human grants a scope for a bounded duration
                  ↓
site command declares read or write intent
                  ↓
gate checks scope and expiry
        ├── denied or expired → stop before protected session use
        └── allowed
                  ↓
prefer the managed profile's live login session
        ├── live cookies present → continue with current browser state
        └── empty jar → use the protected snapshot as bootstrap
                  ↓
run the declared page command

monosurf auth grant read 1h
monosurf auth grant write 30m
monosurf auth grant full 2h

monosurf auth revoke read
monosurf auth revoke all
monosurf auth status

monosurf login x --profile work

monosurf bridge install
monosurf bridge example.com       # add --keep for repeated Sync clicks

plugin command
      ↓
check declared read/write scope
      ↓
connect to the selected profile
      ↓
verify that the managed CDP listener owns this profile's user-data directory
      ↓
query live cookies for the target domain
      ├── present → use them; skip snapshot
      └── absent  → read snapshot through the gate and hydrate the jar
      ↓
navigate and run the plugin command

managed Chromium profile
    └── live cookies, local storage, saved browser state

OpenCLIs vault (preferred) or legacy secure fallback
    └── login snapshots and other protected MonoSurf secret keys

auth gate state
    └── scope, grant time, expiry time; no site cookie values

MonoPass companion
    └── passkeys and WebAuthn/FIDO2 ceremonies outside the cookie-snapshot model

Monolex Agent Browser
    └── same-profile managed login when complete browser state must stay together

monosurf auth status