cdp-toolkit 1.2.0 → 1.6.0

package/dist/mcp.js

@@ -13,6 +13,9 @@ function leaseTtlMs() {
   const raw = Number(process.env.CDP_LEASE_TTL_MS);
   return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_LEASE_TTL_MS;
 }
+function defaultLabel() {
+  return `pid-${process.pid}`;
+}
 function safeId(id) {
   return id.replace(/[^A-Za-z0-9._-]/g, "_");
 }
@@ -679,6 +682,8 @@ var REQUIRED_CAPABILITIES = {
   performance_trace: ["trace.performance"],
   take_heapsnapshot: ["heap.snapshot"],
   lighthouse_audit: ["audit.lighthouse"],
+  start_screen_recording: ["capture.screencast"],
+  stop_screen_recording: ["capture.screencast"],
   mock_request: ["network.intercept"],
   list_mocks: ["network.intercept"],
   clear_mocks: ["network.intercept"]
@@ -704,6 +709,31 @@ function decodeUid(uid) {
     throw driverError("foreign-uid", `malformed cdp uid payload: ${uid}`);
   return n;
 }
+function normalizeCdpCookie(c) {
+  const same = (c.sameSite ?? "").toLowerCase();
+  const sameSite = same === "strict" || same === "lax" || same === "none" ? same : "default";
+  return {
+    name: c.name,
+    value: c.value,
+    domain: c.domain,
+    path: c.path,
+    expires: typeof c.expires === "number" ? c.expires : -1,
+    size: typeof c.size === "number" ? c.size : Buffer.byteLength(`${c.name}${c.value}`, "utf8"),
+    httpOnly: c.httpOnly === true,
+    secure: c.secure === true,
+    sameSite,
+    session: c.session === true
+  };
+}
+function cdpSameSite(sameSite) {
+  if (sameSite === "strict")
+    return "Strict";
+  if (sameSite === "lax")
+    return "Lax";
+  if (sameSite === "none")
+    return "None";
+  return;
+}
 async function centerOf(conn, objectId) {
   const fn = "function(){this.scrollIntoView({block:'center',inline:'center'});const r=this.getBoundingClientRect();if(r.width===0&&r.height===0)return null;return {x:r.left+r.width/2,y:r.top+r.height/2};}";
   const { result, exceptionDetails } = await conn.send("Runtime.callFunctionOn", { objectId, functionDeclaration: fn, returnByValue: true });
@@ -909,7 +939,8 @@ var CDP_CAPABILITIES = new Set([
   "snapshot.accessibilityTree",
   "input.insertTextAtomic",
   "locate.text",
-  "locate.xpath"
+  "locate.xpath",
+  "capture.screencast"
 ]);
 
 class CdpPageDriver {
@@ -1226,6 +1257,38 @@ class CdpPageDriver {
       });
     });
   }
+  async getCookies() {
+    await this.ensureDomain("Network");
+    const { cookies } = await this.conn.send("Network.getCookies");
+    return (cookies ?? []).map(normalizeCdpCookie);
+  }
+  async setCookie(params) {
+    await this.ensureDomain("Network");
+    const sameSite = cdpSameSite(params.sameSite);
+    const { success } = await this.conn.send("Network.setCookie", {
+      name: params.name,
+      value: params.value,
+      ...params.url !== undefined ? { url: params.url } : {},
+      ...params.domain !== undefined ? { domain: params.domain } : {},
+      ...params.path !== undefined ? { path: params.path } : {},
+      ...params.expires !== undefined ? { expires: params.expires } : {},
+      ...params.httpOnly !== undefined ? { httpOnly: params.httpOnly } : {},
+      ...params.secure !== undefined ? { secure: params.secure } : {},
+      ...sameSite !== undefined ? { sameSite } : {}
+    });
+    if (success !== true) {
+      throw driverError("page-error", `Network.setCookie declined the cookie '${params.name}'. Chrome rejects a cookie whose domain does not match the url, a secure cookie on an insecure origin, and an oversized name or value.`);
+    }
+  }
+  async deleteCookies(filter) {
+    await this.ensureDomain("Network");
+    await this.conn.send("Network.deleteCookies", {
+      name: filter.name,
+      ...filter.url !== undefined ? { url: filter.url } : {},
+      ...filter.domain !== undefined ? { domain: filter.domain } : {},
+      ...filter.path !== undefined ? { path: filter.path } : {}
+    });
+  }
   async startBodyCapture() {
     await this.ensureDomain("Network");
     return async () => {
@@ -1285,6 +1348,10 @@ async function withBrowserConn(fn) {
   }
 }
 function noSuchTarget(e) {
+  if (e instanceof LeaseConflictError)
+    throw e;
+  if (typeof e?.code === "string")
+    throw e;
   throw driverError("no-such-target", e instanceof CdpError ? e.message : String(e));
 }
 
@@ -1328,6 +1395,97 @@ function createCdpDriver() {
   return new CdpBrowserDriver;
 }
 
+// src/origins.ts
+import { mkdir as mkdir2, readFile as readFile2, readdir as readdir2, unlink as unlink2, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join2 } from "node:path";
+function safeId2(id) {
+  return id.replace(/[^A-Za-z0-9._-]/g, "_");
+}
+function originFile(backend, targetId) {
+  return join2(leaseDir(), `origin-${backend}-${safeId2(targetId)}.json`);
+}
+var ORIGIN_FILE_RE = /^origin-(chrome|firefox)-(.+)\.json$/;
+async function recordOrigin(backend, targetId, opts = {}) {
+  const record = {
+    backend,
+    targetId,
+    label: typeof opts.label === "string" && opts.label.length ? opts.label : defaultLabel(),
+    pid: process.pid,
+    createdAt: opts.now ?? Date.now()
+  };
+  const file = originFile(backend, targetId);
+  try {
+    await mkdir2(leaseDir(), { recursive: true });
+    try {
+      await writeFile2(file, JSON.stringify(record), { flag: "wx" });
+      return;
+    } catch (err) {
+      if (err.code !== "EEXIST")
+        throw err;
+    }
+    await unlink2(file).catch(() => {
+      return;
+    });
+    await writeFile2(file, JSON.stringify(record), { flag: "wx" });
+  } catch {}
+}
+async function listOrigins(opts = {}) {
+  let names = [];
+  try {
+    names = await readdir2(leaseDir());
+  } catch {
+    return [];
+  }
+  const live = opts.liveIds === undefined ? undefined : new Set(opts.liveIds.map((id) => safeId2(id)));
+  const out = [];
+  for (const name of names) {
+    const parts = ORIGIN_FILE_RE.exec(name);
+    if (!parts)
+      continue;
+    const backend = parts[1];
+    const nameId = parts[2];
+    const scoped = live !== undefined && (opts.liveBackend === undefined || opts.liveBackend === backend);
+    if (scoped && !live.has(nameId)) {
+      await unlink2(join2(leaseDir(), name)).catch(() => {
+        return;
+      });
+      continue;
+    }
+    const fromName = { backend, targetId: nameId, label: "", pid: 0, createdAt: 0 };
+    let rec;
+    try {
+      rec = JSON.parse(await readFile2(join2(leaseDir(), name), "utf8"));
+    } catch (err) {
+      const code = err.code;
+      if (code === "ENOENT")
+        continue;
+      out.push({ ...fromName, unreadable: code ?? "unparseable" });
+      continue;
+    }
+    if (typeof rec?.targetId !== "string" || typeof rec?.label !== "string" || typeof rec?.createdAt !== "number") {
+      out.push({ ...fromName, unreadable: "unparseable" });
+      continue;
+    }
+    out.push({ backend: rec.backend, targetId: rec.targetId, label: rec.label, pid: rec.pid, createdAt: rec.createdAt });
+  }
+  return out;
+}
+async function originIndex(backend, liveIds) {
+  const rows = await listOrigins({ liveIds, liveBackend: backend }).catch(() => []);
+  const index = new Map;
+  for (const row of rows) {
+    if (row.backend !== backend)
+      continue;
+    index.set(row.targetId, row);
+  }
+  return index;
+}
+async function newTrackedPage(driver, backend, opts = {}) {
+  const page = await driver.newPage(opts.url);
+  await recordOrigin(backend, page.id, { label: opts.label });
+  return page;
+}
+
 // src/leases-tools.ts
 class LeaseToolError extends Error {
 }
@@ -1336,12 +1494,12 @@ function backendOf(driver) {
 }
 async function claimPage(driver, args = {}) {
   const backend = backendOf(driver);
-  const label = typeof args.label === "string" && args.label.length ? args.label : `pid-${process.pid}`;
+  const label = typeof args.label === "string" && args.label.length ? args.label : defaultLabel();
   const pages = await driver.listPages();
   let targetId = args.targetId;
   let url = args.url ?? "about:blank";
   if (targetId === undefined || targetId === "") {
-    const page = await driver.newPage(args.url);
+    const page = await newTrackedPage(driver, backend, { url: args.url, label });
     targetId = page.id;
     url = page.url;
   } else {
@@ -1383,8 +1541,8 @@ var LEASE_TOOLS = {
 };
 
