@weavetab/mcp 2.5.0-beta.0 → 2.5.0-beta.2

package/dist/cdp/lock.js

@@ -10,49 +10,56 @@ import * as path from "node:path";
 import * as os from "node:os";
 import * as net from "node:net";
 import { lock } from "proper-lockfile";
+import { sanitizeAppName } from "./profiles.js";
 const LOCK_DIR = path.join(os.homedir(), ".weavetab-system", "locks");
-const LOCK_FILE = path.join(LOCK_DIR, ".weavetab.lock");
-const MUTEX_FILE = path.join(LOCK_DIR, ".weavetab.lock.mutex");
-// ─── In-process serialization queue ──────────────────────────────────────────
-// When multiple MCP tool calls run in parallel inside the same Node process they
-// all race to acquireMutex() simultaneously. The OS-level proper-lockfile handles
-// cross-process contention, but within the same process concurrent callers share
-// the same lockfile handle and can trigger "Lock is already released" errors.
-// This queue serializes callers at the JS level before they touch the filesystem.
-let _inProcessMutexQueue = Promise.resolve();
-// Re-entrancy tracking. getOrConnect() acquires the mutex and then calls
-// launchWithBridge(), which internally calls writeLock() → acquireMutex()
-// again (nested). The serialization queue would block the nested call on the
-// outer slot, which only releases after the launch finishes — a self-deadlock.
-// Track how many regions this process currently holds and only touch the OS
-// file lock + queue slot on the outermost acquisition / release.
-let _heldDepth = 0;
-let _heldFileRelease = null;
-let _heldSlotResolve = null;
-async function acquireMutex() {
-    // Re-entrant fast path: this process already holds the mutex.
-    if (_heldDepth > 0) {
-        _heldDepth++;
+export function getLockFilePath(appName) {
+    if (appName && appName.trim()) {
+        return path.join(LOCK_DIR, `.weavetab.electron.${sanitizeAppName(appName)}.lock`);
+    }
+    return path.join(LOCK_DIR, ".weavetab.lock");
+}
+export function getMutexFilePath(appName) {
+    if (appName && appName.trim()) {
+        return path.join(LOCK_DIR, `.weavetab.electron.${sanitizeAppName(appName)}.lock.mutex`);
+    }
+    return path.join(LOCK_DIR, ".weavetab.lock.mutex");
+}
+// ─── In-process serialization queues per app/browser ──────────────────────────
+const _inProcessQueues = new Map();
+const _heldDepths = new Map();
+const _heldFileReleases = new Map();
+const _heldSlotResolves = new Map();
+function getTargetKey(appName) {
+    return appName && appName.trim() ? `electron:${sanitizeAppName(appName)}` : "browser";
+}
+async function acquireMutex(appName) {
+    const key = getTargetKey(appName);
+    const currentDepth = _heldDepths.get(key) ?? 0;
+    // Re-entrant fast path: this process already holds the mutex for this target.
+    if (currentDepth > 0) {
+        _heldDepths.set(key, currentDepth + 1);
         return async () => {
-            _heldDepth--;
+            const d = (_heldDepths.get(key) ?? 1) - 1;
+            _heldDepths.set(key, Math.max(0, d));
         };
     }
-    // Enqueue this caller — it will only proceed once all prior callers finish.
+    // Enqueue this caller for this specific key
     let resolveSlot;
     const slot = new Promise(resolve => { resolveSlot = resolve; });
-    const prevQueue = _inProcessMutexQueue;
-    _inProcessMutexQueue = _inProcessMutexQueue.then(() => slot);
-    await prevQueue; // Wait for all prior callers to fully release
+    const prevQueue = _inProcessQueues.get(key) ?? Promise.resolve();
+    _inProcessQueues.set(key, prevQueue.then(() => slot));
+    await prevQueue; // Wait for all prior callers for this key to fully release
     fs.mkdirSync(LOCK_DIR, { recursive: true });
-    if (!fs.existsSync(MUTEX_FILE)) {
+    const mutexFile = getMutexFilePath(appName);
+    if (!fs.existsSync(mutexFile)) {
         try {
-            fs.writeFileSync(MUTEX_FILE, String(process.pid), "utf-8");
+            fs.writeFileSync(mutexFile, String(process.pid), "utf-8");
         }
         catch { /* race/non-fatal */ }
     }
     let fileRelease = null;
     try {
-        fileRelease = await lock(MUTEX_FILE, {
+        fileRelease = await lock(mutexFile, {
             retries: {
                 retries: 25,
                 minTimeout: 200,
@@ -62,28 +69,29 @@ async function acquireMutex() {
         });
         // Write current PID to mutex file for diagnostics/HUD
         try {
-            fs.writeFileSync(MUTEX_FILE, String(process.pid), "utf-8");
