@ai-ecoverse/slicc-cdp 1.45.0 → 1.45.1

package/README.md

@@ -92,8 +92,6 @@ playwright-cli --cdp 9333 webmcp-call get_inbox_state '{}' --tab <targetId>
 playwright-cli --cdp 9333 webmcp-call send_reply '{}' --tab <targetId> --allow-consequential
 ```
 
-Stage 1 retains a guarded-route limit. On both guarded routes, an independent second-process `playwright-cli webmcp-list` can return `[]` for a polyfilled page even while the running MCP server lists and calls its tools. This limit also affects pages without children and is tracked in [#693](https://github.com/ai-ecoverse/slicc-cdp/issues/693). Use the running `mcpcat serve --webmcp` server for listing and calling those tools.
-
 Same-origin frames are included on direct Chrome and the link route; same-origin child frame tools do not work on the extension route yet ([#694](https://github.com/ai-ecoverse/slicc-cdp/issues/694)). There, the injected shim is also installed through ordinary Runtime.evaluate when a same-origin child default context appears and its document is verified. On direct Chrome and the link route, this includes a child added after the root was accepted. The child queue starts only after the current root document is committed and its installation is accepted; it makes no live read while that root is navigating or a Document request is paused. This is a no-op if the pause path already installed that realm. The installer waits within a bounded placement window, binds the child frame, loader and unique context plus the root identity, rechecks after evaluation, and does nothing in an already accepted realm. It does not publish child Debugger content or pause the child script. Synchronous child registration or a WebMCP check that runs before installation cannot be recovered; awaited or asynchronous registration must leave enough time for installation. A cross-origin provider additionally requires repeatable `--from-origin <http(s)-origin>`, explicit `exposedTo` permission for the caller's origin, the `tools` Permissions Policy and iframe delegation along the entire ancestor chain. `--json` includes each provider's `frameId`; use `webmcp-call ... --frame <frameId>` to resolve duplicate names. Unknown policy is denied for all iframes and for our injected shim: on browsers without native `tools` policy introspection, the holder must observe the document response, normally through `--reload`. For compatibility, an ordinary top-level page-defined API may expose its own tools when no policy was observed and the browser does not recognize `tools`; these tools carry `"policy": "unknown"` in `--json` and a “policy: unknown, top-level page-defined” label in human output. Verified tools carry `"policy": "allowed"`. Any observed `tools=()` denies tools, including in compatibility mode. Run `webmcp-polyfill --tab <targetId> --reload` to record verified response headers rather than rely on compatibility mode. Tool lists and call results are capped at 65,536 characters per page response. The shim supports JavaScript tool registration, not declarative HTML tools.
 
 Requested `--from-origin` origins are passed to native WebMCP's `getTools()` for listing and tool selection before native `executeTool()`. On the polyfill path, cross-origin child tools remain unavailable ([#684](https://github.com/ai-ecoverse/slicc-cdp/issues/684)); requested origins are cleared, root listing and calling remain available, and the command reports the clear limit message. A protected requested origin is refused before native or polyfill mode detection.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-cdp",
-  "version": "1.45.0",
+  "version": "1.45.1",
   "description": "SLICC's CDP layer: client, browser API, transports, HAR, and ARIA snapshot",
   "type": "module",
   "license": "Apache-2.0",
@@ -54,7 +54,7 @@
     "build:wasm": "cargo build --locked --release --target wasm32-wasip1 -p slicc-cdp -p curlwright && mkdir -p bin && cp target/wasm32-wasip1/release/playwright-cli.wasm bin/playwright-cli.wasm && cp target/wasm32-wasip1/release/curlwright.wasm bin/curlwright.wasm",
     "prepublishOnly": "npm run build:wasm",
     "lint": "slicc-lint && shellcheck -s sh install.sh",
-    "typecheck": "node --check src/index.js && node --check src/cdp-client.js && node --check src/connect.js && node --check src/page.js && node --check src/browser.js && node --check src/cli.js && node --check packages/sliccy-browser/src/browser.js && node --check packages/sliccy-browser/src/connect.js && node --check packages/sliccy-browser/src/cdp-client.js && node --check packages/sliccy-browser/src/fetch-script.js",
+    "typecheck": "node --check src/index.js && node --check src/cdp-client.js && node --check src/connect.js && node --check src/page.js && node --check src/browser.js && node --check src/cli.js && node --check packages/sliccy-browser/src/browser.js && node --check packages/sliccy-browser/src/connect.js && node --check packages/sliccy-browser/src/cdp-client.js && node --check packages/sliccy-browser/src/fetch-script.js && node --check packages/sliccy-browser/src/version.js",
     "format": "biome check --write .",
     "pretest": "export PATH=\"$HOME/.cargo/bin:$PATH\" && cargo build --locked -p slicc-cdp -p curlwright && cargo build --locked -p slicc-cdp-client --examples && cargo build --locked --target wasm32-wasip1 -p slicc-cdp -p curlwright && cargo build --locked --target wasm32-wasip1 -p slicc-cdp-client --example guard_bridge && npm run -s browser >/dev/null",
     "test": "PATH=\"$HOME/.cargo/bin:$PATH\" SLICC_CDP_PORTS=\"${SLICC_CDP_PORTS:-9300-9309}\" node scripts/test-integration.mjs",
@@ -68,10 +68,10 @@
     "chrome": "156.0.8078.4"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-browsers": "1.19.0",
+    "@ai-ecoverse/slicc-browsers": "1.19.1",
     "@ai-ecoverse/slicc-cdp": "1.43.0",
     "@ai-ecoverse/slicc-jsh": "0.64.0",
-    "@ai-ecoverse/slicc-kernel": "1.172.2",
+    "@ai-ecoverse/slicc-kernel": "1.173.3",
     "@ai-ecoverse/slicc-shared-web": "2.13.10",
     "@ai-ecoverse/wasi-pnpm": "12.9.1-21",
     "@ai-ecoverse/wasm-bash": "5.3.0-23",