@ai-ecoverse/slicc-cdp 1.46.5 → 1.46.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +7 -5
- package/bin/curlwright.wasm +0 -0
- package/bin/playwright-cli.wasm +0 -0
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -69,10 +69,10 @@ The web storage commands, `localstorage-list`, `-get`, `-set`, `-delete` and `-c
|
|
|
69
69
|
`webmcp-list` and `webmcp-call` prefer native WebMCP, including declarative tools when the browser supports them. For an app that registers JavaScript tools without native WebMCP, keep a dedicated holder running:
|
|
70
70
|
|
|
71
71
|
```sh
|
|
72
|
-
playwright-cli --cdp 9333 webmcp-polyfill --tab <targetId> --reload
|
|
72
|
+
playwright-cli --cdp 9333 webmcp-polyfill --tab <targetId> --reload --from-origin https://foreign.example
|
|
73
73
|
```
|
|
74
74
|
|
|
75
|
-
The holder is a foreground process: keep stdin open, and close stdin to stop it. Its first stdout line is JSON with `event: "ready"`, `loaderId`, `mode`, `tab`, `late`, `reloaded` and measured `pauseMicros`. After later navigations, a `document-ready` JSON event identifies the current `loaderId` once the top document has loaded, its current main-world context has passed the live check, and the holder has persisted its verified metadata; consumers should await this event before listing load-time tools. Ordinary CLI saves preserve holder-owned metadata, and listing refreshes it after verifying the current document. On native hosts and WASI, session and state files are published from unique private sibling files with atomic renames, so concurrent readers see a complete previous or new generation. `--reload` is opt-in: it reloads only the selected tab so registration during page load sees the API. Without it, the shim installs into the already-loaded document and `late: true` warns that load-time registrations may have been missed. An existing native or page-provided API is not replaced. The shim's document and navigator aliases remain replaceable; the holder retains its registered tools through a private, random lexical bridge, not a page-callable binding.
|
|
75
|
+
The holder is a foreground process: keep stdin open, and close stdin to stop it. Its first stdout line is JSON with `event: "ready"`, `loaderId`, `mode`, `tab`, `late`, `reloaded` and measured `pauseMicros`. After later navigations, a `document-ready` JSON event identifies the current `loaderId` once the top document has loaded, its current main-world context has passed the live check, and the holder has persisted its verified metadata; consumers should await this event before listing load-time tools. Ordinary CLI saves preserve holder-owned metadata, and listing refreshes it after verifying the current document. On native hosts and WASI, session and state files are published from unique private sibling files with atomic renames, so concurrent readers see a complete previous or new generation. `--reload` is opt-in: it reloads only the selected tab so registration during page load sees the API. Without it, the shim installs into the already-loaded document and `late: true` warns that load-time registrations may have been missed. Repeatable `--from-origin <http(s)-origin>` on the holder (same validation as `webmcp-list`: origin only, no path, query, fragment or credentials) opts in to ordinary cross-origin children at start, so a child that attaches is installed as soon as its default context appears. Origins added later by `webmcp-list` or `webmcp-call --from-origin` still install lazily into parked children. Tools that registered before the shim was installed are not recovered until the page reloads. An existing native or page-provided API is not replaced. The shim's document and navigator aliases remain replaceable; the holder retains its registered tools through a private, random lexical bridge, not a page-callable binding.
