@ai-ecoverse/slicc-cdp 1.39.3 → 1.40.0

package/README.md

@@ -71,6 +71,16 @@ playwright-cli --cdp 9333 webmcp-polyfill --tab <targetId> --reload
 
 The holder is a foreground process: keep stdin open, and close stdin to stop it. Its first stdout line is JSON with `event: "ready"`, `loaderId`, `mode`, `tab`, `late`, `reloaded` and measured `pauseMicros`. After later navigations, a `document-ready` JSON event identifies the current `loaderId` once the top document has loaded, every frame document the holder is waiting on, including cross-origin iframes in their own processes, has passed or failed the gate, and the holder has persisted its verified metadata; consumers should await this event before listing load-time tools. Ordinary CLI saves preserve holder-owned metadata, and listing refreshes it after verifying the current document. `--reload` is opt-in: it reloads only the selected tab so registration during page load sees the API. Without it, the shim installs into the already-loaded document and `late: true` warns that load-time registrations may have been missed. An existing native or page-provided API is not replaced. The shim's document and navigator aliases remain replaceable; the holder retains its registered tools through a private, random lexical bridge, not a page-callable binding.
 
+While the holder runs, a page that registers or unregisters tools after load, including in an admitted cross-origin iframe, produces a `tools-changed` JSON line:
+
+```json
+{"event":"tools-changed","tab":"<targetId>","target":"<targetId>","frameId":"<frameId>","loaderId":"<loaderId>","origin":"https://shop.example","tools":[]}
+```
+
+`target` is the CDP target that hosts the frame: the tab, or a cross-origin iframe's own target. `tools` is that frame's list with the same fields, policy checks, escaping and URL redaction as `webmcp-list --json`, or `webmcp-list --json --from-origin <origin>` for a cross-origin frame. The holder adds no binding and no init script for this. About every 250 ms it reads the change counter of each admitted frame document's private bridge, or with native WebMCP that document's `getTools()` from an isolated world. It reports once no change has been seen for 250 ms, and at most a second after the first change. An event is printed only when the frame's list differs from the one it had at `ready` or `document-ready`, or from the last event; a frame document admitted later starts from `[]`. Events belong to one document generation: a change still pending when its frame or the top document navigates is dropped, and after a top-level navigation reporting resumes at the next `document-ready`. Protected, refused and unverified documents never produce events. A page-defined API that replaces `document.modelContext` is not watched.
+
+`discover` reports these changes too, but only from a running holder. In watch mode it reads the changes the holder publishes to the saved session, so the holder must use the same CDP endpoint and saved session (the same working directory, or the same `--session`). Each change becomes one `webmcp` event with `"via":"page-api"` and `"summary":{"event":"tools-changed","target":…,"frameId":…,"loaderId":…,"origin":…,"tools":[…]}`, and only while the tab's top document is still the one the holder reported. Changes published before `discover` started are not replayed. Without a holder, `discover` reports a page's WebMCP tools only when it loads.
+
 From another terminal, using the same CDP endpoint and saved session:
 
 ```sh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-cdp",
-  "version": "1.39.3",
+  "version": "1.40.0",
   "description": "SLICC's CDP layer: client, browser API, transports, HAR, and ARIA snapshot",
   "type": "module",
   "license": "Apache-2.0",