@ai-ecoverse/slicc-cdp 1.31.8 → 1.32.0

package/README.md

@@ -47,10 +47,34 @@ Seven's origins, the vault, browser pages, extensions and local files are always
 
 `snapshot` prints the same tree as `@playwright/cli`: the same role names and refs, with `[active]`, `[cursor=pointer]` and `/url:`. It runs Playwright's own aria snapshot code, taken from `playwright-core` 1.64 (Apache-2.0, Copyright Microsoft Corporation), in an isolated world, in `crates/playwright-cli/src/aria-snapshot.js`. A `/url:` is redacted like every other URL: a protected origin shows only its origin, and query values, fragments and credentials show as `…` unless `--full-urls` is given. A cross-origin iframe that runs in its own process is captured through its own flat session, with `f<N>e<M>` refs that `click`, `fill` and the other ref commands drive in that session, and `frames` lists it. A protected, unverified or unknown child frame is never attached or read: it shows as a bare `iframe`, and `frames` shows a protected one by its origin alone.
 
+`eval` calls a function expression (arrow, `function` or async function) and prints its awaited result, like Playwright's evaluate. Other expressions and multi-statement scripts still print their values without being called. `--frame` uses the selected frame's isolated world.
+
 The cookie commands, `cookie-list`, `cookie-get`, `cookie-set`, `cookie-delete` and `cookie-clear`, work like Microsoft's and print ordinary values as they are. Seven's and the vault's cookies, including cookies scoped to a parent domain of a protected host, are never listed, read, set or deleted. Domain arguments are canonicalized before the guard checks them; protected scopes and malformed domains are refused. `cookie-clear` leaves protected cookies, and requests to protected origins are not recorded. Headers containing protected-scope cookies and console lines containing their values are hidden, even on ordinary pages.
 
 Saved sessions never contain cookie values or value hashes. They retain only cookie names and scopes (domain and path), with Cookie and Set-Cookie header values redacted. `request-headers`, `response-headers` and `request` look up those scopes in the live guarded cookie jar and label any values they show as current jar values, not necessarily what was sent at that time. Removed and protected cookies stay `[redacted]`. A header with no retained scopes can show current cookies applicable to its URL only when that URL cannot share a protected parent-domain cookie. Cookie-bearing console messages may be shown live but are not saved.
 
+## WebMCP
+
+`webmcp-list` and `webmcp-call` prefer native WebMCP, including declarative tools when the browser supports them. For an app that registers JavaScript tools without native WebMCP, keep a dedicated holder running:
+
+```sh
+playwright-cli --cdp 9333 webmcp-polyfill --tab <targetId> --reload
+```
+
+The holder is a foreground process: keep stdin open, and close stdin to stop it. Its first stdout line is JSON with `event: "ready"`, `loaderId`, `mode`, `tab`, `late`, `reloaded` and measured `pauseMicros`. After later navigations, a `document-ready` JSON event identifies the current `loaderId` after the holder has persisted its verified document metadata; consumers should await this event before listing load-time tools. Ordinary CLI saves preserve holder-owned metadata, and listing refreshes it after verifying the current document. `--reload` is opt-in: it reloads only the selected tab so registration during page load sees the API. Without it, the shim installs into the already-loaded document and `late: true` warns that load-time registrations may have been missed. An existing native or page-provided API is not replaced. The shim's document and navigator aliases remain replaceable; the holder retains its registered tools through a private, random lexical bridge, not a page-callable binding.
+
+From another terminal, using the same CDP endpoint and saved session:
+
+```sh
+playwright-cli --cdp 9333 webmcp-list --tab <targetId> --json
+playwright-cli --cdp 9333 webmcp-call get_inbox_state '{}' --tab <targetId>
+playwright-cli --cdp 9333 webmcp-call send_reply '{}' --tab <targetId> --allow-consequential
+```
+
+Same-origin frames are included. A cross-origin provider additionally requires repeatable `--from-origin <http(s)-origin>`, explicit `exposedTo` permission for the caller's origin, the `tools` Permissions Policy and iframe delegation along the entire ancestor chain. `--json` includes each provider's `frameId`; use `webmcp-call ... --frame <frameId>` to resolve duplicate names. Unknown policy is denied for all iframes and for our injected shim: on browsers without native `tools` policy introspection, the holder must observe the document response, normally through `--reload`. For compatibility, an ordinary top-level page-defined API may expose its own tools when no policy was observed and the browser does not recognize `tools`; these tools carry `"policy": "unknown"` in `--json` and a “policy: unknown, top-level page-defined” label in human output. Verified tools carry `"policy": "allowed"`. Any observed `tools=()` denies tools, including in compatibility mode. Run `webmcp-polyfill --tab <targetId> --reload` to record verified response headers rather than rely on compatibility mode. Tool lists and call results are capped at 65,536 characters per page response. The shim supports JavaScript tool registration, not declarative HTML tools.
+
+Only the hash-pinned shim can use the dedicated installer. Its inert pre-execution gate pauses each new document, verifies fresh guard-owned frame, loader and context evidence, then permits the shim body. Protected or unverified documents, including child frames, never pass the gate; errors, missing pauses or changed document evidence remove the installer and resume without the shim. No holder means no debugger gate or extra navigation pause. Stopping the holder removes future injection; an already-installed ordinary document API lasts until that document is discarded. Browser-backed tests and navigation/pause measurements run on CI only.
+
 `webmcp-list` succeeds with an empty list (`--json`: `[]`) or “No WebMCP tools on this page” when WebMCP is available but has no registered tools. If `document.modelContext` is absent or null, both `webmcp-list` and `webmcp-call` print “WebMCP is unavailable on this page” to stderr, leave stdout empty and exit 2. Evaluation and connection failures exit 1.
 