+            fs.writeFileSync(mutexFile, String(process.pid), "utf-8");
         }
         catch { /* non-fatal */ }
     }
     catch (err) {
         resolveSlot(); // Unblock the queue even on failure
-        throw new Error(`[Weavetab] Could not acquire launch mutex after retries: ${err?.message || err}`);
+        throw new Error(`[Weavetab] Could not acquire launch mutex for ${key} after retries: ${err?.message || err}`);
     }
     // Mark this process as the current holder so nested calls skip the queue.
-    _heldDepth = 1;
-    _heldFileRelease = fileRelease;
-    _heldSlotResolve = resolveSlot;
+    _heldDepths.set(key, 1);
+    _heldFileReleases.set(key, fileRelease);
+    _heldSlotResolves.set(key, resolveSlot);
     // Return a release function that releases both the file lock and the in-process slot
     return async () => {
-        _heldDepth--;
-        if (_heldDepth > 0)
+        const d = (_heldDepths.get(key) ?? 1) - 1;
+        _heldDepths.set(key, Math.max(0, d));
+        if (d > 0)
             return; // nested regions still active
-        _heldDepth = 0;
-        const rel = _heldFileRelease;
-        const slotResolve = _heldSlotResolve;
-        _heldFileRelease = null;
-        _heldSlotResolve = null;
+        _heldDepths.delete(key);
+        const rel = _heldFileReleases.get(key);
+        const slotResolve = _heldSlotResolves.get(key);
+        _heldFileReleases.delete(key);
+        _heldSlotResolves.delete(key);
         try {
             if (rel)
                 await rel();
@@ -94,44 +102,49 @@ async function acquireMutex() {
     };
 }
 // ─── Public API ───────────────────────────────────────────────────────────────
-export async function writeLockSafe(data) {
-    const release = await acquireMutex();
+export async function writeLockSafe(data, appName) {
+    const targetApp = appName || data.appName;
+    const release = await acquireMutex(targetApp);
+    const lockFile = getLockFilePath(targetApp);
     try {
         fs.mkdirSync(LOCK_DIR, { recursive: true });
-        fs.writeFileSync(LOCK_FILE, JSON.stringify(data, null, 2), "utf-8");
+        fs.writeFileSync(lockFile, JSON.stringify(data, null, 2), "utf-8");
     }
     finally {
         await release();
     }
 }
-export async function writeLock(data) {
-    await writeLockSafe(data);
+export async function writeLock(data, appName) {
+    await writeLockSafe(data, appName);
 }
-export function readLock() {
-    if (!fs.existsSync(LOCK_FILE))
+export function readLock(appName) {
+    const lockFile = getLockFilePath(appName);
+    if (!fs.existsSync(lockFile))
         return null;
     try {
-        return JSON.parse(fs.readFileSync(LOCK_FILE, "utf-8"));
+        return JSON.parse(fs.readFileSync(lockFile, "utf-8"));
     }
     catch {
         return null;
     }
 }
-export function clearLock() {
+export function clearLock(appName) {
+    const lockFile = getLockFilePath(appName);
+    const mutexFile = getMutexFilePath(appName);
     try {
-        if (fs.existsSync(LOCK_FILE))
-            fs.unlinkSync(LOCK_FILE);
+        if (fs.existsSync(lockFile))
+            fs.unlinkSync(lockFile);
     }
     catch (e) {
         logDebug(`[Weavetab] [!] Failed to clear lock file: ${e}`);
     }
     try {
-        if (fs.existsSync(MUTEX_FILE))
-            fs.unlinkSync(MUTEX_FILE);
+        if (fs.existsSync(mutexFile))
+            fs.unlinkSync(mutexFile);
     }
     catch { /* ignore */ }
     try {
-        const lockDir = MUTEX_FILE + ".lock";
+        const lockDir = mutexFile + ".lock";
         if (fs.existsSync(lockDir))
             fs.rmSync(lockDir, { recursive: true, force: true });
     }
@@ -142,14 +155,14 @@ export function clearLock() {
  * Prevents a second MCP server instance from wiping the first instance's browser lock
  * during its retry loop, which would allow a race condition where two browsers spawn.
  */
-export function clearLockIfOwned() {
+export function clearLockIfOwned(appName) {
     try {
-        const lock = readLock();
+        const lock = readLock(appName);
         if (!lock || lock.pid !== process.pid) {
             logDebug(`[Weavetab] clearLockIfOwned: skipping — lock owned by PID ${lock?.pid ?? 'none'}, this PID is ${process.pid}`);
             return;
         }
-        clearLock();
+        clearLock(appName);
     }
     catch (e) {
         logDebug(`[Weavetab] clearLockIfOwned error: ${e}`);

