@ai-ecoverse/slicc-cdp 1.46.7 → 1.47.0

package/README.md

@@ -40,7 +40,7 @@ playwright-cli click e3
 curlwright -i https://example.com/
 ```
 
-`open` attaches to a running Chrome or launches one. To pick a browser, pass `--cdp <port>` (for example `--cdp 9333`, which means `localhost:9333`) or `--cdp http://127.0.0.1:<port>`, or set `SLICC_CDP_URL`. Run `playwright-cli --help` for all commands.
+`open` attaches to a running Chrome or launches one. To pick a browser, pass `--cdp <port>` (for example `--cdp 9333`, which means `localhost:9333`) or `--cdp http://127.0.0.1:<port>`, or set `SLICC_CDP_URL`. Without those, host connect tries `slicc browsers --json` when `slicc` is on `PATH` (prefer `sevenOpen`, then a slicc profile, then best tier; loopback `ws://` only), then a live `DevToolsActivePort` under slicc `seven-profiles` / legacy `profiles` / SLICC six profile dirs (loopback `/json/version` check; the live websocket pathname must match the file; newest live wins), then a loopback endpoint saved under the user config dir, then probes `127.0.0.1:9222-9229`. `curlwright` uses the same order without the saved session and exits when nothing answers. The wasm builds still use port 9222 and skip the CLI and file steps. Run `playwright-cli --help` for all commands.
 
 `--cdp` and `SLICC_CDP_URL` take a port, `host`, `host:port` (port 9222 when it is left out), an `http://` or `https://` URL, or a `ws://` or `wss://` URL. A `ws://` or `wss://` URL with a path is dialled as it is; every other form reads `/json/version` first. The client tries every address the host resolves to, and `localhost`, `127.0.0.1`, `::1` (`[::1]`) and `0.0.0.0` all mean this machine: both `::1` and `127.0.0.1` are tried. Every address but the last gets two seconds to connect.
 
@@ -224,7 +224,9 @@ Real-Chrome integration cases run only on CI by default; set `SLICC_LOCAL_CHROME
 
 On `main`, semantic-release publishes `@ai-ecoverse/slicc-cdp` to npm with provenance from `ci.yml`, tags `v<version>` and opens a draft GitHub release. When it released, `ci.yml` then publishes the four crates to crates.io, builds the binaries for macOS, Linux and Windows (the macOS ones signed and notarised), and uploads them with `install.sh`, `LICENSE`, `THIRD-PARTY-NOTICES` and `SHA256SUMS` before it publishes the release as latest. `@ai-ecoverse/sliccy-browser` is published from the same workflow whenever its `package.json` names a version npm doesn't have yet.
 
-`sliccy-browser` has no dependencies, on purpose. The kernel's pnpm hoists a dependency next to the package, and the kernel reads `slicc.commands` from everything in a global `node_modules`, so a dependency on `@ai-ecoverse/slicc-cdp` would give the user that copy's `playwright-cli` and `curlwright` ahead of the base set's. It carries its own copies of `src/connect.js` and `src/cdp-client.js` instead. When a change to those two files lands, `test/integration/sliccy-browser-install.test.mjs` fails until the same pull request copies them and raises `sliccy-browser`'s version, which publishes them. It fails on any other change to what `sliccy-browser` ships that doesn't raise the version, too. A slicc-cdp release that leaves those files alone needs nothing here.
+`sliccy-browser` has no dependencies, on purpose. The kernel's pnpm hoists a dependency next to the package, and the kernel reads `slicc.commands` from everything in a global `node_modules`, so a dependency on `@ai-ecoverse/slicc-cdp` would give the user that copy's `playwright-cli` and `curlwright` ahead of the base set's. It carries its own copies of `src/connect.js` and `src/cdp-client.js`, and of `@ai-ecoverse/slicc-browsers`'s `protected.mjs` plus the catalog's `protectedOrigins` rules as `src/protected.js` and `src/protected-origins.js`, instead. When a change to those files lands, `test/integration/sliccy-browser-install.test.mjs` fails until the same pull request copies them and raises `sliccy-browser`'s version, which publishes them. It fails on any other change to what `sliccy-browser` ships that doesn't raise the version, too. A slicc-cdp release that leaves those files alone needs nothing here.
