@ai-ecoverse/slicc-cdp 1.45.1 → 1.46.0

package/README.md

@@ -48,7 +48,7 @@ A `wss://` or `https://` endpoint on this machine with a self-signed certificate
 
 When the other end closes the connection, for example a relay with `1011` and a reason, the command stops and prints `websocket closed <code> <reason>`, wherever the close arrived, a guard check included. Nothing more is sent on that connection, and a check the close cut short still fails the command.
 
-Seven's origins, the vault, browser pages, extensions and local files are always off limits. `goto` and `navigate` can leave a blocked error tab for an ordinary HTTP(S) destination without exposing its old document. A page containing a protected or unverified frame refuses whole-page screenshots, PDF output, Runtime, DOM, CSS, accessibility reads, input and WebMCP tool reads and change notifications, including operations in its ordinary frames. The check includes frames already loaded in other renderer processes and is repeated before returning content. Unplaced frames fail closed. Screencasts, layer snapshots, headless frame capture and tab mirroring remain unsupported; unadmitted screencast events are stopped and discarded.
+Seven's origins, the vault, browser pages, extensions and local files are always off limits. `goto` and `navigate` can leave a blocked error tab for an ordinary HTTP(S) destination without exposing its old document. A page containing a protected or unverified frame refuses whole-page screenshots, PDF output, Runtime, DOM, CSS, accessibility reads, input and WebMCP tool reads and change notifications, including operations in its ordinary frames. A browser extension's frame, such as a password manager's autofill list, is the exception: the page stays readable and the frame stays out of reach. Screenshots and input work only while every such frame is hidden and none holds the deep active element, including inside closed shadow roots; visibility and focus are rechecked before every command. Otherwise the refusal names `chrome-extension://`. The check-to-dispatch race remains a limit: page code can change visibility or focus between the check and delivery. PDF output and screencasts are refused while an extension frame is present. Snapshots skip it. The check includes frames already loaded in other renderer processes and is repeated before returning content. Unplaced frames fail closed. Screencasts, layer snapshots, headless frame capture and tab mirroring remain unsupported; unadmitted screencast events are stopped and discarded.
 
 `snapshot` prints the same tree as `@playwright/cli`: the same role names and refs, with `[active]`, `[cursor=pointer]` and `/url:`. It runs Playwright's own aria snapshot code, taken from `playwright-core` 1.64 (Apache-2.0, Copyright Microsoft Corporation), in an isolated world, in `crates/playwright-cli/src/aria-snapshot.js`. A `/url:` is redacted like every other URL: a protected origin shows only its origin, and query values, fragments and credentials show as `…` unless `--full-urls` is given. A cross-origin iframe that runs in its own process is captured through its own flat session, with `f<N>e<M>` refs that `click`, `fill` and the other ref commands drive in that session, and `frames` lists it. A protected, unverified or unknown child frame is never read. `snapshot` refuses its whole page, and `frames` shows a protected frame by its origin alone.
 