package/dist/cdp/omni_broker.d.ts

@@ -14,4 +14,5 @@ export declare function initOmniBroker(parentSession: CDP.Client, parentTargetId
  * Executes a CDP command across all known iframe contexts if it fails in the top-level context.
  */
 export declare function omniEvaluate(parentSession: CDP.Client, parentTargetId: string, expression: string, returnByValue?: boolean): Promise<any>;
+export declare function getOmniSessions(parentTargetId: string): Map<string, CDP.Client> | undefined;
 export declare function cleanupOmniBroker(parentTargetId: string): void;

package/dist/cdp/omni_broker.js

@@ -20,13 +20,16 @@ export async function initOmniBroker(parentSession, parentTargetId, port) {
     }
     parentSession.Target.on("attachedToTarget", async (event) => {
         const { targetInfo } = event;
-        if (targetInfo.type === 'iframe') {
+        if (targetInfo && targetInfo.targetId !== parentTargetId && (targetInfo.type === 'iframe' || targetInfo.type === 'webview' || targetInfo.type === 'page' || targetInfo.type === 'app')) {
             try {
-                // Connect a flat session to the iframe target
-                const iframeSession = await CDP({ host: "127.0.0.1", port, target: targetInfo.targetId });
-                await iframeSession.Runtime.enable();
-                await iframeSession.DOM.enable();
-                omniSessions.get(parentTargetId).set(targetInfo.targetId, iframeSession);
+                // Connect a flat session to the child iframe/webview target
+                const childSession = await CDP({ host: "127.0.0.1", port, target: targetInfo.targetId });
+                await Promise.all([
+                    childSession.Runtime.enable().catch(() => { }),
+                    childSession.DOM.enable().catch(() => { }),
+                    childSession.Page.enable().catch(() => { })
+                ]);
+                omniSessions.get(parentTargetId).set(targetInfo.targetId, childSession);
             }
             catch (e) {
                 // Fallback or ignore
@@ -105,6 +108,9 @@ function parseJSON(str) {
         return str;
     }
 }
+export function getOmniSessions(parentTargetId) {
+    return omniSessions.get(parentTargetId);
+}
 export function cleanupOmniBroker(parentTargetId) {
     const iframeMap = omniSessions.get(parentTargetId);
     if (iframeMap) {