 // src/shared-tools.ts
-import { mkdir as mkdir2, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { mkdir as mkdir3, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname, join as join3 } from "node:path";
 var ARTIFACT_DIR = process.env.CDP_ARTIFACT_DIR ?? "/tmp/cdp-toolkit";
 var STATE_DIR = process.env.CDP_STATE_DIR ?? "/tmp/cdp-toolkit";
 
@@ -1452,16 +1610,35 @@ function locatorOf(args) {
     throw new SharedToolError("provide exactly one of { uid } or { selector }");
   return hasUid ? { uid: args.uid } : { css: args.selector };
 }
+async function reapSet(driver, pages, all) {
+  if (all === true)
+    return pages.map((p) => p.id);
+  try {
+    return (await driver.listPages({ all: true })).map((p) => p.id);
+  } catch {
+    return;
+  }
+}
 async function listPages(driver, args = {}) {
   const pages = await driver.listPages({ all: args.all });
-  return { pages, count: pages.length };
+  const ledger = await originIndex(backendOf2(driver), await reapSet(driver, pages, args.all));
+  const annotated = pages.map((p) => {
+    const rec = ledger.get(p.id);
+    if (!rec)
+      return { ...p, origin: "unknown" };
+    if (rec.unreadable !== undefined)
+      return { ...p, origin: "unknown", originUnreadable: rec.unreadable };
+    return { ...p, origin: "agent", label: rec.label, createdAt: rec.createdAt };
+  });
+  return { pages: annotated, count: annotated.length };
 }
 async function newPage(driver, args = {}) {
-  const p = await driver.newPage(args.url);
+  const label = typeof args.label === "string" && args.label.length ? args.label : defaultLabel();
+  const p = await newTrackedPage(driver, backendOf2(driver), { url: args.url, label });
   if (args.claim !== true)
     return { targetId: p.id, url: p.url };
   const { record, token } = await claimLease(backendOf2(driver), p.id, {
-    label: typeof args.label === "string" && args.label.length ? args.label : `pid-${process.pid}`,
+    label,
     ttlMs: typeof args.ttlMs === "number" && args.ttlMs > 0 ? args.ttlMs : leaseTtlMs()
   });
   return { targetId: p.id, url: p.url, lease: token, label: record.label, expiresAt: record.lastUsedAt + record.ttlMs };
@@ -1477,8 +1654,8 @@ async function closePage(driver, args) {
   return { closed: p.id, success: true, ...released.released ? { leaseReleased: true } : {} };
 }
 async function writeSelectedFile(id) {
-  await mkdir2(STATE_DIR, { recursive: true });
-  await writeFile2(join2(STATE_DIR, "selected"), id, "utf8");
+  await mkdir3(STATE_DIR, { recursive: true });
+  await writeFile3(join3(STATE_DIR, "selected"), id, "utf8");
 }
 async function selectPage(driver, args) {
   if (args.target === undefined || args.target === "")
@@ -1518,11 +1695,108 @@ async function waitForText(driver, args) {
     return { found: true, waitedMs: r.elapsedMs };
   });
 }
+function serializeForSink(value) {
+  const json = JSON.stringify(value === undefined ? null : value, null, 2);
+  return json ?? "null";
+}
+async function writeJsonSink(savePath, value) {
+  const path = savePath.startsWith("/") ? savePath : join3(ARTIFACT_DIR, savePath);
+  await mkdir3(dirname(path), { recursive: true });
+  const json = serializeForSink(value);
+  await writeFile3(path, json, "utf8");
+  return { path, bytes: Buffer.byteLength(json, "utf8") };
+}
+function sinkRequested(savePath) {
+  return savePath !== undefined && savePath !== "";
+}
 async function evaluateScript(driver, args) {
   if (typeof args.expression !== "string" || args.expression.length === 0) {
     throw new SharedToolError("evaluateScript: 'expression' must be a non-empty string");
   }
-  return withPage2(driver, args.target, (page) => page.evaluate(args.expression, { args: args.args, awaitPromise: args.awaitPromise ?? true }));
+  return withPage2(driver, args.target, async (page) => {
+    const value = await page.evaluate(args.expression, { args: args.args, awaitPromise: args.awaitPromise ?? true });
+    if (!sinkRequested(args.savePath))
+      return value;
+    const { path, bytes } = await writeJsonSink(args.savePath, value);
+    const result = {
+      path,
+      bytes,
+      type: value === null ? "null" : typeof value,
+      target: target3(page.info)
+    };
+    return result;
+  });
+}
+function cookieDomainMatches(cookieDomain, filter) {
+  const bare = (d) => (d.startsWith(".") ? d.slice(1) : d).toLowerCase();
+  const c = bare(cookieDomain);
+  const f = bare(filter);
+  return c === f || c.endsWith(`.${f}`);
+}
+function filterCookies(cookies, filter) {
+  return cookies.filter((c) => {
+    if (filter.name !== undefined && filter.name !== "" && c.name !== filter.name)
+      return false;
+    if (filter.domain !== undefined && filter.domain !== "" && !cookieDomainMatches(c.domain, filter.domain))
+      return false;
+    return true;
+  });
+}
+async function listCookies(driver, args = {}) {
+  return withPage2(driver, args.target, async (page) => {
+    const all = await page.getCookies();
+    const cookies = filterCookies(all, { domain: args.domain, name: args.name });
+    if (!sinkRequested(args.savePath)) {
+      return { cookies, count: cookies.length, target: target3(page.info) };
+    }
+    const { path, bytes } = await writeJsonSink(args.savePath, cookies);
+    return { path, bytes, count: cookies.length, target: target3(page.info) };
+  });
+}
+function assertCookieSite(args, toolName) {
+  const hasUrl = args.url !== undefined && args.url !== "";
+  const hasDomain = args.domain !== undefined && args.domain !== "";
+  if (!hasUrl && !hasDomain) {
+    throw new Error(`${toolName} requires either 'url' or 'domain': a cookie has to be attributed to a site, and neither was given.`);
+  }
+}
+function assertCookieName(name, toolName) {
+  if (name === undefined || name === "") {
+    throw new Error(`${toolName} requires a non-empty 'name'.`);
+  }
+}
+async function setCookie(driver, args) {
+  assertCookieName(args.name, "set_cookie");
+  if (typeof args.value !== "string")
+    throw new Error("set_cookie requires a string 'value'.");
+  assertCookieSite(args, "set_cookie");
+  return withPage2(driver, args.target, async (page) => {
+    await page.setCookie({
+      name: args.name,
+      value: args.value,
+      ...args.url !== undefined ? { url: args.url } : {},
+      ...args.domain !== undefined ? { domain: args.domain } : {},
+      ...args.path !== undefined ? { path: args.path } : {},
+      ...args.expires !== undefined ? { expires: args.expires } : {},
+      ...args.httpOnly !== undefined ? { httpOnly: args.httpOnly } : {},
+      ...args.secure !== undefined ? { secure: args.secure } : {},
+      ...args.sameSite !== undefined ? { sameSite: args.sameSite } : {}
+    });
+    return { set: true, target: target3(page.info) };
+  });
+}
+async function deleteCookies(driver, args) {
+  assertCookieName(args.name, "delete_cookies");
+  assertCookieSite(args, "delete_cookies");
+  return withPage2(driver, args.target, async (page) => {
+    await page.deleteCookies({
+      name: args.name,
+      ...args.url !== undefined ? { url: args.url } : {},
+      ...args.domain !== undefined ? { domain: args.domain } : {},
+      ...args.path !== undefined ? { path: args.path } : {}
+    });
+    return { deleted: true, target: target3(page.info) };
+  });
 }
 var BARE_TOKEN_EXTRAS = new Set(["disabled", "focused"]);
 var UNQUOTED_EXTRAS = new Set(["checked", "expanded", "url"]);
@@ -1633,10 +1907,10 @@ async function takeScreenshot(driver, args = {}) {
     const { data, format: outFormat } = await page.screenshot({ format, quality: args.quality, fullPage: args.fullPage, ...clip ? { clip } : {} });
     if (data.byteLength === 0)
       throw new SharedToolError("captureScreenshot returned empty data");
-    await mkdir2(ARTIFACT_DIR, { recursive: true });
+    await mkdir3(ARTIFACT_DIR, { recursive: true });
     const ext = outFormat === "jpeg" ? "jpg" : "png";
-    const path = args.savePath ?? join2(ARTIFACT_DIR, `screenshot-${page.info.id.slice(0, 8)}-${stamp()}.${ext}`);
-    await writeFile2(path, Buffer.from(data));
+    const path = args.savePath ?? join3(ARTIFACT_DIR, `screenshot-${page.info.id.slice(0, 8)}-${stamp()}.${ext}`);
+    await writeFile3(path, Buffer.from(data));
     const result = {
       path,
       bytes: data.byteLength,
@@ -1683,6 +1957,9 @@ var SHARED_TOOLS = {
   navigate_page: navigatePage,
   wait_for: waitForText,
   evaluate_script: evaluateScript,
+  list_cookies: listCookies,
+  set_cookie: setCookie,
+  delete_cookies: deleteCookies,
   take_snapshot: takeSnapshot,
   click,
   hover,
@@ -1699,10 +1976,10 @@ var SHARED_TOOLS = {
 };
 
