@ai-ecoverse/slicc-cdp 1.43.0 → 1.44.0

package/README.md

@@ -44,6 +44,8 @@ curlwright -i https://example.com/
 
 `--cdp` and `SLICC_CDP_URL` take a port, `host`, `host:port` (port 9222 when it is left out), an `http://` or `https://` URL, or a `ws://` or `wss://` URL. A `ws://` or `wss://` URL with a path is dialled as it is; every other form reads `/json/version` first. The client tries every address the host resolves to, and `localhost`, `127.0.0.1`, `::1` (`[::1]`) and `0.0.0.0` all mean this machine: both `::1` and `127.0.0.1` are tried. Every address but the last gets two seconds to connect.
 
+A `wss://` or `https://` endpoint on this machine with a self-signed certificate takes a pin: set `SLICC_CDP_CERT_SHA256` to the certificate's SHA-256 fingerprint, as 64 hex digits, with or without colons (`openssl x509 -noout -fingerprint -sha256`). The certificate must then match exactly, and it is checked before anything is sent, so a wrong certificate never sees the token in a URL. The pin replaces certificate verification only for names of this machine (`localhost`, `127.0.0.1`, `::1`, `0.0.0.0` and `::`); any other host is verified as usual, and a value that isn't a fingerprint is an error. The wasm build has no TLS: in the kernel, a program reaches the browser through the `ws://` URL in `SLICC_CDP_URL`, and the page that hosts the kernel holds any `wss://` socket.
+
 When the other end closes the connection, for example a relay with `1011` and a reason, the command stops and prints `websocket closed <code> <reason>`, wherever the close arrived, a guard check included. Nothing more is sent on that connection, and a check the close cut short still fails the command.
 
 Seven's origins, the vault, browser pages, extensions and local files are always off limits. `goto` and `navigate` can leave a blocked error tab for an ordinary HTTP(S) destination without exposing its old document. A page containing a protected or unverified frame refuses whole-page screenshots, PDF output, Runtime, DOM, CSS, accessibility reads, input and WebMCP tool reads and change notifications, including operations in its ordinary frames. The check includes frames already loaded in other renderer processes and is repeated before returning content. Unplaced frames fail closed. Screencasts, layer snapshots, headless frame capture and tab mirroring remain unsupported; unadmitted screencast events are stopped and discarded.
@@ -216,6 +218,8 @@ Real-Chrome integration cases run only on CI by default; set `SLICC_LOCAL_CHROME
 
 On `main`, semantic-release publishes `@ai-ecoverse/slicc-cdp` to npm with provenance from `ci.yml`, tags `v<version>` and opens a draft GitHub release. When it released, `ci.yml` then publishes the four crates to crates.io, builds the binaries for macOS, Linux and Windows (the macOS ones signed and notarised), and uploads them with `install.sh`, `LICENSE`, `THIRD-PARTY-NOTICES` and `SHA256SUMS` before it publishes the release as latest. `@ai-ecoverse/sliccy-browser` is published from the same workflow whenever its `package.json` names a version npm doesn't have yet.
 
+`sliccy-browser` has no dependencies, on purpose. The kernel's pnpm hoists a dependency next to the package, and the kernel reads `slicc.commands` from everything in a global `node_modules`, so a dependency on `@ai-ecoverse/slicc-cdp` would give the user that copy's `playwright-cli` and `curlwright` ahead of the base set's. It carries its own copies of `src/connect.js` and `src/cdp-client.js` instead. When a change to those two files lands, `test/integration/sliccy-browser-install.test.mjs` fails until the same pull request copies them and raises `sliccy-browser`'s version, which publishes them. It fails on any other change to what `sliccy-browser` ships that doesn't raise the version, too. A slicc-cdp release that leaves those files alone needs nothing here.
+
 ## Backend contract
 
 What the clients need from a CDP backend, checked against the code by `crates/cdp-client/src/contract.rs`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-cdp",
-  "version": "1.43.0",
+  "version": "1.44.0",
   "description": "SLICC's CDP layer: client, browser API, transports, HAR, and ARIA snapshot",
   "type": "module",
   "license": "Apache-2.0",
@@ -54,7 +54,7 @@
     "build:wasm": "cargo build --locked --release --target wasm32-wasip1 -p slicc-cdp -p curlwright && mkdir -p bin && cp target/wasm32-wasip1/release/playwright-cli.wasm bin/playwright-cli.wasm && cp target/wasm32-wasip1/release/curlwright.wasm bin/curlwright.wasm",
     "prepublishOnly": "npm run build:wasm",
     "lint": "slicc-lint && shellcheck -s sh install.sh",
-    "typecheck": "node --check src/index.js && node --check src/cdp-client.js && node --check src/connect.js && node --check src/page.js && node --check src/browser.js && node --check src/cli.js && node --check packages/sliccy-browser/src/browser.js && node --check packages/sliccy-browser/src/fetch-script.js",
+    "typecheck": "node --check src/index.js && node --check src/cdp-client.js && node --check src/connect.js && node --check src/page.js && node --check src/browser.js && node --check src/cli.js && node --check packages/sliccy-browser/src/browser.js && node --check packages/sliccy-browser/src/connect.js && node --check packages/sliccy-browser/src/cdp-client.js && node --check packages/sliccy-browser/src/fetch-script.js",
     "format": "biome check --write .",
     "pretest": "export PATH=\"$HOME/.cargo/bin:$PATH\" && cargo build --locked -p slicc-cdp -p curlwright && cargo build --locked -p slicc-cdp-client --examples && cargo build --locked --target wasm32-wasip1 -p slicc-cdp -p curlwright && cargo build --locked --target wasm32-wasip1 -p slicc-cdp-client --example guard_bridge && npm run -s browser >/dev/null",
     "test": "PATH=\"$HOME/.cargo/bin:$PATH\" SLICC_CDP_PORTS=\"${SLICC_CDP_PORTS:-9300-9309}\" node scripts/test-integration.mjs",
@@ -69,11 +69,15 @@
   },
   "devDependencies": {
     "@ai-ecoverse/slicc-browsers": "1.18.21",
-    "@ai-ecoverse/slicc-kernel": "1.170.1",
+    "@ai-ecoverse/slicc-cdp": "1.43.0",
+    "@ai-ecoverse/slicc-jsh": "0.63.30",
+    "@ai-ecoverse/slicc-kernel": "1.172.2",
     "@ai-ecoverse/slicc-shared-web": "2.13.7",
+    "@ai-ecoverse/wasi-pnpm": "12.9.1-21",
     "@ai-ecoverse/wasm-bash": "5.3.0-23",
     "@ai-ecoverse/wasm-coreutils": "9.12.0-15",
-    "@biomejs/biome": "2.6.2",
+    "@ai-ecoverse/wasm-tls-engine": "4.2.0-12",
+    "@biomejs/biome": "2.6.3",
     "lefthook": "2.2.2",
     "semantic-release": "25.0.9"
   }