|
|
76
76
|
|
|
77
77
|
While the holder runs, a page that registers or unregisters tools after load in its admitted main document produces a `tools-changed` JSON line:
|
|
78
78
|
|
|
@@ -92,11 +92,13 @@ playwright-cli --cdp 9333 webmcp-call get_inbox_state '{}' --tab <targetId>
|
|
|
92
92
|
playwright-cli --cdp 9333 webmcp-call send_reply '{}' --tab <targetId> --allow-consequential
|
|
93
93
|
```
|
|
94
94
|
|
|
95
|
-
Same-origin frames are included on direct Chrome, the link route and the extension route; the extension route needs slicc extension 7.12.1 or later. The injected shim is also installed through ordinary Runtime.evaluate when a same-origin child default context appears and its document is verified. On direct Chrome and the link route, this includes a child added after the root was accepted. The child queue starts only after the current root document is committed and its installation is accepted; it makes no live read while that root is navigating or a Document request is paused. This is a no-op if the pause path already installed that realm. The installer waits within a bounded placement window, binds the child frame, loader and unique context plus the root identity, rechecks after evaluation, and does nothing in an already accepted realm. It does not publish child Debugger content or pause the child script. Synchronous child registration or a WebMCP check that runs before installation cannot be recovered; awaited or asynchronous registration must leave enough time for installation. A cross-origin provider additionally requires repeatable `--from-origin <http(s)-origin>`, explicit `exposedTo` permission for the caller's origin, the `tools` Permissions Policy and iframe delegation along the entire ancestor chain. `--json` includes each provider's `frameId`; use `webmcp-call ... --frame <frameId>` to resolve duplicate names. Unknown policy is denied for all iframes and for our injected shim
|
|
95
|
+
Same-origin frames are included on direct Chrome, the link route and the extension route; the extension route needs slicc extension 7.12.1 or later. The injected shim is also installed through ordinary Runtime.evaluate when a same-origin child default context appears and its document is verified. On direct Chrome and the link route, this includes a child added after the root was accepted. The child queue starts only after the current root document is committed and its installation is accepted; it makes no live read while that root is navigating or a Document request is paused. This is a no-op if the pause path already installed that realm. The installer waits within a bounded placement window, binds the child frame, loader and unique context plus the root identity, rechecks after evaluation, and does nothing in an already accepted realm. It does not publish child Debugger content or pause the child script. Synchronous child registration or a WebMCP check that runs before installation cannot be recovered; awaited or asynchronous registration must leave enough time for installation. A cross-origin provider additionally requires repeatable `--from-origin <http(s)-origin>`, explicit `exposedTo` permission for the caller's origin, the `tools` Permissions Policy and iframe delegation along the entire ancestor chain. `--json` includes each provider's `frameId`; use `webmcp-call ... --frame <frameId>` to resolve duplicate names. Unknown policy is denied for all iframes and for our injected shim. For a cross-origin child the holder tries native `Page.getPermissionsPolicyState` first, then re-requests that child's document URL once, without cookies, from the browser side (`Network.loadNetworkResource`) to read its Permissions-Policy header. That fetched header is weaker than a real Document `Network.responseReceived` (which always overwrites it) and weaker than native `Page.getPermissionsPolicyState`; it can only further restrict the child—the embedder's parent header and iframe `allow` stay the trusted gates—so the residual is that the child's own restriction is missed if the server answers differently to a credentialless request (hostile page JS cannot influence it). The fetched header is stored only if the child's committed frame id, loader and origin are unchanged after the fetch, and is capped at 16 KiB. Missing, failed, non-2xx, or empty fetched evidence stays unknown and is denied. `Network.loadNetworkResource` is an experimental Chrome method: if a Chrome change removes or alters it, the holder falls back to deny-and-reload so a page reload can observe the Document response. For compatibility, an ordinary top-level page-defined API may expose its own tools when no policy was observed and the browser does not recognize `tools`; these tools carry `"policy": "unknown"` in `--json` and a “policy: unknown, top-level page-defined” label in human output. Verified tools carry `"policy": "allowed"`. Any observed `tools=()` denies tools, including in compatibility mode. Run `webmcp-polyfill --tab <targetId> --reload` to record verified response headers rather than rely on compatibility mode. Tool lists and call results are capped at 65,536 characters per page response. The shim supports JavaScript tool registration, not declarative HTML tools.
|
|
96
96
|
|
|
97
|
-
|
|
97
|
+
On real Chrome under site isolation, an OOPIF's `Target.attachedToTarget` `targetInfo` carries `parentFrameId` (the embedding frame id), the root page's `Page.getFrameTree` lists only local frames and omits the OOPIF, and the child's own `Page.getFrameTree` root has `id` equal to the child target id with `parentId` equal to that parent frame id. Placement uses `parentFrameId` from `Target.getTargets` only: when it is absent or not the current root frame, the child fails closed with no domain enable and no evaluate.
|
|
98
98
|
|
|
99
|
-
|
|
99
|
+
Requested `--from-origin` origins are passed to native WebMCP's `getTools()` for listing and tool selection before native `executeTool()`. On the polyfill path on direct Chrome, the holder installs into ordinary cross-origin children only for requested origins after private auto-attach without holding the child at start: origins given on `webmcp-polyfill --from-origin` are known at holder start, and origins added later by list or call install lazily into parked children. The holder never reloads a child frame to force registration and never installs into an unrequested origin. Awaited or asynchronous child registration must leave enough time for installation, and synchronous registration before installation cannot be recovered until a page reload, the same declared limit as for same-origin children. List and call keep those origins and apply the frame gates. A protected requested origin is refused before remembering origins or waiting. On a guarded route, cross-origin child tools stay off and the clear guarded-route error appears when evidence is absent; requested origins are cleared when the holder has no direct-child evidence, and root listing and calling remain available. Route detection only decides which features switch on: every guard still polices attach and evaluate on its own. The required signal for cross-origin child tools is a successful private `Target.setAutoAttach`; a non-empty string `slicc.route` in `Browser.getVersion` (when present) means a guard sits in the path and keeps those tools off. Any non-empty value is treated the same (`link`, `devtools`, `extension`, or another string). The link route sends that hint from slicc-cli v1.62.0, and the bios route sends it from bios v1.56.0; older versions without the hint look like direct Chrome and may show the guard's own refusals instead of the clear error. The extension refuses the private auto-attach; the holder swallows that refusal and list/call print the clear guarded-route error, so that route does not surface the guard's own refusal text. Neither bios nor the link guard refuses the raw auto-attach; they protect at attach level. A link or bios route that sends the hint keeps cross-origin child tools off.
|
|
100
|
+
|
|
101
|
+
Only the hash-pinned shim can use the dedicated installer. With `--reload`, the holder first arms instrumentation, performs one guarded reload, waits for the normal pause published by the guard, and rechecks the document before installing through main-world `Runtime.evaluate`. The guard owns any conversion of an instrumentation pause; on direct Chrome, Rust's own guard performs that conversion with private `Debugger.pause` and `Debugger.resume`. Generic library calls refuse all Debugger methods, including the holder's five methods; only the private holder path can use them. Debugger events remain private even for that holder. Client `Debugger.pause`, `Debugger.getScriptSource` and `Debugger.evaluateOnCallFrame` remain refused. Without `--reload`, it installs into the current main document immediately and leaves instrumentation armed for the next document. The same private lexical declaration is used on both paths, without an init script or binding. A second installation in the same realm is a no-op. Protected or unverified documents never receive the shim; missing normal pauses, failed reads and changed context or loader evidence fail closed and release the holder's debugger. On direct Chrome the holder arms private iframe auto-attach with `waitForDebuggerOnStart: false` after that command is accepted, then installs into ordinary cross-origin children through main-world `Runtime.evaluate` after placement (late Option A), without a child Debugger lease or start pause; a child that fails or times out settles closed and the root holder stays ready. No holder means no debugger lease or extra navigation pause. Stopping the holder removes future injection; an already-installed ordinary document API lasts until that document is discarded. Browser-backed tests and navigation/pause measurements run on CI only.
|
|
100
102
|
|
|
101
103
|
When the debugger is refused because another extension runs scripts in an otherwise ordinary page, the holder can use a plain main-world installation after a bounded guarded frame-tree read completes. Protected, unknown, incomplete and version refusals never select this fallback. Ordinary iframes do not disable it. This path reloads only when `--reload` was requested and sends no debugger method after the refusal. It checks eligibility before the reload, installs in the new root realm after commit, then rechecks the guarded tree after load. The extension route may not expose protected subframes in that tree; on that route the fallback remains root-only and never reaches or names those subframes. The reload still uses the normal navigation guard. It can miss page startup or parse-time WebMCP checks; an empty tool result names that limitation rather than silently reporting no tools.
|
|
102
104
|
|
package/bin/curlwright.wasm
CHANGED
|
Binary file
|
package/bin/playwright-cli.wasm
CHANGED
|
Binary file
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ai-ecoverse/slicc-cdp",
|
|
3
|
-
"version": "1.46.
|
|
3
|
+
"version": "1.46.7",
|
|
4
4
|
"description": "SLICC's CDP layer: client, browser API, transports, HAR, and ARIA snapshot",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -71,7 +71,7 @@
|
|
|
71
71
|
"@ai-ecoverse/slicc-browsers": "1.20.3",
|
|
72
72
|
"@ai-ecoverse/slicc-cdp": "1.43.0",
|
|
73
73
|
"@ai-ecoverse/slicc-jsh": "0.64.0",
|
|
74
|
-
"@ai-ecoverse/slicc-kernel": "1.
|
|
74
|
+
"@ai-ecoverse/slicc-kernel": "1.175.1",
|
|
75
75
|
"@ai-ecoverse/slicc-shared-web": "2.13.10",
|
|
76
76
|
"@ai-ecoverse/wasi-pnpm": "12.9.1-21",
|
|
77
77
|
"@ai-ecoverse/wasm-bash": "5.3.0-23",
|