refactor: one door from a tool to the browser

Four routes coexisted: cdpCall, a raw client.session().call, a session
held in a local and called directly, and client.evaluateJs — and five
files mixed two or three of them. The CdpError-to-ToolErr mapping was
hand-copied at nine sites, plus a private copy in isolated-tab.ts.

domains/cdp-call.ts now owns all of it: cdpErrToToolErr, cdpCall,
cdpCallOnTarget, cdpCallBrowser, evalJs. Every other file under
src/domains goes through them, which also removes a pile of
`if (!r.success) return err({ kind: "cdp_error", ... })` boilerplate in
favour of returning the failed Result as-is.

Two scanner rules keep it that way, scoped to src/domains/ so the layer
that legitimately owns the session — cdp/ and client.ts — is unaffected.
Scoping is new to the rule model; without it the rules fired on the
transport itself.

One deliberate behaviour change: a CDP timeout now surfaces as
kind "timeout" rather than "cdp_error". isolated-tab.ts already did this
and the other 13 sites flattened it; the shared mapper uses the honest
label rather than preserving the mislabel.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 13 insertions, 0 deletions

diff --git a/scripts/boundary-allowlist.ts b/scripts/boundary-allowlist.ts
index bb34139..512aa40 100644
--- a/scripts/boundary-allowlist.ts
+++ b/scripts/boundary-allowlist.ts
@@ -42,6 +42,19 @@ export const ALLOWLIST: ReadonlyArray<Exemption> = [
       "renderCall is stored under a per-tool Static<S> but invoked through the erased TSchema form; the generic-correlation limit makes this unavoidable and the value is the tool's own handler, created with the same S",
   },
   {
+    path: "src/domains/cdp-call.ts",
+    rule: "raw-cdp-call",
+    count: 3,
+    reason:
+      "the one door from a tool to CDP: cdpCall, cdpCallOnTarget and cdpCallBrowser each reach the session once and map CdpError to ToolErr, so no other file under src/domains needs to",
+  },
+  {
+    path: "src/domains/cdp-call.ts",
+    rule: "raw-evaluate",
+    count: 1,
+    reason: "evalJs is the single wrapper over client.evaluateJs, for the same reason",
+  },
+  {
     path: "src/domains/js.ts",
     rule: "trailing-cast",
     count: 1,