+
+`@ai-ecoverse/sliccy-browser` finds a browser without launching one. Order: `SLICC_CDP_URL` if set; else `slicc browsers --json` when `slicc` is on `PATH` (prefer `sevenOpen`, then a slicc profile `userDataDir`, then the best tier); else a live `DevToolsActivePort` under slicc's `seven-profiles` / `profiles` / SLICC six profile dirs on this machine (loopback `/json/version` check, and the live `webSocketDebuggerUrl` path must match the file's second line so a reused port with a different browser id is skipped; newest matching file wins); else `127.0.0.1:9222`. Loopback only; no arbitrary port scan. When nothing answers, the error lists each step. An explicit `SLICC_CDP_URL` stays unguarded. On a discovered endpoint it refuses protected top-level tabs (catalog `protectedOrigins`, plus missing/non-page targets, empty URLs, inheriting `about:` documents and `chrome-error:` pages) for `findTab`, `ensureTab`, `eval`, `evalAsync`, `localStorage`, `cookie`, `fetch` and `websocket` (fail closed, live URL pre/post checks). `cookie` asks CDP with `urls: [top-level]` and drops any cookie whose domain, url or partition key is in a protected cookie scope (including parent-domain scopes such as `.ai`). `websocket` drops frames whose socket URL is protected. Chrome does not replay `Network.webSocketCreated` for sockets that were already open before the first `Network.enable` on that tab, so discovered-mode subscriptions also drop frames from those unknown-URL sockets (fail closed); the subscription warns once and exposes a `dropped` count, and reloading the tab or reconnecting the socket after the first attach makes a new allowed socket visible. Page-level residuals it does not stop: same-origin frame DOM reads through `eval`, `window.open` / `postMessage` / `BroadcastChannel` / service-worker side channels, and anything an allowed page's own script can do without a CDP aggregation. `node:child_process` is imported only when the CLI discovery step runs, so `require('sliccy:browser')` still loads under the kernel's `slicc` export condition.
 
 ## Backend contract
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-cdp",
-  "version": "1.46.7",
+  "version": "1.47.0",
   "description": "SLICC's CDP layer: client, browser API, transports, HAR, and ARIA snapshot",
   "type": "module",
   "license": "Apache-2.0",
@@ -54,7 +54,7 @@
     "build:wasm": "cargo build --locked --release --target wasm32-wasip1 -p slicc-cdp -p curlwright && mkdir -p bin && cp target/wasm32-wasip1/release/playwright-cli.wasm bin/playwright-cli.wasm && cp target/wasm32-wasip1/release/curlwright.wasm bin/curlwright.wasm",
     "prepublishOnly": "npm run build:wasm",
     "lint": "slicc-lint && shellcheck -s sh install.sh",
-    "typecheck": "node --check src/index.js && node --check src/cdp-client.js && node --check src/connect.js && node --check src/page.js && node --check src/browser.js && node --check src/cli.js && node --check packages/sliccy-browser/src/browser.js && node --check packages/sliccy-browser/src/connect.js && node --check packages/sliccy-browser/src/cdp-client.js && node --check packages/sliccy-browser/src/fetch-script.js && node --check packages/sliccy-browser/src/version.js",
+    "typecheck": "node --check src/index.js && node --check src/cdp-client.js && node --check src/connect.js && node --check src/page.js && node --check src/browser.js && node --check src/cli.js && node --check packages/sliccy-browser/src/browser.js && node --check packages/sliccy-browser/src/connect.js && node --check packages/sliccy-browser/src/cdp-client.js && node --check packages/sliccy-browser/src/discover.js && node --check packages/sliccy-browser/src/guard.js && node --check packages/sliccy-browser/src/protected.js && node --check packages/sliccy-browser/src/protected-origins.js && node --check packages/sliccy-browser/src/fetch-script.js && node --check packages/sliccy-browser/src/version.js",
     "format": "biome check --write .",
     "pretest": "export PATH=\"$HOME/.cargo/bin:$PATH\" && cargo build --locked -p slicc-cdp -p curlwright && cargo build --locked -p slicc-cdp-client --examples && cargo build --locked --target wasm32-wasip1 -p slicc-cdp -p curlwright && cargo build --locked --target wasm32-wasip1 -p slicc-cdp-client --example guard_bridge && npm run -s browser >/dev/null",
     "test": "PATH=\"$HOME/.cargo/bin:$PATH\" SLICC_CDP_PORTS=\"${SLICC_CDP_PORTS:-9300-9309}\" node scripts/test-integration.mjs",
@@ -71,7 +71,7 @@
     "@ai-ecoverse/slicc-browsers": "1.20.3",
     "@ai-ecoverse/slicc-cdp": "1.43.0",
     "@ai-ecoverse/slicc-jsh": "0.64.0",
-    "@ai-ecoverse/slicc-kernel": "1.175.1",
+    "@ai-ecoverse/slicc-kernel": "1.176.0",
     "@ai-ecoverse/slicc-shared-web": "2.13.10",
     "@ai-ecoverse/wasi-pnpm": "12.9.1-21",
     "@ai-ecoverse/wasm-bash": "5.3.0-23",