feat(browse): add geolocation CDP override methods to allowlist

[cl0ckt0wer]

Summary

Adds Emulation.setGeolocationOverride and Emulation.clearGeolocationOverride to the CDP allowlist, enabling GPS/geolocation coordinate simulation via the browse daemon.

Why

Testing location-aware web apps (maps, GPS trackers, proximity search) currently requires a separate Playwright script because the browse daemon blocks all CDP methods by default (deny-default posture). Geolocation override has the same threat profile as the already-allowed Emulation.setDeviceMetricsOverride: pure input to the active tab, no data exfiltration surface.

What changed

• browse/src/cdp-allowlist.ts — added 2 entries under the Emulation section:
  • Emulation.setGeolocationOverride (tab, trusted) — sets geolocation coordinates for the active tab
  • Emulation.clearGeolocationOverride (tab, trusted) — clears the override, mirrors clearDeviceMetricsOverride
• Added a NOTE documenting that Browser.grantPermissions cannot work through the page-scoped CDPSession and needs a separate browser-scope routing path in the future

Usage

# Set geolocation to London
$B cdp Emulation.setGeolocationOverride '{"latitude":51.5074,"longitude":-0.1278,"accuracy":10}'

# Clear override
$B cdp Emulation.clearGeolocationOverride '{}'

Known limitation

Full end-to-end GPS testing (permission grant + coordinate override) still requires either:

1. A Playwright script that creates a context with permissions: ['geolocation'] and geolocation: {...}, or
2. A future browser-scope CDP routing path in the bridge that can forward Browser.grantPermissions

The setGeolocationOverride alone overrides coordinates when geolocation permission is already granted (e.g., after user interaction or via a Playwright-launched context).

Testing

All 6 existing CDP allowlist tests pass (199 expect calls). No new tests needed — existing test suite validates that every entry has required fields, no duplicates exist, and the deny-default posture is maintained.

bun test browse/test/cdp-allowlist.test.ts
 6 pass  0 fail  199 expect() calls

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews