humanish 0.136.1 → 0.138.0

package/dist/evidence/browser-network.js

@@ -0,0 +1,516 @@
+import { createHash } from "node:crypto";
+import { setImmediate as nextTurn } from "node:timers/promises";
+import { assertSafeOutputPathSegment } from "../run/contained-output.js";
+import { scrubSandboxIds } from "../run/sandbox-ids.js";
+import { isNonNegativeSafeInteger, isRecord } from "../run/type-guards.js";
+import { originKeepsNoWithheldLabel, pageProblem, pathKeepsNoWithheldSegment, tracePage, } from "./trace-page.js";
+// A participant's browser network log: the requests its browser made, one record per request hop,
+// each tagged with the turn it happened in. The in-sandbox holder appends a short line per
+// DevTools event (src/substrates/e2b/cdp-network-capture.ts). This module joins those lines into
+// records, redacts each address as a trace page is redacted, and binds the file it writes to the
+// stream index run.json carries. verify reads the file with networkRecordProblem, the check the
+// writer applies before it writes a record.
+export const BROWSER_NETWORK_SCHEMA = "humanish.browser-network.v1";
+/** Why records are missing from a participant's network log, as the index's `reason` says. */
+export const BROWSER_NETWORK_GAPS = [
+    "no-capture",
+    "holder-stopped",
+    "capped",
+    "not-collected",
+];
+/** The first records a log keeps, then the failed, pending and 400-or-above records past them. */
+const FIRST_RECORDS = 20_000;
+const NOTABLE_RECORDS = 5_000;
+const MAX_FILE_BYTES = 8 * 1024 * 1024;
+/** The lowercase CDP ResourceType names; any other type is written as `other`. */
+const RESOURCE_TYPES = new Set([
+    "document",
+    "stylesheet",
+    "image",
+    "media",
+    "font",
+    "script",
+    "texttrack",
+    "xhr",
+    "fetch",
+    "prefetch",
+    "eventsource",
+    "websocket",
+    "manifest",
+    "signedexchange",
+    "ping",
+    "cspviolationreport",
+    "preflight",
+    "fedcm",
+    "other",
+]);
+const CACHES = new Set([
+    "memory",
+    "disk",
+    "prefetch",
+    "service-worker",
+    "back-forward",
+]);
+const RECORD_KEYS = new Set([
+    "at",
+    "turn",
+    "method",
+    "origin",
+    "path",
+    "type",
+    "status",
+    "ms",
+    "redirect",
+    "cache",
+    "failed",
+    "pending",
+]);
+/** The HTTP methods a record names; a page can send any token as a method, written as `OTHER`. */
+const METHODS = new Set([
+    "GET",
+    "HEAD",
+    "POST",
+    "PUT",
+    "DELETE",
+    "OPTIONS",
+    "PATCH",
+    "CONNECT",
+    "TRACE",
+    "OTHER",
+]);
+const FAILED = /^ERR_[A-Z0-9_]{1,64}$/;
+const ISO_TIME = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+/** Whether `value` is an ISO time as `Date.prototype.toISOString` writes one. */
+export function isIsoTime(value) {
+    if (typeof value !== "string" || !ISO_TIME.test(value))
+        return false;
+    const time = Date.parse(value);
+    return Number.isFinite(time) && new Date(time).toISOString() === value;
+}
+/** The run-relative path of a participant's network log. */
+export function networkLogPath(participantId) {
+    return `network/${participantId}.ndjson`;
+}
+const optional = (value, valid) => value === undefined || valid(value);
+/**
+ * What is wrong with one network log record, or undefined when it holds only the schema's keys and
+ * values. The writer leaves out a record this names; verify reports one as a finding. Never says
+ * what the record holds.
