withCdpSession (src/cdp-bridge.ts)

Provides CDP session helpers and dispatch for Playwright‑based browser automation.

// Source: https://github.com/garrytan/gstack | License: MIT | Copyright 2026 Garry Tan
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * CDP escape hatch — `$B cdp <Domain.method> [json-params]`.
 *
 * Path A from the spike: uses Playwright's newCDPSession() per page so we
 * piggyback Playwright's own CDP socket (no second WebSocket, no need for
 * --remote-debugging-port).
 *
 * Security posture (Codex T2):
 *   - DENY-DEFAULT. Methods must be explicitly listed in cdp-allowlist.ts.
 *   - Each entry is tagged scope (tab|browser) and output (trusted|untrusted).
 *
 * Concurrency posture (Codex T7):
 *   - Two-tier lock from browser-manager.ts.
 *   - tab-scoped methods take the per-tab mutex.
 *   - browser-scoped methods take the global lock that blocks all tab mut

... (truncated -- full source via MCP)