@ai-ecoverse/slicc-cdp 1.34.1 → 1.35.0

package/README.md

@@ -55,6 +55,12 @@ The cookie commands, `cookie-list`, `cookie-get`, `cookie-set`, `cookie-delete`
 
 Saved sessions never contain cookie values or value hashes. They retain only cookie names and scopes (domain and path), with Cookie and Set-Cookie header values redacted. `request-headers`, `response-headers` and `request` look up those scopes in the live guarded cookie jar and label any values they show as current jar values, not necessarily what was sent at that time. Removed and protected cookies stay `[redacted]`. A header with no retained scopes can show current cookies applicable to its URL only when that URL cannot share a protected parent-domain cookie. Cookie-bearing console messages may be shown live but are not saved.
 
+The web storage commands, `localstorage-list`, `-get`, `-set`, `-delete` and `-clear` and the same five `sessionstorage-` commands, work like Microsoft's and print ordinary values as they are, with terminal control characters escaped. They run in a fresh isolated world of the tab's main frame through the guarded client, so a tab whose current document is protected, unverified, an error page or opaque is refused. Seven's and the vault's localStorage and sessionStorage are never read or written. `--tab` picks the tab; otherwise the current tab is used.
+
+`state-save [filename]` writes Microsoft's storageState JSON: `cookies` in Playwright's cookie shape and `origins` with each origin's `localStorage`. Without a filename it writes `.playwright-cli/storage-state-<timestamp>.json`. **The file is a credential.** It holds live cookie values, including HttpOnly session cookies, and localStorage, where sites often keep login tokens, so anyone who reads it can sign in as you on those sites. On Unix it is created owner-only (0600). Keep it out of version control, chat transcripts and shared directories, and delete it when you're done. It never holds seven's or the vault's cookies (parent-domain and partitioned ones included) or their origins, and like Microsoft's it never holds sessionStorage. Deviations: the origins are those of the open ordinary tabs, read in place, not every origin the browser context has visited; a tab the guard can't verify is skipped. An absolute filename prints as given.
+
+`state-load <filename>` checks the whole file before it changes anything. A protected, malformed or non-http(s) cookie scope or origin refuses the file, and so do IndexedDB, OPFS and credential entries, which are not restored. It then clears the ordinary cookies (protected ones stay) and sets the file's cookies. For each origin in the file it opens one temporary background tab, answers the tab's requests to those origins with an empty page through guarded interception, and, as Microsoft does, unregisters that origin's service workers, deletes its IndexedDB databases, clears its localStorage and writes the file's localStorage. The tab is then closed. Deviations: the HTTP cache is not cleared, because that would clear seven's, and origins that are not in the file keep their storage. Errors from these commands go to stderr as `Error: ...` and exit 1.
+
 ## WebMCP
 
 `webmcp-list` and `webmcp-call` prefer native WebMCP, including declarative tools when the browser supports them. For an app that registers JavaScript tools without native WebMCP, keep a dedicated holder running:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-cdp",
-  "version": "1.34.1",
+  "version": "1.35.0",
   "description": "SLICC's CDP layer: client, browser API, transports, HAR, and ARIA snapshot",
   "type": "module",
   "license": "Apache-2.0",