@@ -92,7 +92,7 @@ playwright-cli --cdp 9333 webmcp-call get_inbox_state '{}' --tab <targetId>
 playwright-cli --cdp 9333 webmcp-call send_reply '{}' --tab <targetId> --allow-consequential
 ```
 
-Same-origin frames are included on direct Chrome and the link route; same-origin child frame tools do not work on the extension route yet ([#694](https://github.com/ai-ecoverse/slicc-cdp/issues/694)). There, the injected shim is also installed through ordinary Runtime.evaluate when a same-origin child default context appears and its document is verified. On direct Chrome and the link route, this includes a child added after the root was accepted. The child queue starts only after the current root document is committed and its installation is accepted; it makes no live read while that root is navigating or a Document request is paused. This is a no-op if the pause path already installed that realm. The installer waits within a bounded placement window, binds the child frame, loader and unique context plus the root identity, rechecks after evaluation, and does nothing in an already accepted realm. It does not publish child Debugger content or pause the child script. Synchronous child registration or a WebMCP check that runs before installation cannot be recovered; awaited or asynchronous registration must leave enough time for installation. A cross-origin provider additionally requires repeatable `--from-origin <http(s)-origin>`, explicit `exposedTo` permission for the caller's origin, the `tools` Permissions Policy and iframe delegation along the entire ancestor chain. `--json` includes each provider's `frameId`; use `webmcp-call ... --frame <frameId>` to resolve duplicate names. Unknown policy is denied for all iframes and for our injected shim: on browsers without native `tools` policy introspection, the holder must observe the document response, normally through `--reload`. For compatibility, an ordinary top-level page-defined API may expose its own tools when no policy was observed and the browser does not recognize `tools`; these tools carry `"policy": "unknown"` in `--json` and a “policy: unknown, top-level page-defined” label in human output. Verified tools carry `"policy": "allowed"`. Any observed `tools=()` denies tools, including in compatibility mode. Run `webmcp-polyfill --tab <targetId> --reload` to record verified response headers rather than rely on compatibility mode. Tool lists and call results are capped at 65,536 characters per page response. The shim supports JavaScript tool registration, not declarative HTML tools.
+Same-origin frames are included on direct Chrome, the link route and the extension route; the extension route needs slicc extension 7.12.1 or later. The injected shim is also installed through ordinary Runtime.evaluate when a same-origin child default context appears and its document is verified. On direct Chrome and the link route, this includes a child added after the root was accepted. The child queue starts only after the current root document is committed and its installation is accepted; it makes no live read while that root is navigating or a Document request is paused. This is a no-op if the pause path already installed that realm. The installer waits within a bounded placement window, binds the child frame, loader and unique context plus the root identity, rechecks after evaluation, and does nothing in an already accepted realm. It does not publish child Debugger content or pause the child script. Synchronous child registration or a WebMCP check that runs before installation cannot be recovered; awaited or asynchronous registration must leave enough time for installation. A cross-origin provider additionally requires repeatable `--from-origin <http(s)-origin>`, explicit `exposedTo` permission for the caller's origin, the `tools` Permissions Policy and iframe delegation along the entire ancestor chain. `--json` includes each provider's `frameId`; use `webmcp-call ... --frame <frameId>` to resolve duplicate names. Unknown policy is denied for all iframes and for our injected shim: on browsers without native `tools` policy introspection, the holder must observe the document response, normally through `--reload`. For compatibility, an ordinary top-level page-defined API may expose its own tools when no policy was observed and the browser does not recognize `tools`; these tools carry `"policy": "unknown"` in `--json` and a “policy: unknown, top-level page-defined” label in human output. Verified tools carry `"policy": "allowed"`. Any observed `tools=()` denies tools, including in compatibility mode. Run `webmcp-polyfill --tab <targetId> --reload` to record verified response headers rather than rely on compatibility mode. Tool lists and call results are capped at 65,536 characters per page response. The shim supports JavaScript tool registration, not declarative HTML tools.
 
 Requested `--from-origin` origins are passed to native WebMCP's `getTools()` for listing and tool selection before native `executeTool()`. On the polyfill path, cross-origin child tools remain unavailable ([#684](https://github.com/ai-ecoverse/slicc-cdp/issues/684)); requested origins are cleared, root listing and calling remain available, and the command reports the clear limit message. A protected requested origin is refused before native or polyfill mode detection.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-cdp",
-  "version": "1.45.1",
+  "version": "1.46.0",
   "description": "SLICC's CDP layer: client, browser API, transports, HAR, and ARIA snapshot",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,13 +65,13 @@
     "browser": "node src/cli.js install-browser --version \"$npm_package_config_chrome\""
   },
   "config": {
-    "chrome": "156.0.8078.4"
+    "chrome": "157.0.8103.38"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-browsers": "1.19.1",
+    "@ai-ecoverse/slicc-browsers": "1.20.0",
     "@ai-ecoverse/slicc-cdp": "1.43.0",
     "@ai-ecoverse/slicc-jsh": "0.64.0",
-    "@ai-ecoverse/slicc-kernel": "1.173.3",
+    "@ai-ecoverse/slicc-kernel": "1.174.0",
     "@ai-ecoverse/slicc-shared-web": "2.13.10",
     "@ai-ecoverse/wasi-pnpm": "12.9.1-21",
     "@ai-ecoverse/wasm-bash": "5.3.0-23",