+ */
+export function networkRecordProblem(record) {
+    if (!isRecord(record))
+        return "is not a JSON object";
+    if (Object.keys(record).some((key) => !RECORD_KEYS.has(key)))
+        return "has a key outside the schema";
+    if (!isIsoTime(record.at))
+        return "has a start time that is not an ISO time";
+    if (!optional(record.turn, isNonNegativeSafeInteger))
+        return "has a turn that is not a whole number from 0";
+    if (!optional(record.method, (method) => typeof method === "string" && METHODS.has(method)))
+        return "has a method outside the HTTP methods and `OTHER`";
+    const page = pageProblem({ origin: record.origin, path: record.path });
+    if (page !== undefined)
+        return page;
+    if (!pathKeepsNoWithheldSegment(String(record.path)))
+        return "has a path segment the trace page rule withholds";
+    if (!originKeepsNoWithheldLabel(String(record.origin)))
+        return "has a host label the trace page rule withholds";
+    if (typeof record.type !== "string" || !RESOURCE_TYPES.has(record.type))
+        return "has a resource type outside the list";
+    if (!optional(record.status, (status) => Number.isInteger(status) && Number(status) >= 100 && Number(status) <= 599))
+        return "has a status outside 100 to 599";
+    if (!optional(record.ms, isNonNegativeSafeInteger))
+        return "has a duration that is not a whole number of milliseconds from 0";
+    if (!optional(record.cache, (cache) => typeof cache === "string" && CACHES.has(cache)))
+        return "has a cache value outside the list";
+    if (!optional(record.failed, (failed) => typeof failed === "string" && FAILED.test(failed)))
+        return "has error text that is not ERR_ then capital letters, digits or underscores";
+    if (!optional(record.redirect, (flag) => flag === true))
+        return "has a redirect flag other than true";
+    if (!optional(record.pending, (flag) => flag === true))
+        return "has a pending flag other than true";
+    if (record.pending === true && (record.ms !== undefined || record.failed !== undefined))
+        return "has a duration or a failure on a request with no recorded end";
+    if (record.cache === "back-forward" &&
+        (record.type !== "document" ||
+            ["method", "status", "ms", "failed", "pending", "redirect"].some((key) => key in record)))
+        return "is a back-forward restore, which sends no request, with request fields or a type other than document";
+    return undefined;
+}
+/** The longest the reduction runs before it lets other work on the event loop go first. */
+const SLICE_MS = 20;
+/**
+ * The index of a participant whose events were never read: capture did not start, or the file
+ * could not be read at teardown. No file goes with it.
+ */
+export function networkIndexWithoutEvents(capture, reason) {
+    return {
+        schema: BROWSER_NETWORK_SCHEMA,
+        origins: indexOrigins(capture.origins, withSandboxScrub(capture)),
+        complete: false,
+        reason,
+        omitted: { otherOrigin: 0, overCap: 0, invalid: 0 },
+    };
+}
+/** The capture's redaction, then the sandbox id scrub, so tracePage withholds a segment naming one. */
+function withSandboxScrub(capture) {
+    const ids = (capture.sandboxIds ?? []).filter((id) => id !== "");
+    return ids.length === 0 ? capture.redact : (text) => scrubSandboxIds(capture.redact(text), ids);
+}
+/** The allowed origins as the index lists them: each redacted as a trace page's origin is. */
+function indexOrigins(origins, redact) {
+    return [
+        ...new Set(origins.flatMap((origin) => {
+            const page = tracePage(origin, redact);
+            return page === undefined ? [] : [page.origin];
+        })),
+    ];
+}
+/**
+ * The network log of one participant: the records the holder's events give, joined by request id
+ * into one per hop, redacted, tagged with turns, checked and capped, then the index that binds
+ * them. A redirect gives the 3xx hop's record, then one with `redirect: true`. A request's turn is
+ * the N of the first mark at or after its start, or the last mark's N plus 1 after every mark.