package/dist/cdp/profiles.d.ts

@@ -1 +1,11 @@
 export declare function getSessionProfile(cookies: boolean, customProfileDir?: string, syncDataAcrossBrowsers?: boolean, browserPath?: string): string;
+export declare function sanitizeAppName(appName: string): string;
+/**
+ * Asserts that the given profile directory is NOT a real desktop app's native user data directory.
+ * Throws a security block error if it matches root or subdirectory of standard app data paths.
+ */
+export declare function assertNotRealElectronProfile(profileDir: string, appName: string): void;
+/**
+ * Resolves the isolated profile directory for a specific Electron application.
+ */
+export declare function getElectronProfile(appName: string, customProfileDir?: string): string;

package/dist/cdp/profiles.js

@@ -85,3 +85,68 @@ export function getSessionProfile(cookies, customProfileDir, syncDataAcrossBrows
     }
     return sessionProfile;
 }
+// ─── Electron App Profile Resolver & Safety Guard ─────────────────────────────
+export function sanitizeAppName(appName) {
+    const cleaned = appName.trim().replace(/[^a-zA-Z0-9_-]/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").toLowerCase();
+    return cleaned || "app";
+}
+// Real application data directories that should NEVER be used directly
+const REAL_DESKTOP_APP_ROOTS = [];
+if (PLATFORM === 'win32') {
+    REAL_DESKTOP_APP_ROOTS.push(path.join(HOME, "AppData", "Roaming"), path.join(HOME, "AppData", "Local"), path.join(HOME, "AppData", "LocalLow"));
+}
+else if (PLATFORM === 'darwin') {
+    REAL_DESKTOP_APP_ROOTS.push(path.join(HOME, "Library", "Application Support"), path.join(HOME, "Library", "Saved Application State"), path.join(HOME, "Library", "Caches"));
+}
+else {
+    REAL_DESKTOP_APP_ROOTS.push(path.join(HOME, ".config"), path.join(HOME, ".local", "share"), path.join(HOME, ".cache"));
+}
+/**
+ * Asserts that the given profile directory is NOT a real desktop app's native user data directory.
+ * Throws a security block error if it matches root or subdirectory of standard app data paths.
+ */
+export function assertNotRealElectronProfile(profileDir, appName) {
+    const resolved = path.resolve(profileDir).toLowerCase();
+    // First check against browser profiles
+    assertNotRealBrowserProfile(resolved);
+    // Check against native desktop app data roots
+    for (const rootPath of REAL_DESKTOP_APP_ROOTS) {
+        const rootResolved = path.resolve(rootPath).toLowerCase();
+        // Direct matches or direct children in %APPDATA%/<appName>
+        const appSpecificRealDir = path.join(rootResolved, sanitizeAppName(appName)).toLowerCase();
+        if (resolved === appSpecificRealDir || resolved.startsWith(appSpecificRealDir + path.sep)) {
+            throw new Error(`[Weavetab] ✗ SECURITY BLOCK: The profileDir "${profileDir}" points to your real ${appName} desktop app data.\n` +
+                `  Weavetab will never read from or write to your personal desktop app data.\n` +
+                `  Please use an isolated directory or let Weavetab manage ~/.weavetab-system/apps/${appName}/.\n` +
+                `  Real app data path detected: ${appSpecificRealDir}`);
+        }
+    }
+}
+/**
+ * Resolves the isolated profile directory for a specific Electron application.
+ */
+export function getElectronProfile(appName, customProfileDir) {
+    const sanitized = sanitizeAppName(appName);
+    if (customProfileDir && customProfileDir.trim()) {
+        const resolved = path.resolve(customProfileDir.trim());
+        assertNotRealElectronProfile(resolved, appName);
+        if (!fs.existsSync(resolved)) {
+            fs.mkdirSync(resolved, { recursive: true });
+            logDebug(`[Weavetab] ✓ Created custom Electron profile directory for ${appName}: ${resolved}`);
+        }
+        else {
+            logDebug(`[Weavetab] ✓ Using custom Electron profile directory for ${appName}: ${resolved}`);
+        }
+        return resolved;
+    }
+    const appProfileDir = path.join(HOME, ".weavetab-system", "apps", sanitized);
+    assertNotRealElectronProfile(appProfileDir, appName);
+    if (!fs.existsSync(appProfileDir)) {
+        fs.mkdirSync(appProfileDir, { recursive: true });
+        logDebug(`[Weavetab] ✓ Created isolated Electron profile directory for ${appName}: ${appProfileDir}`);
+    }
+    else {
+        logDebug(`[Weavetab] ✓ Using isolated Electron profile directory for ${appName}: ${appProfileDir}`);
+    }
+    return appProfileDir;
+}