 // src/tools/console.ts
-import { readFile as readFile2 } from "node:fs/promises";
+import { readFile as readFile3 } from "node:fs/promises";
 
 // src/tools/recorder.ts
-import { mkdir as mkdir3, appendFile, writeFile as writeFile3, copyFile } from "node:fs/promises";
+import { mkdir as mkdir4, appendFile, writeFile as writeFile4, copyFile } from "node:fs/promises";
 var ARTIFACT_DIR2 = process.env.CDP_ARTIFACT_DIR ?? "/tmp/cdp-toolkit";
 function recFile(targetId) {
   return `${ARTIFACT_DIR2}/rec-${targetId}.jsonl`;
@@ -1723,11 +2000,11 @@ var CONSOLE_EVENTS = ["Runtime.consoleAPICalled", "Runtime.exceptionThrown", "Lo
 async function startRecorder(target, opts = {}) {
   const network = opts.network ?? true;
   const consoleCap = opts.console ?? true;
-  await mkdir3(ARTIFACT_DIR2, { recursive: true });
+  await mkdir4(ARTIFACT_DIR2, { recursive: true });
   const { conn, target: resolved } = await openPage(target, { timeoutMs: opts.timeoutMs });
   const file = opts.file ?? recFile(resolved.id);
   if (opts.truncate) {
-    await writeFile3(file, "");
+    await writeFile4(file, "");
   }
   let chain = Promise.resolve();
   let dropped = 0;
@@ -1869,7 +2146,7 @@ function lineToEntry(line, index) {
 async function readConsoleEntries(file) {
   let raw;
   try {
-    raw = await readFile2(file, "utf8");
+    raw = await readFile3(file, "utf8");
   } catch {
     return [];
   }
@@ -1925,7 +2202,7 @@ async function getConsoleMessage(args = {}) {
 }
 
 // src/tools/network.ts
-import { readFile as readFile3 } from "node:fs/promises";
+import { readFile as readFile4 } from "node:fs/promises";
 var DEFAULT_CAPTURE_MS2 = 2500;
 function asHeaders(v) {
   if (!v || typeof v !== "object")
@@ -1992,7 +2269,7 @@ function correlate(lines) {
 async function readNetworkRequests(file) {
   let raw;
   try {
-    raw = await readFile3(file, "utf8");
+    raw = await readFile4(file, "utf8");
   } catch {
     return [];
   }
@@ -2074,8 +2351,8 @@ async function getNetworkRequest(args = {}) {
 }
 
 // src/tools/performance.ts
-import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4, stat, unlink as unlink2 } from "node:fs/promises";
-import { join as join3 } from "node:path";
+import { mkdir as mkdir5, readFile as readFile5, writeFile as writeFile5, stat, unlink as unlink3 } from "node:fs/promises";
+import { join as join4 } from "node:path";
 var ARTIFACT_DIR3 = process.env.CDP_ARTIFACT_DIR ?? "/tmp/cdp-toolkit";
 var STATE_DIR2 = process.env.CDP_STATE_DIR ?? "/tmp/cdp-toolkit";
 var DEFAULT_CATEGORIES = [
@@ -2093,7 +2370,7 @@ function shortId(id) {
   return id.slice(0, 8);
 }
 function stateFilePath() {
-  return join3(STATE_DIR2, "trace-state.json");
+  return join4(STATE_DIR2, "trace-state.json");
 }
 function bufferTraceData(conn, sink) {
   return conn.on("Tracing.dataCollected", (params) => {
@@ -2115,10 +2392,10 @@ async function endTrace(conn, sink, timeoutMs = 30000) {
   return sink;
 }
 async function writeTrace(events, targetId) {
-  await mkdir4(ARTIFACT_DIR3, { recursive: true });
-  const path = join3(ARTIFACT_DIR3, `trace-${shortId(targetId)}-${stamp2()}.json`);
+  await mkdir5(ARTIFACT_DIR3, { recursive: true });
+  const path = join4(ARTIFACT_DIR3, `trace-${shortId(targetId)}-${stamp2()}.json`);
   const body = JSON.stringify({ traceEvents: events, metadata: { source: "cdp-toolkit" } });
-  await writeFile4(path, body, "utf8");
+  await writeFile5(path, body, "utf8");
   const { size } = await stat(path);
   return { path, bytes: size };
 }
@@ -2138,7 +2415,7 @@ async function performanceStartTrace(args = {}) {
     throw err;
   }
   liveTraces.set(target.id, { conn, target, events, startedAt: Date.now() });
-  await mkdir4(STATE_DIR2, { recursive: true });
+  await mkdir5(STATE_DIR2, { recursive: true });
   const state = {
     targetId: target.id,
     url: target.url,
@@ -2146,7 +2423,7 @@ async function performanceStartTrace(args = {}) {
     pid: process.pid,
     categories
   };
-  await writeFile4(stateFilePath(), JSON.stringify(state), "utf8");
+  await writeFile5(stateFilePath(), JSON.stringify(state), "utf8");
   return {
     target: { id: target.id, url: target.url, title: target.title },
     categories,
@@ -2159,7 +2436,7 @@ async function performanceStopTrace(args = {}) {
   if (!entry) {
     let hint = "";
     try {
-      const raw = await readFile4(stateFilePath(), "utf8");
+      const raw = await readFile5(stateFilePath(), "utf8");
       const state = JSON.parse(raw);
       hint = state.pid === process.pid ? ` (state file lists target ${shortId(state.targetId)} but its live connection is gone)` : ` (trace was started by a DIFFERENT process pid=${state.pid}; live recordings cannot cross process boundaries)`;
     } catch {}
@@ -2171,7 +2448,7 @@ async function performanceStopTrace(args = {}) {
   } finally {
     conn.close();
     liveTraces.delete(target.id);
-    await unlink2(stateFilePath()).catch(() => {});
+    await unlink3(stateFilePath()).catch(() => {});
   }
   const written = await writeTrace(events, target.id);
   const metrics = analyzeEvents(events);
@@ -2289,7 +2566,7 @@ async function performanceAnalyzeInsight(args = {}) {
   }
   let raw;
   try {
-    raw = await readFile4(args.tracePath, "utf8");
+    raw = await readFile5(args.tracePath, "utf8");
   } catch (err) {
     throw new CdpError(`cannot read trace file '${args.tracePath}': ${err.message}`);
   }
@@ -2305,11 +2582,375 @@ async function performanceAnalyzeInsight(args = {}) {
   return { ...analyzeEvents(events), tracePath: args.tracePath };
 }
 