+ * Capture that started and kept no record writes no file. Only a hop the caps still take is
+ * redacted, and the work yields to the event loop every 20 ms, so the other participants of a
+ * fan-out keep running while a 32 MiB events file is reduced. Throws only for a participant id
+ * that is not one path segment.
+ */
+export async function reduceBrowserNetwork(capture) {
+    const { participantId } = capture;
+    assertSafeOutputPathSegment(participantId, "Network log participant");
+    const redact = withSandboxScrub(capture);
+    const origins = indexOrigins(capture.origins, redact);
+    let sliceStart = performance.now();
+    const pause = async () => {
+        if (performance.now() - sliceStart < SLICE_MS)
+            return;
+        await nextTurn();
+        sliceStart = performance.now();
+    };
+    const read = await joinHops(capture.events, capture.origins, pause);
+    const omitted = { otherOrigin: read.otherOrigin, overCap: 0, invalid: 0 };
+    if (read.startedAt === undefined)
+        return {
+            index: { ...networkIndexWithoutEvents(capture, "no-capture"), omitted },
+            warnings: [],
+        };
+    const pageOf = cachedPages(redact);
+    const turnOf = turnRule(capture.marks);
+    const lines = [];
+    const kept = { failed: 0, pending: 0 };
+    const room = {
+        first: FIRST_RECORDS,
+        notable: NOTABLE_RECORDS,
+        bytes: MAX_FILE_BYTES,
+        full: false,
+    };
+    for (const hop of read.hops) {
+        await pause();
+        if (isoOf(hop.wallTime) === undefined) {
+            omitted.invalid += 1;
+            continue;
+        }
+        if (slotFor(hop, room) === undefined) {
+            omitted.overCap += 1;
+            continue;
+        }
+        const record = recordOf(hop, pageOf(hop.url), turnOf);
+        if (networkRecordProblem(record) !== undefined) {
+            omitted.invalid += 1;
+            continue;
+        }
+        const line = `${JSON.stringify(record)}\n`;
+        if (!fits(hop, Buffer.byteLength(line, "utf8"), room)) {
+            omitted.overCap += 1;
+            continue;
+        }
+        lines.push(line);
+        if (record.failed !== undefined)
+            kept.failed += 1;
+        if (record.pending === true)
+            kept.pending += 1;
+    }
+    const reason = read.capped || omitted.overCap > 0
+        ? "capped"
+        : read.stopped || capture.holderExited === true
+            ? "holder-stopped"
+            : undefined;
+    const gap = { complete: reason === undefined, ...(reason === undefined ? {} : { reason }) };
+    if (lines.length === 0)
+        return {
+            index: {
+                schema: BROWSER_NETWORK_SCHEMA,
+                startedAt: read.startedAt,
+                origins,
+                ...gap,
+                omitted,
+            },
+            warnings: [],
+        };
+    const text = lines.join("");
+    const bytes = Buffer.from(text, "utf8");
+    return {
+        index: {
+            schema: BROWSER_NETWORK_SCHEMA,
+            path: networkLogPath(participantId),
+            records: lines.length,
+            ...kept,
+            bytes: bytes.length,
+            sha256: createHash("sha256").update(bytes).digest("hex"),
+            startedAt: read.startedAt,
+            origins,
+            ...gap,
+            omitted,
+        },
+        text,
+        warnings: capture.marks.length === 0
+            ? [
+                `Participant ${participantId}'s network log has no turn numbers: no checkpoint screenshot recorded a browser-state read, so its requests could not be matched to turns. Each record's time (at) still places it.`,
+            ]
+            : [],
+    };
+}
+/**
+ * The page a request address is written as. tracePage runs once per address the holder wrote,
+ * which is a raw origin and path: a page polling one endpoint repeats the same address thousands
+ * of times, and an uncached call costs a few hundred microseconds.
