@ai-ecoverse/slicc-cdp 1.41.20 → 1.41.22

package/README.md

@@ -260,7 +260,7 @@ What the clients need from a CDP backend, checked against the code by `crates/cd
 - `Inspector.enable` (private guard only)
 - `Fetch.*`
 
-The guarded Rust client supports document-scoped operations, origin-scoped cookies and guarded interception. Persistent page capabilities that cannot be restricted to verified ordinary documents are refused before sending, including generic init scripts, bindings, page overrides and automatic debugger-waiting attachment. `Network.emulateNetworkConditions` is the one network override admitted, and only as Playwright's offline toggle on an ordinary page session. The dedicated WebMCP installer is the sole vetted-shim exception: it accepts a session, never client-provided source, and gates the pinned bytes on guard-owned document verification. The production method lifetime [inventory](crates/cdp-client/src/capability_inventory_test.rs) is checked against the CLI sources. The Node `CDPClient` is a raw CDP transport, not the guarded Rust client.
+The guarded Rust client supports document-scoped operations, origin-scoped cookies and guarded interception. Persistent page capabilities that cannot be restricted to verified ordinary documents are refused before sending, including generic init scripts, bindings, page overrides and automatic debugger-waiting attachment. `Network.emulateNetworkConditions` is the one network override admitted, and only as Playwright's offline toggle on an ordinary page session. The dedicated WebMCP installer is the sole vetted-shim exception: it accepts a session, never client-provided source, and gates the pinned bytes on guard-owned document verification. The production method lifetime [inventory](crates/cdp-client/src/capability_inventory_test.rs) is checked against the CLI sources. The Node `CDPClient` is a raw CDP transport, not the guarded Rust client. Both clients send message IDs from 1 through 2^30 - 1 and refuse further sends when that range is exhausted; IDs never wrap.
 
 ### Session-level domains
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-cdp",
-  "version": "1.41.20",
+  "version": "1.41.22",
   "description": "SLICC's CDP layer: client, browser API, transports, HAR, and ARIA snapshot",
   "type": "module",
   "license": "Apache-2.0",
@@ -69,8 +69,8 @@
   },
   "devDependencies": {
     "@ai-ecoverse/slicc-browsers": "1.18.15",
-    "@ai-ecoverse/slicc-kernel": "1.166.5",
-    "@ai-ecoverse/slicc-shared-web": "2.12.3",
+    "@ai-ecoverse/slicc-kernel": "1.167.0",
+    "@ai-ecoverse/slicc-shared-web": "2.12.4",
     "@ai-ecoverse/wasm-bash": "5.3.0-23",
     "@ai-ecoverse/wasm-coreutils": "9.12.0-15",
     "@biomejs/biome": "2.5.15",

package/src/cdp-client.js

@@ -80,6 +80,9 @@ export class CDPClient {
     if (this.#state !== 'connected' || !this.#ws) {
       return Promise.reject(new Error('CDP client is not connected\n'));
     }
+    if (this.#nextId >= 2 ** 30 - 1) {
+      return Promise.reject(new Error('CDP client message ID range exhausted\n'));
+    }
     const id = ++this.#nextId;
     const message = { id, method };
     if (params !== undefined) message.params = params;