Summary

• Add a per-webview CDP proxy so web widgets can be remotely controlled/debugged via CDP without exposing a global Electron debug port.
• Improve CLI UX: wsh web cdp lists web widgets, wsh web open --cdp creates + enables in one step (with a short retry for webview readiness).
• Add a clear UI indicator for CDP-enabled widgets (CONTROLLED badge + amber border).

Guardrails / Security

• Explicit opt-in: debug:webcdp=true is required; otherwise wsh web cdp start fails with a clear error.
• Local-only: CDP proxy always binds to 127.0.0.1 (no non-loopback listen option).
• Secret-prefixed endpoints: /__wave_cdp/<secret>/... for WS and /json/list to reduce accidental discovery; root /json/list returns 404.
• Idle timeout: default 5 minutes (configurable via CLI) with auto-stop logging.
• Auditability: start/stop and auto-stop reasons logged in Electron main.
• Global Electron remote debugging: debug:remotedebugport validated (1–65535) and bound to loopback.

UX Details

• wsh web cdp shows web widgets in the current workspace with CDP status + WS URL if active.
• wsh web cdp start without -b uses the current web block if possible; otherwise it lists web widgets and hints to use -b.
• wsh web open --cdp (or -c) creates a web widget and starts CDP; includes a brief retry to handle async WebContents creation.
• Web widgets with active CDP show a CONTROLLED badge and amber highlight.

Testing

• go test ./cmd/wsh/cmd
• go build ./cmd/wsh
• Manual:
  • verify debug:webcdp gate
  • wsh web cdp listing
  • wsh web open --cdp success
  • CDP active indicator appears/disappears
  • secret-prefixed /json/list works; root /json/list 404s