargets', {}));
+    const attached = await outcome(
+      client.send('Target.attachToTarget', { targetId: probeId, flatten: true })
+    );
+    let readCookie = false;
+    if (attached.ok) {
+      const read = await outcome(
+        client.send(
+          'Runtime.evaluate',
+          {
+            expression: `document.cookie.includes(${JSON.stringify(`${cookie}=${value}`)})`,
+            returnByValue: true,
+          },
+          attached.result.sessionId
+        )
+      );
+      readCookie = read.ok && read.result.result?.value === true;
+      await outcome(
+        client.send('Target.detachFromTarget', { sessionId: attached.result.sessionId })
+      );
+    }
+    const queried = await outcome(client.send('Network.getCookies', { urls: [url] }, session));
+    const result = {
+      browserVersion: (await reader.send('Browser.getVersion', {})).product,
+      live: ground.cookie.includes(`${cookie}=${value}`),
+      listed: listed.ok && listed.result.targetInfos?.some((info) => info.targetId === probeId),
+      attached: attached.ok,
+      attachRefused: refused(attached),
+      readCookie,
+      cookieRefused: refused(queried),
+      cookieDelivered:
+        queried.ok &&
+        queried.result.cookies?.some((entry) => entry.name === cookie && entry.value === value),
+      ...(await destinations({ client, reader, root, tag, targets, session, targetId })),
+    };
+    await pause(100);
+    const requests = await fixture.log();
+    result.cookieRequest = requests.some((entry) =>
+      entry.url.includes(`${tag}-create-`) || entry.url.includes(`${tag}-navigate-`)
+        ? entry.headers.cookie?.includes(`${cookie}=${value}`)
+        : false
+    );
+    return result;
+  } finally {
+    if (observer)
+      await outcome(
+        reader.send(
+          'Network.deleteCookies',
+          { name: cookie, domain: '.sliccy.ai', path: '/' },
+          observer
+        )
+      );
+    const listed = await outcome(reader.send('Target.getTargets', {}));
+    for (const info of listed.result?.targetInfos ?? [])
+      if (info.url.includes(tag)) targets.add(info.targetId);
+    for (const targetId of targets) await outcome(reader.send('Target.closeTarget', { targetId }));
+  }
+}