-// src/tools/heap.ts
-import { mkdir as mkdir5, writeFile as writeFile5 } from "node:fs/promises";
-import { join as join4 } from "node:path";
+// src/tools/screencast.ts
+import { spawn } from "node:child_process";
+import { mkdir as mkdir6, rm, stat as stat2, writeFile as writeFile6 } from "node:fs/promises";
+import { join as join5 } from "node:path";
 var ARTIFACT_DIR4 = process.env.CDP_ARTIFACT_DIR ?? "/tmp/cdp-toolkit";
-function stamp3(targetId) {
+var FFMPEG_BIN = process.env.CDP_FFMPEG ?? "ffmpeg";
+function frameDurationsMs(ledger, stopWallclockMs) {
+  return ledger.map((entry, i) => {
+    const next = i + 1 < ledger.length ? ledger[i + 1].timestamp : stopWallclockMs;
+    return Math.max(1, Math.round(next - entry.timestamp));
+  });
+}
+var CONCAT_GRID_MS = 40;
+function coalesceToConcatGrid(ledger, stopWallclockMs, gridMs = CONCAT_GRID_MS) {
+  if (!ledger.length)
+    return [];
+  const raw = frameDurationsMs(ledger, stopWallclockMs);
+  let elapsed = 0;
+  const kept = [];
+  let lastSlot = -1;
+  for (let i = 0;i < ledger.length; i++) {
+    const slot = Math.round(elapsed / gridMs);
+    if (slot > lastSlot) {
+      kept.push({ file: ledger[i].file, slot });
+      lastSlot = slot;
+    }
+    elapsed += raw[i];
+  }
+  const endSlot = Math.max(lastSlot + 1, Math.round(elapsed / gridMs));
+  return kept.map((frame, i) => ({
+    file: frame.file,
+    durationMs: ((i + 1 < kept.length ? kept[i + 1].slot : endSlot) - frame.slot) * gridMs
+  }));
+}
+function buildConcatManifest(frames) {
+  if (!frames.length)
+    throw new CdpError("cannot build a concat manifest from an empty frame ledger");
+  const lines = ["ffconcat version 1.0"];
+  for (const frame of frames) {
+    lines.push(`file ${frame.file}`);
+    lines.push(`duration ${(frame.durationMs / 1000).toFixed(6)}`);
+  }
+  lines.push(`file ${frames[frames.length - 1].file}`);
+  return `${lines.join(`
+`)}
+`;
+}
+function evenDimensions(width, height) {
+  return { width: Math.max(0, Math.trunc(width / 2) * 2), height: Math.max(0, Math.trunc(height / 2) * 2) };
+}
+function pngSize(buf) {
+  if (buf.length < 24)
+    return;
+  if (buf.readUInt32BE(0) !== 2303741511 || buf.readUInt32BE(4) !== 218765834)
+    return;
+  if (buf.toString("latin1", 12, 16) !== "IHDR")
+    return;
+  return { width: buf.readUInt32BE(16), height: buf.readUInt32BE(20) };
+}
+var JPEG_SOF = new Set([192, 193, 194, 195, 197, 198, 199, 201, 202, 203, 205, 206, 207]);
+function jpegSize(buf) {
+  if (buf.length < 4 || buf[0] !== 255 || buf[1] !== 216)
+    return;
+  let i = 2;
+  while (i + 3 < buf.length) {
+    if (buf[i] !== 255) {
+      i += 1;
+      continue;
+    }
+    const marker = buf[i + 1];
+    if (marker === 255) {
+      i += 1;
+      continue;
+    }
+    if (marker === 216 || marker === 1 || marker >= 208 && marker <= 215) {
+      i += 2;
+      continue;
+    }
+    if (i + 3 >= buf.length)
+      return;
+    const segLen = buf.readUInt16BE(i + 2);
+    if (JPEG_SOF.has(marker)) {
+      if (i + 9 > buf.length)
+        return;
+      return { width: buf.readUInt16BE(i + 7), height: buf.readUInt16BE(i + 5) };
+    }
+    if (segLen < 2)
+      return;
+    i += 2 + segLen;
+  }
+  return;
+}
+function imageSize(buf) {
+  return pngSize(buf) ?? jpegSize(buf);
+}
+var ENCODER_LADDER = [
+  { encoder: "hevc_videotoolbox", codec: "hevc", tag: "hvc1" },
+  { encoder: "h264_videotoolbox", codec: "h264" },
+  { encoder: "libx265", codec: "hevc", tag: "hvc1" },
+  { encoder: "libx264", codec: "h264" }
+];
+function ffmpegEncoderNames(encodersOutput) {
+  const names = new Set;
+  for (const line of encodersOutput.split(`
+`)) {
+    const m = /^\s*[VAS][A-Z.]{5}\s+(\S+)/.exec(line);
+    if (m)
+      names.add(m[1]);
+  }
+  return names;
+}
+function selectEncoder(encodersOutput) {
+  const available = ffmpegEncoderNames(encodersOutput);
+  for (const candidate of ENCODER_LADDER) {
+    if (available.has(candidate.encoder))
+      return candidate;
+  }
+  throw new CdpError(`ffmpeg reports none of the supported video encoders (${ENCODER_LADDER.map((c) => c.encoder).join(", ")}). ` + "Install a full ffmpeg build: 'brew install ffmpeg' (macOS) or 'apt install ffmpeg' (Debian/Ubuntu).");
+}
+function buildFfmpegArgs(manifestPath, outPath, choice) {
+  return [
+    "-hide_banner",
+    "-loglevel",
+    "error",
+    "-y",
+    "-f",
+    "concat",
+    "-safe",
+    "0",
+    "-i",
+    manifestPath,
+    "-vsync",
+    "vfr",
+    "-vf",
+    "scale=trunc(iw/2)*2:trunc(ih/2)*2",
+    "-c:v",
+    choice.encoder,
+    ...choice.tag ? ["-tag:v", choice.tag] : [],
+    "-pix_fmt",
+    "yuv420p",
+    "-movflags",
+    "+faststart",
+    "-an",
+    outPath
+  ];
+}
+function run(bin, args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(bin, args, { stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString("utf8");
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString("utf8");
+    });
+    child.on("error", reject);
+    child.on("close", (code) => resolve({ code, stdout, stderr }));
+  });
+}
+var encoderProbe;
+var FFMPEG_MISSING = `ffmpeg is required to encode a screen recording but '${FFMPEG_BIN}' could not be executed. ` + "Install it with 'brew install ffmpeg' (macOS) or 'apt install ffmpeg' (Debian/Ubuntu), " + "or point CDP_FFMPEG at the binary.";
+async function probeEncoder() {
+  if (!encoderProbe) {
+    encoderProbe = (async () => {
+      let res;
+      try {
+        res = await run(FFMPEG_BIN, ["-hide_banner", "-encoders"]);
+      } catch (err) {
+        throw new CdpError(`${FFMPEG_MISSING} (${err.message})`);
+      }
+      if (res.code !== 0)
+        throw new CdpError(`${FFMPEG_MISSING} ('-encoders' exited ${res.code}: ${res.stderr.trim().slice(0, 300)})`);
+      return selectEncoder(`${res.stdout}
+${res.stderr}`);
+    })();
+    encoderProbe.catch(() => {
+      encoderProbe = undefined;
+    });
+  }
+  return encoderProbe;
+}
+var liveRecordings = new Map;
+function shortId2(id) {
+  return id.slice(0, 8);
+}
+function assertNotRecording(targetId, activeIds) {
+  if (activeIds.includes(targetId)) {
+    throw new CdpError(`a screen recording is already in progress for target ${shortId2(targetId)}; call stop_screen_recording first`);
+  }
+}
+function chooseRecordingId(activeIds, selector) {
+  if (!activeIds.length) {
+    throw new CdpError("no screen recording is in progress in this process. start_screen_recording parks a live CDP connection in memory, so a recording cannot be stopped from a different process than the one that started it (the CLI is one process per call: use the MCP server for the pair).");
+  }
+  if (selector === undefined || selector === "active") {
+    if (activeIds.length === 1)
+      return activeIds[0];
+    throw new CdpError(`${activeIds.length} screen recordings are in progress (targets: ${activeIds.map(shortId2).join(", ")}); pass 'target' to say which one to stop`);
+  }
+  return activeIds.find((id) => id === selector);
+}
+function stamp3() {
+  return new Date(Date.now()).toISOString().replace(/[:.]/g, "-");
+}
+function target32(t) {
+  return { id: t.id, url: t.url, title: t.title };
+}
+async function startScreenRecording(args = {}) {
+  const format = args.format ?? "jpeg";
+  if (format !== "jpeg" && format !== "png")
+    throw new CdpError("start_screen_recording: format must be 'jpeg' or 'png'");
+  if (args.quality !== undefined && (!Number.isFinite(args.quality) || args.quality < 0 || args.quality > 100)) {
+    throw new CdpError("start_screen_recording: quality must be a number between 0 and 100 (jpeg only)");
+  }
+  const encoder = await probeEncoder();
+  const { conn, target } = await openPage(args.target);
+  try {
+    assertNotRecording(target.id, [...liveRecordings.keys()]);
+  } catch (err) {
+    conn.close();
+    throw err;
+  }
+  const spoolDir = join5(ARTIFACT_DIR4, `screencast-${shortId2(target.id)}-${stamp3()}`);
+  try {
+    await mkdir6(spoolDir, { recursive: true });
+  } catch (err) {
+    conn.close();
+    throw new CdpError(`cannot create the screencast spool directory '${spoolDir}': ${err.message}`);
+  }
+  const ext = format === "png" ? "png" : "jpg";
+  const rec = {
+    conn,
+    target,
+    spoolDir,
+    ledger: [],
+    startedAt: Date.now(),
+    format,
+    encoder,
+    writes: Promise.resolve(),
+    dropped: 0,
+    unwritten: new Set,
+    off: () => {}
+  };
+  let seq = 0;
+  rec.off = conn.on("Page.screencastFrame", (params) => {
+    const sessionId = params.sessionId;
+    if (typeof sessionId === "number") {
+      conn.send("Page.screencastFrameAck", { sessionId }).catch(() => {});
+    }
+    const data = params.data;
+    if (typeof data !== "string" || !data.length) {
+      rec.dropped += 1;
+      return;
+    }
+    const meta = params.metadata;
+    const timestamp = typeof meta?.timestamp === "number" ? Math.round(meta.timestamp * 1000) : Date.now();
+    const buf = Buffer.from(data, "base64");
+    const size = imageSize(buf);
+    if (!size || size.width <= 0 || size.height <= 0) {
+      rec.dropped += 1;
+      return;
+    }
+    seq += 1;
+    const file = `frame-${String(seq).padStart(6, "0")}.${ext}`;
+    rec.ledger.push({ file, timestamp, width: size.width, height: size.height });
+    rec.writes = rec.writes.then(() => writeFile6(join5(spoolDir, file), buf)).catch(() => {
+      rec.dropped += 1;
+      rec.unwritten.add(file);
+    });
+  });
+  try {
+    await conn.send("Page.enable");
+    if (args.bringToFront)
+      await conn.send("Page.bringToFront").catch(() => {});
+    const params = { format };
+    if (format === "jpeg" && args.quality !== undefined)
+      params.quality = args.quality;
+    if (args.maxWidth !== undefined)
+      params.maxWidth = args.maxWidth;
+    if (args.maxHeight !== undefined)
+      params.maxHeight = args.maxHeight;
+    if (args.everyNthFrame !== undefined)
+      params.everyNthFrame = args.everyNthFrame;
+    await conn.send("Page.startScreencast", params);
+  } catch (err) {
+    rec.off();
+    conn.close();
+    await rm(spoolDir, { recursive: true, force: true }).catch(() => {});
+    throw err;
+  }
+  liveRecordings.set(target.id, rec);
+  return {
+    target: target32(target),
+    format,
+    spoolDir,
+    encoder: encoder.encoder,
+    codec: encoder.codec,
+    startedAt: rec.startedAt,
+    note: "Recording. Call stop_screen_recording in THIS process to encode the MP4; frames only arrive on repaint, so a still page yields one long-held frame."
+  };
+}
+async function pickRecording(selector) {
+  const chosen = chooseRecordingId([...liveRecordings.keys()], selector);
+  if (chosen)
+    return liveRecordings.get(chosen);
+  const { conn, target } = await openPage(selector);
+  conn.close();
+  const hit = liveRecordings.get(target.id);
+  if (!hit) {
+    throw new CdpError(`no screen recording is in progress for target ${shortId2(target.id)} (recording: ${[...liveRecordings.keys()].map(shortId2).join(", ") || "none"})`);
+  }
+  return hit;
+}
+async function stopScreenRecording(args = {}) {
+  const rec = await pickRecording(args.target);
+  rec.off();
+  try {
+    await rec.conn.send("Page.stopScreencast");
+  } catch {}
+  const stoppedAt = Date.now();
+  await rec.writes.catch(() => {});
+  rec.conn.close();
+  liveRecordings.delete(rec.target.id);
+  const ledger = rec.unwritten.size ? rec.ledger.filter((entry) => !rec.unwritten.has(entry.file)) : rec.ledger;
+  if (!ledger.length) {
+    await rm(rec.spoolDir, { recursive: true, force: true }).catch(() => {});
+    throw new CdpError(`screen recording captured 0 frames for target ${shortId2(rec.target.id)}. Chrome emits a screencast frame only on repaint: a fully backgrounded or occluded tab may never paint. Retry with bringToFront:true, or drive the page while recording.`);
+  }
+  await mkdir6(ARTIFACT_DIR4, { recursive: true });
+  const outPath = args.savePath ?? join5(ARTIFACT_DIR4, `screen-recording-${shortId2(rec.target.id)}-${stamp3()}.mp4`);
+  const frames = coalesceToConcatGrid(ledger, stoppedAt);
+  const manifestPath = join5(rec.spoolDir, "frames.ffconcat");
+  await writeFile6(manifestPath, buildConcatManifest(frames), "utf8");
+  const durationMs = frames.reduce((total, f) => total + f.durationMs, 0);
+  const { width, height } = evenDimensions(ledger[0].width, ledger[0].height);
+  let res;
+  try {
+    res = await run(FFMPEG_BIN, buildFfmpegArgs(manifestPath, outPath, rec.encoder));
+  } catch (err) {
+    throw new CdpError(`${FFMPEG_MISSING} Spooled frames kept at ${rec.spoolDir}. (${err.message})`);
+  }
+  if (res.code !== 0) {
+    throw new CdpError(`ffmpeg (${rec.encoder.encoder}) exited ${res.code} encoding ${frames.length} frames. Spooled frames kept at ${rec.spoolDir}, re-run by hand with: ` + `${FFMPEG_BIN} ${buildFfmpegArgs(manifestPath, outPath, rec.encoder).join(" ")}
+ffmpeg said: ${res.stderr.trim().slice(0, 800)}`);
+  }
+  const { size } = await stat2(outPath);
+  await rm(rec.spoolDir, { recursive: true, force: true }).catch(() => {});
+  return {
+    path: outPath,
+    bytes: size,
+    durationMs,
+    frameCount: ledger.length,
+    encodedFrames: frames.length,
+    codec: rec.encoder.codec,
+    encoder: rec.encoder.encoder,
+    width,
+    height,
+    droppedFrames: rec.dropped,
+    target: target32(rec.target)
+  };
+}
+
+// src/tools/heap.ts
+import { mkdir as mkdir7, writeFile as writeFile7 } from "node:fs/promises";
+import { join as join6 } from "node:path";
+var ARTIFACT_DIR5 = process.env.CDP_ARTIFACT_DIR ?? "/tmp/cdp-toolkit";
+function stamp4(targetId) {
   const short = targetId.slice(0, 8);
   const iso = new Date().toISOString().replace(/[:.]/g, "-");
   return `${short}-${iso}`;
@@ -2332,9 +2973,9 @@ async function takeHeapsnapshot(args = {}) {
     if (snapshot.length === 0) {
       throw new Error("HeapProfiler.takeHeapSnapshot produced no chunks");
     }
-    await mkdir5(ARTIFACT_DIR4, { recursive: true });
-    const path = args.savePath ? args.savePath.startsWith("/") ? args.savePath : join4(ARTIFACT_DIR4, args.savePath) : join4(ARTIFACT_DIR4, `take_heapsnapshot-${stamp3(target.id)}.heapsnapshot`);
-    await writeFile5(path, snapshot, "utf8");
+    await mkdir7(ARTIFACT_DIR5, { recursive: true });
+    const path = args.savePath ? args.savePath.startsWith("/") ? args.savePath : join6(ARTIFACT_DIR5, args.savePath) : join6(ARTIFACT_DIR5, `take_heapsnapshot-${stamp4(target.id)}.heapsnapshot`);
+    await writeFile7(path, snapshot, "utf8");
     const bytes = Buffer.byteLength(snapshot, "utf8");
     return {
       path,
@@ -2346,15 +2987,15 @@ async function takeHeapsnapshot(args = {}) {
 }
 
 // src/tools/lighthouse.ts
-import { spawn } from "node:child_process";
-import { mkdir as mkdir6, readFile as readFile5, stat as stat2 } from "node:fs/promises";
-var ARTIFACT_DIR5 = process.env.CDP_ARTIFACT_DIR ?? "/tmp/cdp-toolkit";
+import { spawn as spawn2 } from "node:child_process";
+import { mkdir as mkdir8, readFile as readFile6, stat as stat3 } from "node:fs/promises";
+var ARTIFACT_DIR6 = process.env.CDP_ARTIFACT_DIR ?? "/tmp/cdp-toolkit";
 function cdpPort() {
   const base = process.env.CDP_BASE ?? "http://127.0.0.1:9222";
   const m = base.match(/:(\d+)/);
   return m?.[1] ? Number(m[1]) : 9222;
 }
-function stamp4() {
+function stamp5() {
   return new Date(Date.now()).toISOString().replace(/[:.]/g, "-");
 }
 function shortHost(url) {
@@ -2371,7 +3012,7 @@ function runProcess(cmd, args, opts) {
     let stdout = "";
     let stderr = "";
     let settled = false;
-    const child = spawn(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn2(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
     const timer = setTimeout(() => {
       if (settled)
         return;
@@ -2408,8 +3049,8 @@ async function lighthouseAudit(args) {
   const url = args.url.trim();
   const timeoutMs = args.timeoutMs ?? 120000;
   const port = cdpPort();
-  await mkdir6(ARTIFACT_DIR5, { recursive: true });
-  const outPath = args.savePath ?? `${ARTIFACT_DIR5}/lighthouse-${shortHost(url)}-${stamp4()}.json`;
+  await mkdir8(ARTIFACT_DIR6, { recursive: true });
+  const outPath = args.savePath ?? `${ARTIFACT_DIR6}/lighthouse-${shortHost(url)}-${stamp5()}.json`;
   const formFactor = args.formFactor ?? "desktop";
   const lhArgs = [
     "--yes",
@@ -2437,7 +3078,7 @@ async function lighthouseAudit(args) {
   }
   let raw;
   try {
-    raw = await readFile5(outPath, "utf8");
+    raw = await readFile6(outPath, "utf8");
   } catch {
     raw = undefined;
   }
@@ -2464,7 +3105,7 @@ async function lighthouseAudit(args) {
   if (Object.keys(categories).length === 0) {
     throw new CdpError(`lighthouse_audit report contained no category scores (exit code ${res.code}). stderr: ${truncate(res.stderr)}`);
   }
-  const { size } = await stat2(outPath);
+  const { size } = await stat3(outPath);
   return {
     path: outPath,
     bytes: size,
@@ -2494,6 +3135,9 @@ var TOOLS = {
   navigate_page: onCdp(SHARED_TOOLS.navigate_page),
   wait_for: onCdp(SHARED_TOOLS.wait_for),
   evaluate_script: onCdp(SHARED_TOOLS.evaluate_script),
+  list_cookies: onCdp(SHARED_TOOLS.list_cookies),
+  set_cookie: onCdp(SHARED_TOOLS.set_cookie),
+  delete_cookies: onCdp(SHARED_TOOLS.delete_cookies),
   take_snapshot: onCdp(SHARED_TOOLS.take_snapshot),
   click: onCdp(SHARED_TOOLS.click),
   hover: onCdp(SHARED_TOOLS.hover),
@@ -2515,6 +3159,8 @@ var TOOLS = {
   performance_stop_trace: performanceStopTrace,
   performance_analyze_insight: performanceAnalyzeInsight,
   performance_trace: performanceTrace,
+  start_screen_recording: startScreenRecording,
+  stop_screen_recording: stopScreenRecording,
   take_heapsnapshot: takeHeapsnapshot,
   lighthouse_audit: lighthouseAudit,
   mock_request: mockRequest,
@@ -2535,7 +3181,7 @@ import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprot
 var MANIFEST = [
   {
     name: "list_pages",
-    description: "Enumerate browser page targets via the CDP browser endpoint (GET /json/list). By default returns only page-type tabs; set 'all' to also include workers and background pages. Each entry carries the targetId used as a target selector elsewhere.",
+    description: "Enumerate browser page targets via the CDP browser endpoint (GET /json/list). By default returns only page-type tabs; set 'all' to also include workers and background pages. Each entry carries the targetId used as a target selector elsewhere, plus an 'origin' field recording where the tab came from: 'agent' means this toolkit created it (the entry then also carries the creating 'label' and 'createdAt'), and this stays true after the creating agent releases its lease or dies, which is what makes a stray agent tab findable later. 'unknown' means there is no creation record. It never says 'human': the toolkit cannot prove a person opened a tab, so 'unknown' is the honest word for a tab it did not create, one opened before the toolkit ran, or one whose record could not be written. A tab whose record exists but could not be read reports origin 'unknown' plus 'originUnreadable', so a broken record is never mistaken for no record.",
     inputSchema: {
       type: "object",
       properties: {
@@ -2702,7 +3348,7 @@ var MANIFEST = [
   },
   {
     name: "evaluate_script",
-    description: "Run arbitrary JavaScript in the target page's main-world context over raw CDP and return the evaluated value (returnByValue). With no 'args' the 'expression' is evaluated as a raw expression; when 'args' is provided 'expression' must be a function literal (arrow or classic) invoked on globalThis with the args passed positionally. A thrown exception surfaces as an error; non-serializable returns (DOM nodes, functions) come back as their CDP description string.",
+    description: "Run arbitrary JavaScript in the target page's main-world context over raw CDP and return the evaluated value (returnByValue). With no 'args' the 'expression' is evaluated as a raw expression; when 'args' is provided 'expression' must be a function literal (arrow or classic) invoked on globalThis with the args passed positionally. A thrown exception surfaces as an error; non-serializable returns (DOM nodes, functions) come back as their CDP description string. Pass 'savePath' to write the evaluated value to a JSON file instead: the response then carries only {path,bytes,type,target} and the value itself never appears in it, in any form. That is the way to read a credential (a JWT or session token out of localStorage, for example) without putting the secret into the caller's transcript.",
     inputSchema: {
       type: "object",
       properties: {
@@ -2725,6 +3371,10 @@ var MANIFEST = [
         args: {
           type: "array",
           description: "Positional JSON-serializable arguments to pass to the expression, treating it as a function. No live element/page handle is bound."
+        },
+        savePath: {
+          type: "string",
+          description: "Write the evaluated value to this file as JSON and KEEP IT OUT OF THE RESPONSE: with savePath set the result is {path,bytes,type,target} only, with no copy, preview or truncation of the value. Use it to read credentials without putting them in a transcript. An absolute path (starting with /) is used as-is; a relative path is resolved under the artifact dir (/tmp/cdp-toolkit). Missing parent directories are created. Omit it to get the value back inline, exactly as before."
         }
       },
       required: [
@@ -2733,6 +3383,128 @@ var MANIFEST = [
       additionalProperties: false
     }
   },
+  {
+    name: "list_cookies",
+    description: "Read the cookie store for the target page, INCLUDING httpOnly cookies, which document.cookie cannot see and an evaluate_script call therefore cannot reach. Each cookie carries name, value, domain, path, expires (Unix seconds, -1 for a session cookie), size, httpOnly, secure, sameSite ('strict'|'lax'|'none'|'default') and session. The read is page-scoped, not browser-wide: it returns the cookies of the resolved tab (Chrome: Network.getCookies; Firefox: storage.getCookies partitioned by that browsing context), so point at a page on the site whose cookies you want. Filter with 'domain' and/or 'name'. Pass 'savePath' to write the cookie array to a JSON file instead: the response is then {path,bytes,count,target} only, with no cookie value in it in any form, which is how to capture a session cookie without putting the credential in the caller's transcript.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        lease: {
+          type: "string",
+          description: "Opaque lease token from claim_page. Required only when the tab this call resolves to is leased by someone; omit it for unleased tabs."
+        },
+        target: {
+          type: "string",
+          description: "Target page selector: 'active' (default) | '<targetId>' | 'index:N' | 'url:<substring>' | 'title:<substring>'."
+        },
+        domain: {
+          type: "string",
+          description: "Keep only cookies for this domain. A leading dot is ignored on both sides and subdomains of the given domain match too, so 'example.test' matches '.example.test' and 'app.example.test'. No wildcards."
+        },
+        name: {
+          type: "string",
+          description: "Keep only the cookie with exactly this name. Exact match, not a substring."
+        },
+        savePath: {
+          type: "string",
+          description: "Write the cookie array to this file as JSON and KEEP THE VALUES OUT OF THE RESPONSE: with savePath set the result is {path,bytes,count,target} only, with no copy, preview or truncation of any cookie value. An absolute path (starting with /) is used as-is; a relative path is resolved under the artifact dir (/tmp/cdp-toolkit). Missing parent directories are created. Omit it to get the cookies back inline."
+        }
+      },
+      required: [],
+      additionalProperties: false
+    }
+  },
+  {
+    name: "set_cookie",
+    description: "Write one cookie into the target page's cookie store, INCLUDING an httpOnly or secure cookie, which document.cookie cannot create and an evaluate_script call therefore cannot either. Chrome uses Network.setCookie, Firefox uses storage.setCookie partitioned by the resolved browsing context. Either 'url' or 'domain' is REQUIRED: a cookie has to be attributed to a site and the call is refused with an error when neither is given, rather than guessing the current page's origin. The response is {set:true,target} and never echoes the value back, so a credential you just supplied does not land in the transcript twice. A 'set:true' is earned, not assumed: Chrome answers Network.setCookie with success:false when it declines a cookie (a domain the url does not belong to, a secure cookie on an insecure origin, an oversized value) and that refusal is raised as an error. On Firefox, 'domain' is derived from 'url' when only the url was given, because BiDi has no url parameter; a url with no host, such as about:blank or a data URL, is an error rather than a silent no-op. Read the result back with list_cookies when you need proof.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        lease: {
+          type: "string",
+          description: "Opaque lease token from claim_page. Required only when the tab this call resolves to is leased by someone; omit it for unleased tabs."
+        },
+        target: {
+          type: "string",
+          description: "Target page selector: 'active' (default) | '<targetId>' | 'index:N' | 'url:<substring>' | 'title:<substring>'."
+        },
+        name: {
+          type: "string",
+          description: "Cookie name. Required and non-empty."
+        },
+        value: {
+          type: "string",
+          description: "Cookie value. Required. It is not echoed back in the response."
+        },
+        url: {
+          type: "string",
+          description: "The URL the cookie is set for, for example 'https://example.com/'. Chrome derives domain, path and secure from it. Firefox derives only the domain from its host. Give this or 'domain'."
+        },
+        domain: {
+          type: "string",
+          description: "Cookie domain, for example 'example.com' or '.example.com' for subdomains. Give this or 'url'. When both are given, this wins on Firefox and Chrome applies its own url plus domain consistency rule."
+        },
+        path: {
+          type: "string",
+          description: "Cookie path. Passed through exactly as given and NOT defaulted to '/': with a 'url' Chrome derives the path from it, so an invented default here would widen a cookie you meant to scope narrowly."
+        },
+        expires: {
+          type: "number",
+          description: "Expiry as Unix time in SECONDS, matching what list_cookies reports. Omit it for a session cookie, which is what both backends do when no expiry is supplied."
+        },
+        httpOnly: {
+          type: "boolean",
+          description: "Set the httpOnly flag, making the cookie invisible to document.cookie. Only a protocol write like this one can create such a cookie."
+        },
+        secure: {
+          type: "boolean",
+          description: "Set the secure flag. Chrome declines a secure cookie on an insecure origin, and that refusal surfaces as an error."
+        },
+        sameSite: {
+          type: "string",
+          enum: ["strict", "lax", "none", "default"],
+          description: "SameSite attribute, lowercase, matching what list_cookies reports. 'default' means the attribute is not set at all."
+        }
+      },
+      required: ["name", "value"],
+      additionalProperties: false
+    }
+  },
+  {
+    name: "delete_cookies",
+    description: "Delete the named cookie from the target page's cookie store, httpOnly cookies included. Chrome uses Network.deleteCookies, Firefox uses storage.deleteCookies with a filter, partitioned by the resolved browsing context. Both 'name' and one of 'url' or 'domain' are REQUIRED: without a site constraint the call would delete by name across the whole partition, so it is refused with an error instead. Narrow further with 'path'. The response is {deleted:true,target} and carries NO count, because neither protocol reports how many cookies it removed and a number here would be invented; call list_cookies before and after when you need a real count. 'deleted:true' means the backend accepted and performed the deletion, not that a matching cookie existed, since deleting an absent cookie is a success on both backends.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        lease: {
+          type: "string",
+          description: "Opaque lease token from claim_page. Required only when the tab this call resolves to is leased by someone; omit it for unleased tabs."
+        },
+        target: {
+          type: "string",
+          description: "Target page selector: 'active' (default) | '<targetId>' | 'index:N' | 'url:<substring>' | 'title:<substring>'."
+        },
+        name: {
+          type: "string",
+          description: "Exact cookie name to delete. Required and non-empty. No wildcards: this removes a named cookie, not a swathe of them."
+        },
+        url: {
+          type: "string",
+          description: "Delete cookies matching this URL, for example 'https://example.com/'. Give this or 'domain'. On Firefox only the host is used, because BiDi's filter has no url field."
+        },
+        domain: {
+          type: "string",
+          description: "Delete cookies with this exact domain. Give this or 'url'."
+        },
+        path: {
+          type: "string",
+          description: "Narrow the deletion to cookies with this exact path. Omit to match any path allowed by the other constraints."
+        }
+      },
+      required: ["name"],
+      additionalProperties: false
+    }
+  },
   {
     name: "take_snapshot",
     description: "Capture the page's accessibility tree (Accessibility.getFullAXTree) as a compact indented text tree where each line is prefixed with [uid], the node's CDP backendDOMNodeId. These uids are the stateless element references that every interaction tool (click/hover/fill/etc.) feeds back to resolve a live DOM node (via DOM.resolveNode({ backendNodeId: uid })), so run this first to discover uids.",
@@ -3502,6 +4274,76 @@ var MANIFEST = [
       additionalProperties: false
     }
   },
+  {
+    name: "start_screen_recording",
+    description: "Start recording the target tab to video over raw CDP (Page.startScreencast), holding one persistent connection open and spooling every Page.screencastFrame to disk. Chrome emits a frame ON REPAINT, not on a clock, so the stream is variable-rate: each frame is timestamped into a ledger and stop_screen_recording turns those timestamps into per-frame display durations, which is what makes a still page hold one long frame instead of the video racing or freezing. Every frame is acked immediately (an unacked frame stalls the stream). ffmpeg is probed here, not at stop, so a missing encoder fails before a recording is captured and thrown away. Must be paired with stop_screen_recording WITHIN THE SAME PROCESS (the frames are events on this connection and cannot be re-attached from another process, so the pair works under the MCP server, not the one-process-per-call CLI). Throws if a recording is already in progress for the target; recordings on DIFFERENT targets run concurrently. Chrome only: WebDriver BiDi has no screencast primitive, so both tools are absent under --browser firefox.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        lease: {
+          type: "string",
+          description: "Opaque lease token from claim_page. Required only when the tab this call resolves to is leased by someone; omit it for unleased tabs, which behave exactly as before."
+        },
+        target: {
+          type: "string",
+          description: "Target page selector: 'active' (default) | 'index:N' | 'url:<substr>' | 'title:<substr>' | '<targetId>'."
+        },
+        format: {
+          type: "string",
+          enum: [
+            "jpeg",
+            "png"
+          ],
+          description: "Frame image format. Defaults to jpeg (far smaller per repaint); png is lossless. quality applies to jpeg only."
+        },
+        quality: {
+          type: "number",
+          description: "JPEG frame quality 0-100. Ignored for png. Omitted by default, which leaves Chrome's own default in place."
+        },
+        maxWidth: {
+          type: "number",
+          description: "Cap the streamed frame width in pixels. Also the way to pin frame size if the viewport might change mid-recording."
+        },
+        maxHeight: {
+          type: "number",
+          description: "Cap the streamed frame height in pixels."
+        },
+        everyNthFrame: {
+          type: "number",
+          description: "Capture only every Nth repaint (1 = every frame). Reduces spool size on a busy page; per-frame durations keep playback at wallclock speed either way."
+        },
+        bringToFront: {
+          type: "boolean",
+          description: "Activate the tab (Page.bringToFront) before recording. Default false. A fully backgrounded or occluded tab may never repaint, and a recording of one captures 0 frames."
+        }
+      },
+      required: [],
+      additionalProperties: false
+    }
+  },
+  {
+    name: "stop_screen_recording",
+    description: "Stop the recording started by start_screen_recording, assemble the spooled frames into an MP4 with ffmpeg using PER-FRAME durations from the ledger (frame N is held until frame N+1 painted; the last frame is held until this call), and return {path,bytes,durationMs,frameCount,encodedFrames,codec,encoder,width,height,droppedFrames,target}. Encoder ladder, probed once at start: hevc_videotoolbox then h264_videotoolbox then libx265 then libx264, with -tag:v hvc1 on HEVC so QuickTime plays it, +faststart, yuv420p, and even dimensions forced. With one recording in flight 'target' may be omitted; with several it is required, because guessing which to stop can lose another agent's recording. Throws if nothing is recording in this process, and throws rather than writing a silent empty video when 0 frames arrived. On an ffmpeg failure the spooled frames are KEPT and the spool path plus the exact command are named in the error. Encoded video tops out at 25 fps: ffmpeg's concat demuxer represents image timestamps on a 1/25s grid, so frames captured less than 40ms apart are coalesced deliberately (frameCount reports what was captured, encodedFrames what reached the video) instead of being dropped silently by ffmpeg. durationMs is the sum of the encoded durations; the file itself runs one 40ms step longer, because the concat demuxer needs the final frame repeated for its hold to count.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        lease: {
+          type: "string",
+          description: "Opaque lease token from claim_page. Required only when the tab this call resolves to is leased by someone; omit it for unleased tabs, which behave exactly as before."
+        },
+        target: {
+          type: "string",
+          description: "Which recording to stop: 'active' (default, valid only when exactly one recording is in flight) | 'index:N' | 'url:<substr>' | 'title:<substr>' | '<targetId>'."
+        },
+        savePath: {
+          type: "string",
+          description: "Override the output file path. Default: /tmp/cdp-toolkit/screen-recording-<targetIdShort>-<stamp>.mp4."
+        }
+      },
+      required: [],
+      additionalProperties: false
+    }
+  },
   {
     name: "take_heapsnapshot",
     description: "Capture a V8 heap snapshot of the selected page target over raw CDP (HeapProfiler.takeHeapSnapshot, accumulating addHeapSnapshotChunk events) and write it as a .heapsnapshot JSON file loadable by the DevTools Memory panel; returns {path,bytes,chunks,target} only and does not parse/summarize the snapshot. Writes under /tmp/cdp-toolkit (CDP_ARTIFACT_DIR) unless savePath is given.",
@@ -4241,11 +5083,42 @@ function buildSnapshotFunctionSource() {
 var MAX_NAME_LENGTH = 120;
 