+ */
+function cachedPages(redact) {
+    const pages = new Map();
+    return (url) => {
+        let page = pages.get(url);
+        if (page === undefined) {
+            page = tracePage(url, redact) ?? null;
+            pages.set(url, page);
+        }
+        return page ?? undefined;
+    };
+}
+const finite = (value) => typeof value === "number" && Number.isFinite(value) ? value : undefined;
+/**
+ * The holder's lines joined by request id, each hop kept only when its address is on one of
+ * `allowedOrigins`. A last line with no line end is still being written.
+ */
+async function joinHops(events, allowedOrigins, pause) {
+    const allowed = new Set(allowedOrigins.flatMap((origin) => URL.parse(origin)?.origin ?? []));
+    // The holder writes only allowed addresses; the host decides what is written.
+    const allowedUrl = (url) => typeof url === "string" && allowed.has(URL.parse(url)?.origin ?? "") ? url : undefined;
+    const joined = {
+        hops: [],
+        startedAt: undefined,
+        otherOrigin: 0,
+        capped: false,
+        stopped: false,
+    };
+    const open = new Map();
+    const whole = events.slice(0, events.lastIndexOf("\n") + 1);
+    for (const text of whole.split("\n")) {
+        await pause();
+        if (text === "")
+            continue;
+        let line;
+        try {
+            line = JSON.parse(text);
+        }
+        catch {
+            continue;
+        }
+        if (!isRecord(line))
+            continue;
+        const id = typeof line.id === "string" ? line.id : "";
+        const hop = open.get(id);
+        switch (line.e) {
+            case "start":
+                joined.startedAt ??= isoOf(finite(line.wallTime));
+                break;
+            case "cap":
+                joined.capped = true;
+                break;
+            case "exit":
+                joined.stopped = true;
+                break;
+            case "request": {
+                const redirected = isRecord(line.redirectResponse);
+                if (hop !== undefined && redirected) {
+                    answer(hop, line.redirectResponse);
+                    close(hop, line.timestamp);
+                }
+                open.delete(id);
+                const url = allowedUrl(line.url);
+                if (url === undefined) {
+                    joined.otherOrigin += 1;
+                    break;
+                }
+                const next = {
+                    wallTime: finite(line.wallTime),
+                    timestamp: finite(line.timestamp),
+                    url,
+                    method: typeof line.method === "string" ? line.method : undefined,
+                    type: typeof line.type === "string" ? line.type : "",
+                    redirect: redirected,
+                    done: false,
+                };
+                joined.hops.push(next);
+                open.set(id, next);
+                break;
+            }
+            case "response":
+                if (hop !== undefined)
+                    answer(hop, line);
+                break;
+            case "servedFromCache":
+                if (hop !== undefined)
+                    hop.cache = "memory";
+                break;
+            case "finished":
+            case "failed":
+                if (hop === undefined)
+                    break;
+                if (line.e === "failed")
+                    hop.failed = failedOf(line.errorText);
+                close(hop, line.timestamp);
+                open.delete(id);
+                break;
+            case "backForward": {
+                // A restore from the back-forward cache sends no request.
+                const url = allowedUrl(line.url);
+                if (url === undefined)
+                    joined.otherOrigin += 1;
+                else
+                    joined.hops.push({
+                        wallTime: finite(line.wallTime),
+                        timestamp: undefined,
+                        url,
+                        method: undefined,
+                        type: "document",
+                        redirect: false,
+                        cache: "back-forward",
+                        done: true,
+                    });
+                break;
+            }
+            default:
+                break;
+        }
+    }
+    // Sorted by start; a hop with no start time sorts last and is counted invalid.
