feat!: harden raw browser control and packaging

- Add safe-by-default policy gates for raw command surfaces: command, script, and serve-http /command.

- Require explicit opt-ins for page reads, browser control, and high-risk commands such as dom.eval, storage.*, and screenshots.

- Remove all cookies support from CLI, SDK, extension commands, permissions, constants, docs, and tests.

- Add diagnostic, events, watch, workspace, remote, raw command, script, HTTP gateway, tree-view, session import/export, and extension info/capability commands.

- Add Chrome Web Store packaging that strips manifest.key while keeping local packages with a stable native-messaging extension ID.

- Bump browser-cli and extension version to 0.14.1 and cover the new behavior with pytest and extension packaging tests.

BREAKING CHANGE: cookies commands and the b.cookies SDK namespace have been removed; generic raw command execution now blocks non-safe commands unless explicitly allowed.

extension/src/commands/session.ts

@@ -3,7 +3,7 @@ import { CommandGroup } from '../classes/CommandGroup';
 import { AutoSaveManager } from './autosave';
 import { captureCurrentSession } from './session-snapshot';
 import type { CommandEntry } from '../classes/CommandGroup';
-import type { LazySessionMap, SessionSaveArgs, SessionRemoveArgs, SessionDiffArgs, SessionLoadArgs, SessionAutoSaveArgs, ClientsRenameProfileArgs } from '../types';
+import type { Json, LazySessionMap, SessionSaveArgs, SessionRemoveArgs, SessionDiffArgs, SessionImportArgs, SessionLoadArgs, SessionAutoSaveArgs, ClientsRenameProfileArgs, StoredSession } from '../types';
 
 function lazyPlaceholderUrl(url: string) {
   const escaped = String(url).replace(/[&<>"']/g, ch => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", "\"": "&quot;", "'": "&#39;" }[ch]));
@@ -19,6 +19,8 @@ export class SessionCommands extends CommandGroup {
     "session.list":      () => this.sessionList(),
     "session.remove":    (a: SessionRemoveArgs) => this.sessionRemove(a),
     "session.diff":      (a: SessionDiffArgs) => this.sessionDiff(a),
+    "session.export":    (a: SessionSaveArgs) => this.sessionExport(a),
+    "session.import":    (a: SessionImportArgs) => this.sessionImport(a),
     "session.auto_save": (a: SessionAutoSaveArgs) => this.autoSaveManager.setEnabled(Boolean(a.enabled)),
     "clients.list":           () => this.clientsList(),
     "clients.rename_profile": (a: ClientsRenameProfileArgs) => this.clientsRenameProfile(a),
@@ -131,6 +133,31 @@ export class SessionCommands extends CommandGroup {
     };
   }
 
+  private async sessionExport({ name }: SessionSaveArgs) {
+    const sessions = await getSessions();
+    if (!name) return { sessions };
+    const session = sessions[name];
+    if (!session) throw new Error(`Session '${name}' not found`);
+    return { name, session };
+  }
+
+  private isSession(value: Json | undefined): boolean {
+    if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+    const candidate = value as object as StoredSession;
+    return Array.isArray(candidate.tabs) || Array.isArray(candidate.urls);
+  }
+
+  private async sessionImport({ name, session, overwrite = false }: SessionImportArgs) {
+    if (!name) throw new Error("Session name is required");
+    if (!this.isSession(session)) throw new Error("Session payload must contain tabs or urls");
+    const sessions = await getSessions();
+    if (!overwrite && sessions[name]) throw new Error(`Session '${name}' already exists`);
+    const stored = session as object as StoredSession;
+    sessions[name] = { ...stored, savedAt: Number(stored.savedAt) || Date.now() };
+    await chrome.storage.local.set({ sessions });
+    return { name, tabs: getSessionTabs(sessions[name]).length };
+  }
+
   private async clientsList() {
     const manifest = chrome.runtime.getManifest();
     const alias = await getProfileAlias();