 // src/bidi/driver.ts
+function normalizeBidiCookie(c) {
+  const value = c.value.type === "base64" ? Buffer.from(c.value.value, "base64").toString("utf8") : c.value.value;
+  const hasExpiry = typeof c.expiry === "number";
+  return {
+    name: c.name,
+    value,
+    domain: c.domain,
+    path: c.path,
+    expires: hasExpiry ? c.expiry : -1,
+    size: typeof c.size === "number" ? c.size : Buffer.byteLength(`${c.name}${value}`, "utf8"),
+    httpOnly: c.httpOnly === true,
+    secure: c.secure === true,
+    sameSite: c.sameSite ?? "default",
+    session: !hasExpiry
+  };
+}
+function hostFromUrl(url, toolName) {
+  if (url === undefined || url === "") {
+    throw driverError2("unsupported", `${toolName} on Firefox needs a 'domain': BiDi's storage cookie calls have no 'url' parameter, and no url was given to derive one from.`);
+  }
+  let host = "";
+  try {
+    host = new URL(url).hostname;
+  } catch {
+    throw driverError2("unsupported", `${toolName} could not parse the url '${url}' to derive the 'domain' BiDi requires. Pass 'domain' explicitly.`);
+  }
+  if (host === "") {
+    throw driverError2("unsupported", `${toolName} cannot derive a 'domain' from '${url}': that url has no host. Pass 'domain' explicitly.`);
+  }
+  return host;
+}
 function driverError2(code, message, data) {
   return Object.assign(new Error(message), { code, ...data !== undefined ? { data } : {} });
 }
-function encodeUid2(stamp5) {
-  return `bidi:${stamp5}`;
+function encodeUid2(stamp6) {
+  return `bidi:${stamp6}`;
 }
 function decodeStamp(uid) {
   if (!uid.startsWith("bidi:"))
@@ -4352,7 +5225,7 @@ function parseSnapshotLine(line) {
   const m = LINE_RE.exec(line);
   if (!m)
     return;
-  const indent = m[1] ?? "", stamp5 = m[2], role = m[3], nameLit = m[4], extrasRaw = m[5];
+  const indent = m[1] ?? "", stamp6 = m[2], role = m[3], nameLit = m[4], extrasRaw = m[5];
   const depth = indent.length / 2;
   let name;
   if (nameLit) {
@@ -4380,7 +5253,7 @@ function parseSnapshotLine(line) {
       extras[key] = val;
     }
   }
-  return { uid: encodeUid2(stamp5), role, depth, ...name !== undefined ? { name } : {}, ...Object.keys(extras).length ? { extras } : {} };
+  return { uid: encodeUid2(stamp6), role, depth, ...name !== undefined ? { name } : {}, ...Object.keys(extras).length ? { extras } : {} };
 }
 var INTERACTIVE_ROLES3 = new Set([
   "button",
@@ -4413,8 +5286,8 @@ function sharedRefOf(node, describe) {
 }
 async function resolveElementLocator2(conn, contextId, loc) {
   if ("uid" in loc) {
-    const stamp5 = decodeStamp(loc.uid);
-    const nodes2 = await locateNodes(conn, contextId, { type: "css", value: `[${UID_STAMP_ATTR}="${cssEscape(stamp5)}"]` });
+    const stamp6 = decodeStamp(loc.uid);
+    const nodes2 = await locateNodes(conn, contextId, { type: "css", value: `[${UID_STAMP_ATTR}="${cssEscape(stamp6)}"]` });
     if (!nodes2.length)
       throw driverError2("stale-uid", `uid does not resolve: ${loc.uid}`);
     return sharedRefOf(nodes2[0], loc.uid);
@@ -4626,14 +5499,14 @@ class BidiPageDriver {
       return loc.uid;
     }
     const ref = await resolveElementLocator2(this.conn, this.contextId, loc);
-    const stamp5 = await this.callFunctionValue(STAMP_ONE_SOURCE, [], ref);
-    if (typeof stamp5 !== "string")
+    const stamp6 = await this.callFunctionValue(STAMP_ONE_SOURCE, [], ref);
+    if (typeof stamp6 !== "string")
       throw driverError2("page-error", "stamping the located element did not return a string");
-    return encodeUid2(stamp5);
+    return encodeUid2(stamp6);
   }
   async resolve(uid) {
-    const stamp5 = decodeStamp(uid);
-    const nodes = await locateNodes(this.conn, this.contextId, { type: "css", value: `[${UID_STAMP_ATTR}="${cssEscape(stamp5)}"]` });
+    const stamp6 = decodeStamp(uid);
+    const nodes = await locateNodes(this.conn, this.contextId, { type: "css", value: `[${UID_STAMP_ATTR}="${cssEscape(stamp6)}"]` });
     if (!nodes.length)
       throw driverError2("stale-uid", `uid does not resolve: ${uid}`);
   }
@@ -4849,6 +5722,49 @@ class BidiPageDriver {
     }
     return this.handleOneDialog(accept, promptText, opts?.timeoutMs ?? 15000);
   }
+  async getCookies() {
+    try {
+      const { cookies } = await this.conn.send("storage.getCookies", { partition: { type: "context", context: this.contextId } });
+      return (cookies ?? []).map(normalizeBidiCookie);
+    } catch (e) {
+      throw mapBidiError(e);
+    }
+  }
+  async setCookie(params) {
+    const domain = params.domain ?? hostFromUrl(params.url, "set_cookie");
+    try {
+      await this.conn.send("storage.setCookie", {
+        cookie: {
+          name: params.name,
+          value: { type: "string", value: params.value },
+          domain,
+          ...params.path !== undefined ? { path: params.path } : {},
+          ...params.expires !== undefined ? { expiry: params.expires } : {},
+          ...params.httpOnly !== undefined ? { httpOnly: params.httpOnly } : {},
+          ...params.secure !== undefined ? { secure: params.secure } : {},
+          ...params.sameSite !== undefined ? { sameSite: params.sameSite } : {}
+        },
+        partition: { type: "context", context: this.contextId }
+      });
+    } catch (e) {
+      throw mapBidiError(e);
+    }
+  }
+  async deleteCookies(filter) {
+    const domain = filter.domain ?? hostFromUrl(filter.url, "delete_cookies");
+    try {
+      await this.conn.send("storage.deleteCookies", {
+        filter: {
+          name: filter.name,
+          domain,
+          ...filter.path !== undefined ? { path: filter.path } : {}
+        },
+        partition: { type: "context", context: this.contextId }
+      });
+    } catch (e) {
+      throw mapBidiError(e);
+    }
+  }
   async startBodyCapture() {
     let collector;
     try {
@@ -5019,11 +5935,11 @@ function createFirefoxDriver(port, opts) {
 }
 