+    joined.hops.sort((left, right) => (left.wallTime ?? Number.POSITIVE_INFINITY) - (right.wallTime ?? Number.POSITIVE_INFINITY));
+    return joined;
+}
+/** A response's status and cache flags onto its hop. A memory-cache serve outranks the flags. */
+function answer(hop, response) {
+    if (!isRecord(response))
+        return;
+    const status = response.status;
+    if (Number.isInteger(status) && Number(status) >= 100 && Number(status) <= 599)
+        hop.status = Number(status);
+    if (hop.cache === "memory")
+        return;
+    if (response.fromDiskCache === true)
+        hop.cache = "disk";
+    else if (response.fromPrefetchCache === true)
+        hop.cache = "prefetch";
+    else if (response.fromServiceWorker === true)
+        hop.cache = "service-worker";
+}
+function close(hop, timestamp) {
+    const end = finite(timestamp);
+    if (end !== undefined)
+        hop.end = end;
+    hop.done = true;
+}
+/** `loadingFailed.errorText` without its `net::` prefix, or ERR_OTHER for any other text. */
+function failedOf(errorText) {
+    const text = typeof errorText === "string" ? errorText.replace(/^net::/, "") : "";
+    return FAILED.test(text) ? text : "ERR_OTHER";
+}
+function isoOf(wallTime) {
+    if (wallTime === undefined)
+        return undefined;
+    const date = new Date(wallTime * 1000);
+    return Number.isNaN(date.getTime()) ? undefined : date.toISOString();
+}
+/**
+ * The turn rule over `marks`: the N of the first mark at or after a start time, the last mark's N
+ * plus 1 after every mark, and no turn when there are no marks.
+ */
+function turnRule(marks) {
+    const sorted = marks
+        .filter((mark) => Number.isFinite(mark.wallTime) && isNonNegativeSafeInteger(mark.turn))
+        .toSorted((left, right) => left.wallTime - right.wallTime);
+    const last = sorted.at(-1);
+    if (last === undefined)
+        return () => undefined;
+    return (wallTime) => {
+        if (wallTime === undefined)
+            return undefined;
+        let low = 0;
+        let high = sorted.length;
+        while (low < high) {
+            const middle = (low + high) >>> 1;
+            if (sorted[middle].wallTime < wallTime)
+                low = middle + 1;
+            else
+                high = middle;
+        }
+        return low < sorted.length ? sorted[low].turn : last.turn + 1;
+    };
+}
+/**
+ * The record of a hop whose address traced to `page`; an address tracePage gave no page for gets
+ * an origin and path the record check refuses. A hop whose events say it ended before it started,
+ * as a cross-origin preflight's do, gets no `ms`.
+ */
+function recordOf(hop, page, turnOf) {
+    const turn = turnOf(hop.wallTime);
+    const type = hop.type.toLowerCase();
+    const ms = hop.end !== undefined && hop.timestamp !== undefined && hop.end >= hop.timestamp
+        ? Math.round((hop.end - hop.timestamp) * 1000)
+        : undefined;
+    return {
+        at: isoOf(hop.wallTime),
+        ...(turn === undefined ? {} : { turn }),
+        ...(hop.cache === "back-forward"
+            ? {}
+            : { method: hop.method !== undefined && METHODS.has(hop.method) ? hop.method : "OTHER" }),
+        origin: page?.origin ?? "",
+        path: page?.path ?? "",
+        type: RESOURCE_TYPES.has(type) ? type : "other",
+        ...(hop.status === undefined ? {} : { status: hop.status }),
+        ...(ms === undefined ? {} : { ms }),
+        ...(hop.redirect ? { redirect: true } : {}),
+        ...(hop.cache === undefined ? {} : { cache: hop.cache }),
+        ...(hop.failed === undefined ? {} : { failed: hop.failed }),
+        ...(hop.done ? {} : { pending: true }),
+    };
+}
+/**
+ * The slot a hop's record would take: one of the first records, or a notable one past them when
+ * it failed, is pending or has status 400 or above. Undefined when the caps take no more.
