Feature/webview cdp proxy

[Drew-Goddyn]

Summary

• Add a per-webview CDP proxy so web widgets can be remotely controlled/debugged via CDP without exposing a global Electron debug port.
• Improve CLI UX: wsh web cdp lists web widgets, wsh web open --cdp creates + enables in one step (with a short retry for webview readiness).
• Add a clear UI indicator for CDP-enabled widgets (CONTROLLED badge + amber border).

Guardrails / Security

• Explicit opt-in: debug:webcdp=true is required; otherwise wsh web cdp start fails with a clear error.
• Local-only: CDP proxy always binds to 127.0.0.1 (no non-loopback listen option).
• Secret-prefixed endpoints: /__wave_cdp/<secret>/... for WS and /json/list to reduce accidental discovery; root /json/list returns 404.
• Idle timeout: default 5 minutes (configurable via CLI) with auto-stop logging.
• Auditability: start/stop and auto-stop reasons logged in Electron main.
• Global Electron remote debugging: debug:remotedebugport validated (1–65535) and bound to loopback.

UX Details

• wsh web cdp shows web widgets in the current workspace with CDP status + WS URL if active.
• wsh web cdp start without -b uses the current web block if possible; otherwise it lists web widgets and hints to use -b.
• wsh web open --cdp (or -c) creates a web widget and starts CDP; includes a brief retry to handle async WebContents creation.
• Web widgets with active CDP show a CONTROLLED badge and amber highlight.

Testing

• go test ./cmd/wsh/cmd
• go build ./cmd/wsh
• Manual:
  • verify debug:webcdp gate
  • wsh web cdp listing
  • wsh web open --cdp success
  • CDP active indicator appears/disappears
  • secret-prefixed /json/list works; root /json/list 404s

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}