 ## Develop
@@ -63,6 +87,8 @@ npm test
 
 `npm test` builds the native and wasm CLIs and the guard bridge, installs the pinned Chrome for Testing (`config.chrome`) and runs `test/integration/*.test.mjs`, the Rust workspace tests included. The published guard set from `@ai-ecoverse/slicc-browsers` runs in four files, `guard-a.test.mjs` to `guard-d.test.mjs`, one per partition of its targets; `guard-union.test.mjs` checks the partitions add up to the whole set. Every row must pass, or skip with the reason its vector declares, and the `C2.redirect-*` and `C4.iframe-preattach` `.shared` rows must pass. Each partition writes its report to `artifacts/guard-<partition>.md`.
 
+Real-Chrome integration cases run only on CI by default; set `SLICC_LOCAL_CHROME=1` to opt in locally. Fake-backend cases still run without it.
+
 ## CI and releases
 
 `.github/workflows/ci.yml` calls [slicc-shared-web's pipeline](https://github.com/ai-ecoverse/slicc-shared-web#pipeline): lint, the integration tests split over four shards on the pool, and the Claude and Codex reviews on pull requests. The ruleset requires `ci / integration` and `ci / review`.
@@ -109,7 +135,7 @@ What the clients need from a CDP backend, checked against the code by `crates/cd
 - `Network.setRequestInterception`
 - `Fetch.*`
 
-The guarded Rust client supports document-scoped operations, origin-scoped cookies and guarded interception. Persistent page capabilities that cannot be restricted to verified ordinary documents are refused before sending, including init scripts, bindings, page overrides and automatic debugger-waiting attachment. The production method lifetime [inventory](crates/cdp-client/src/capability_inventory_test.rs) is checked against the CLI sources. The Node `CDPClient` is a raw CDP transport, not the guarded Rust client.
+The guarded Rust client supports document-scoped operations, origin-scoped cookies and guarded interception. Persistent page capabilities that cannot be restricted to verified ordinary documents are refused before sending, including generic init scripts, bindings, page overrides and automatic debugger-waiting attachment. The dedicated WebMCP installer is the sole vetted-shim exception: it accepts a session, never client-provided source, and gates the pinned bytes on guard-owned document verification. The production method lifetime [inventory](crates/cdp-client/src/capability_inventory_test.rs) is checked against the CLI sources. The Node `CDPClient` is a raw CDP transport, not the guarded Rust client.
 
 ### Session-level domains
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-cdp",
-  "version": "1.31.8",
+  "version": "1.32.0",
   "description": "SLICC's CDP layer: client, browser API, transports, HAR, and ARIA snapshot",
   "type": "module",
   "license": "Apache-2.0",
@@ -57,7 +57,7 @@
     "typecheck": "node --check src/index.js && node --check src/cdp-client.js && node --check src/connect.js && node --check src/page.js && node --check src/browser.js && node --check src/cli.js && node --check packages/sliccy-browser/src/browser.js && node --check packages/sliccy-browser/src/fetch-script.js",
     "format": "biome check --write .",
     "pretest": "export PATH=\"$HOME/.cargo/bin:$PATH\" && cargo build --locked -p slicc-cdp -p curlwright && cargo build --locked -p slicc-cdp-client --examples && cargo build --locked --target wasm32-wasip1 -p slicc-cdp -p curlwright && cargo build --locked --target wasm32-wasip1 -p slicc-cdp-client --example guard_bridge && npm run -s browser >/dev/null",
-    "test": "PATH=\"$HOME/.cargo/bin:$PATH\" SLICC_CDP_PORTS=\"${SLICC_CDP_PORTS:-9300-9309}\" node --import ./test/integration/ports.mjs --test --test-timeout=600000 'test/integration/*.test.mjs'",
+    "test": "PATH=\"$HOME/.cargo/bin:$PATH\" SLICC_CDP_PORTS=\"${SLICC_CDP_PORTS:-9300-9309}\" node scripts/test-integration.mjs",
     "test:unit": "SLICC_CDP_PORTS=\"${SLICC_CDP_PORTS:-9300-9309}\" mcr -c node_modules/@ai-ecoverse/slicc-shared-web/mcr.config.mjs node scripts/test-unit.mjs",
     "trust": "npx fledgling sync -y --skip-publish",
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish",
@@ -69,8 +69,8 @@
   },
   "devDependencies": {
     "@ai-ecoverse/slicc-browsers": "1.12.0",
-    "@ai-ecoverse/slicc-kernel": "1.146.5",
-    "@ai-ecoverse/slicc-shared-web": "2.10.3",
+    "@ai-ecoverse/slicc-kernel": "1.147.4",
+    "@ai-ecoverse/slicc-shared-web": "2.10.4",
     "@biomejs/biome": "2.5.15",
     "lefthook": "2.2.2",
     "semantic-release": "25.0.9"