+ */
+function slotFor(hop, room) {
+    if (room.full)
+        return undefined;
+    if (room.first > 0)
+        return "first";
+    const notable = hop.failed !== undefined || !hop.done || (hop.status ?? 0) >= 400;
+    return notable && room.notable > 0 ? "notable" : undefined;
+}
+/**
+ * Whether a hop's record of `size` bytes still fits: a slot is free and the byte cap is not
+ * passed. After the first line that would pass the byte cap, no later line is written, so a reader
+ * knows the file ends where the cap fell.
+ */
+function fits(hop, size, room) {
+    const slot = slotFor(hop, room);
+    if (slot === undefined)
+        return false;
+    if (size > room.bytes) {
+        room.full = true;
+        return false;
+    }
+    room.bytes -= size;
+    room[slot] -= 1;
+    return true;
+}

package/dist/evidence/trace-page.d.ts

@@ -1,6 +1,36 @@
 import type { TracePage } from "../actors/contract.js";
+/**
+ * A computer-use trace's text redaction, which its narration and its pages go through: the run's
+ * known-value scrub, then `redactText`, then `redactEncodedText`, then the scrub again.
+ * - A value the model transcribes (a DB password it read on screen) has no shape, so `redactText`
+ *   alone cannot catch it; the scrub closes that.
+ * - The participant receives its instructions as written, so it can repeat a key the study wrote
+ *   base64- or percent-encoded, which verify decodes; `redactEncodedText` removes that one too.
+ * - The scrub runs again last: a marker written before other text can spell a known value, as
+ *   `[REDACTED_SECRET] and` spells `SECRET] and`.
+ */
+export declare function traceRedaction(scrubText: (text: string) => string, redactText: (text: string) => string): (text: string) => string;
 /**
  * The page of an observed URL, or undefined when there is none or the URL parser rejects it.
- * `redact` is the trace's text redaction (the run's known-value scrub, then redactText).
+ * `redact` is the trace's text redaction (traceRedaction).
  */
 export declare function tracePage(url: string | undefined, redact: (text: string) => string): TracePage | undefined;
+/**
+ * Whether no segment of a recorded path is one tracePage withholds by its shape alone: an encoding
+ * that hides text, an address or a token. A segment the run's redaction changed is the marker
+ * already, and the text scan finds secret shapes. verify holds each network log record's path to
+ * it, as the writer does.
+ */
+export declare function pathKeepsNoWithheldSegment(path: string): boolean;
+/**
+ * Whether no host label of a recorded origin is one tracePage withholds: a token-shaped label in
+ * any reading, apart from the text redaction itself writes. verify holds each network log origin to it, as the
+ * writer does.
+ */
+export declare function originKeepsNoWithheldLabel(origin: string): boolean;
+/**
+ * What is wrong with a recorded page, or undefined when it holds an origin and a path only, as
+ * tracePage writes one. verify applies it to each recorded page and the browser network log's
+ * record check to each record's origin and path.
+ */
+export declare function pageProblem(page: unknown): string | undefined;

package/dist/evidence/trace-page.js

@@ -1,4 +1,5 @@
-import { readingsOf, scanEncodedText } from "./encoded-text.js";
+import { isRecord } from "../run/type-guards.js";
+import { readingsOf, redactEncodedText, scanEncodedText } from "./encoded-text.js";
 import { REDACTION_MARKERS } from "./redaction.js";
 // The page a computer-use observation was on, as a trace records it: the URL's origin and path,
 // with no query string, fragment or user info, and any path segment that can carry a credential or
@@ -67,9 +68,22 @@ function redactOrigin(url, redact) {
         .join(".");
     return redact(`${url.protocol}//${host}${url.port === "" ? "" : `:${url.port}`}`);
 }
+/**
+ * A computer-use trace's text redaction, which its narration and its pages go through: the run's
+ * known-value scrub, then `redactText`, then `redactEncodedText`, then the scrub again.
+ * - A value the model transcribes (a DB password it read on screen) has no shape, so `redactText`
+ *   alone cannot catch it; the scrub closes that.