package/dist/cdp/walker.js

@@ -387,6 +387,56 @@ export async function buildActionMap(session, options = {}, targetId = "default"
             }
         }
     }
+    // Merge elements from child webviews and iframes managed by OmniBroker
+    try {
+        const { getOmniSessions } = await import("./omni_broker.js");
+        const childSessions = getOmniSessions(targetId);
+        if (childSessions && childSessions.size > 0) {
+            for (const [, childSession] of childSessions.entries()) {
+                try {
+                    const { result: childResult } = await childSession.Runtime.evaluate({
+                        expression: `(function() {
+              var INTERACTIVE_SEL = 'a, button, input, textarea, select, [role="button"], [role="link"], [role="textbox"], [role="checkbox"], [role="radio"], [role="combobox"], [role="searchbox"], [role="menuitem"], [role="tab"], [contenteditable="true"], [tabindex]:not([tabindex="-1"])';
+              var els = document.querySelectorAll(INTERACTIVE_SEL);
+              var results = [];
+              for (var i = 0; i < els.length; i++) {
+                var el = els[i];
+                var rect = el.getBoundingClientRect();
+                if (rect.width === 0 || rect.height === 0 || rect.bottom < 0 || rect.top > window.innerHeight) continue;
+                var id = el.getAttribute('data-wt-id');
+                if (!id) {
+                  id = 'wv_' + Math.random().toString(36).slice(2, 9);
+                  el.setAttribute('data-wt-id', id);
+                }
+                results.push({
+                  id: id,
+                  role: el.getAttribute('role') || el.tagName.toLowerCase(),
+                  label: el.getAttribute('aria-label') || el.innerText || el.value || el.placeholder || '',
+                  value: el.value,
+                  x: Math.round(rect.left + rect.width / 2),
+                  y: Math.round(rect.top + rect.height / 2),
+                  selector: '[data-wt-id="' + id + '"]',
+                  frameUrl: window.location.href,
+                });
+              }
+              return JSON.stringify(results);
+            })()`,
+                        returnByValue: true,
+                    });
+                    if (childResult && childResult.value) {
+                        const childEls = JSON.parse(childResult.value);
+                        if (Array.isArray(childEls) && childEls.length > 0) {
+                            if (!Array.isArray(extensionMap))
+                                extensionMap = [];
+                            extensionMap = extensionMap.concat(childEls);
+                        }
+                    }
+                }
+                catch { }
+            }
+        }
+    }
+    catch { }
     if (!extensionMap || !Array.isArray(extensionMap)) {
         return { url, title, elements: [], targetId };
     }

package/dist/cli/plugin.d.ts

@@ -4,6 +4,4 @@ export declare function runPluginSearch(query?: string): Promise<void>;
 export declare function runPluginBrowse(): Promise<void>;
 export declare function runPluginRemove(pkgName: string, args?: string[]): Promise<void>;
 export declare function runPluginVerify(pkgName: string): Promise<void>;
-export declare function runPluginInit(args?: string[]): Promise<void>;
-export declare function runPluginBuild(args?: string[]): Promise<void>;
 export declare function runPluginCli(args: string[]): Promise<void>;