 // src/bidi/launch.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 import { mkdtempSync, rmSync } from "node:fs";
 import { createConnection, createServer } from "node:net";
 import { tmpdir } from "node:os";
-import { join as join5 } from "node:path";
+import { join as join7 } from "node:path";
 function resolveBinary() {
   const candidates = [
     process.env.FIREFOX_BIN,
@@ -5097,11 +6013,11 @@ async function launchFirefox(opts = {}) {
   const binary = resolveBinary();
   const port = await pickPort(opts.port);
   const isThrowaway = opts.profilePath === undefined;
-  const profilePath = opts.profilePath ?? mkdtempSync(join5(tmpdir(), "cdp-toolkit-ff-profile-"));
+  const profilePath = opts.profilePath ?? mkdtempSync(join7(tmpdir(), "cdp-toolkit-ff-profile-"));
   const args = ["--profile", profilePath, "--remote-debugging-port", String(port), "--no-remote"];
   if (opts.headless)
     args.push("--headless");
-  const proc = spawn2(binary, args, { stdio: "ignore", detached: false });
+  const proc = spawn3(binary, args, { stdio: "ignore", detached: false });
   let closed = false;
   const close = async () => {
     if (closed)
@@ -5367,7 +6283,7 @@ var FIREFOX_TOOLS = {
 };
 
 // src/mcp.ts
-var VERSION = "1.2.0";
+var VERSION = "1.6.0";
 var BROWSER = resolveBrowserKind(stripBrowserFlag(process.argv.slice(2)));
 var AVAILABILITY = toolAvailability(BROWSER);
 var AVAILABLE_NAMES = new Set(AVAILABILITY.available);