+ * - The participant receives its instructions as written, so it can repeat a key the study wrote
+ *   base64- or percent-encoded, which verify decodes; `redactEncodedText` removes that one too.
+ * - The scrub runs again last: a marker written before other text can spell a known value, as
+ *   `[REDACTED_SECRET] and` spells `SECRET] and`.
+ */
+export function traceRedaction(scrubText, redactText) {
+    return (text) => scrubText(redactEncodedText(redactText(scrubText(text))));
+}
 /**
  * The page of an observed URL, or undefined when there is none or the URL parser rejects it.
- * `redact` is the trace's text redaction (the run's known-value scrub, then redactText).
+ * `redact` is the trace's text redaction (traceRedaction).
  */
 export function tracePage(url, redact) {
     if (url === undefined)
@@ -88,3 +102,55 @@ export function tracePage(url, redact) {
         return { origin: REDACTION_MARKERS.urlPart, path: REDACTION_MARKERS.urlPart };
     return { origin, path };
 }
+/**
+ * Whether no segment of a recorded path is one tracePage withholds by its shape alone: an encoding
+ * that hides text, an address or a token. A segment the run's redaction changed is the marker
+ * already, and the text scan finds secret shapes. verify holds each network log record's path to
+ * it, as the writer does.
+ */
+export function pathKeepsNoWithheldSegment(path) {
+    return path
+        .split("/")
+        .every((segment) => segment === REDACTION_MARKERS.urlPart || !withheld(segment, (text) => text));
+}
+// Text redaction writes into a host: a marker, or a sandbox id's label with its digest.
+const WRITTEN_BY_REDACTION = new RegExp([
+    ...Object.values(REDACTION_MARKERS).map((marker) => marker.replace(/[[\]]/g, "\\$&")),
+    "\\[redacted-sandbox-id [0-9a-f]{16}\\]",
+].join("|"), "g");
+/**
+ * Whether no host label of a recorded origin is one tracePage withholds: a token-shaped label in
+ * any reading, apart from the text redaction itself writes. verify holds each network log origin to it, as the
+ * writer does.
+ */
+export function originKeepsNoWithheldLabel(origin) {
+    // An IPv6 literal is kept as the URL wrote it, and a marker origin or a scheme alone has no host.
+    if (/^[a-z][a-z0-9+.-]*:\/\/\[[0-9a-f:.]*\](?::\d+)?$/i.test(origin))
+        return true;
+    const host = /^[a-z][a-z0-9+.-]*:\/\/([^/:]*)/i.exec(origin)?.[1];
+    if (host === undefined)
+        return true;
+    // Each reading, as for a path segment: an escape can split a token below the length matched.
+    return host
+        .split(".")
+        .every((label) => !readingsOf(label.replace(WRITTEN_BY_REDACTION, ".")).some(tokenShaped));
+}
+// The markers that can stand for a whole origin, such as a withheld sandbox host.
+const MARKERS = new Set(Object.values(REDACTION_MARKERS));
+// `scheme:` alone (a non-web URL) or `scheme://host[:port]`, with nothing after the host. The URL
+// parser reads a backslash there as a slash, so a backslash counts as a path too.
+const ORIGIN = /^[a-z][a-z0-9+.-]*:(?:\/\/[^/\\?#@]*)?$/i;
+/**
+ * What is wrong with a recorded page, or undefined when it holds an origin and a path only, as
+ * tracePage writes one. verify applies it to each recorded page and the browser network log's
+ * record check to each record's origin and path.
+ */
+export function pageProblem(page) {
+    if (!isRecord(page) || typeof page.origin !== "string" || typeof page.path !== "string")
+        return "is not an origin and a path";
+    if (/[?#]/.test(page.path))
+        return "has a query string or fragment in its path";
+    if (!MARKERS.has(page.origin) && !ORIGIN.test(page.origin))
+        return "has an origin with user info, a path, a query string or a fragment";
+    return undefined;
+}