@weavetab/mcp 2.5.0-beta.0

package/dist/cdp/ref_cache.js

@@ -0,0 +1,234 @@
+/**
+ * Weavetab — cdp/ref_cache.ts
+ * Unified Ref Coordinate Cache (URC)
+ *
+ * Single in-memory, per-tab store of refId → {selector, x, y, backendNodeId, fingerprint}
+ * populated once by buildActionMap/buildAXTreeMap and read by every interaction tool.
+ *
+ * Design goals:
+ * - Zero extra CDP calls on cache hit (< TTL)
+ * - One atomic Runtime.evaluate on stale/miss (atomicResolve)
+ * - Keyed strictly by targetId (frame-scoped) — iframe contexts never bleed
+ * - Auto-invalidated on frameNavigated
+ *
+ * Weavetab by fy2ne
+ */
+// ─── Storage ──────────────────────────────────────────────────────────────────
+/** Per-tab: Map<targetId, Map<refId, RefCoordEntry>> */
+const store = new Map();
+/** Default TTL: 30 seconds. Overridden by config.refCacheTtlMs at call sites. */
+export const DEFAULT_URC_TTL_MS = 30_000;
+// ─── Stale-miss counters (foundation for adaptive TTL — Q3 follow-up) ─────────
+const staleMissCounters = new Map();
+function recordStaleMiss(hostname) {
+    const now = Date.now();
+    const entry = staleMissCounters.get(hostname) ?? { count: 0, lastDecayAt: now };
+    // Decay: halve the counter every 5 minutes
+    const decayIntervals = Math.floor((now - entry.lastDecayAt) / (5 * 60_000));
+    if (decayIntervals > 0) {
+        entry.count = Math.floor(entry.count / Math.pow(2, decayIntervals));
+        entry.lastDecayAt = now;
+    }
+    entry.count += 1;
+    staleMissCounters.set(hostname, entry);
+}
+// Sweep staleMissCounters entries that have decayed to 0 so hostnames don't
+// accumulate indefinitely. Runs every 10 minutes via an unref'd interval.
+setInterval(() => {
+    const now = Date.now();
+    for (const [hostname, entry] of staleMissCounters.entries()) {
+        const decayIntervals = Math.floor((now - entry.lastDecayAt) / (5 * 60_000));
+        const decayed = decayIntervals > 0
+            ? Math.floor(entry.count / Math.pow(2, decayIntervals))
+            : entry.count;
+        if (decayed <= 0)
+            staleMissCounters.delete(hostname);
+    }
+}, 10 * 60_000).unref();
+/** Returns stale miss rate [0–1] for the last observation window. */
+export function getStaleMissRate(hostname) {
+    const entry = staleMissCounters.get(hostname);
+    if (!entry)
+        return 0;
+    // Simple heuristic: count > 5 within the window → elevated stale rate
+    return Math.min(1, entry.count / 20);
+}
+// ─── Public API ───────────────────────────────────────────────────────────────
+/** Write an entry into the URC for a given tab and refId. */
+export function urcSet(targetId, refId, entry) {
+    if (!store.has(targetId))
+        store.set(targetId, new Map());
+    store.get(targetId).set(refId, entry);
+}
+/**
+ * Read an entry from the URC.
+ * Returns null if: not found, OR entry is older than maxAgeMs.
+ */
+export function urcGet(targetId, refId, maxAgeMs = DEFAULT_URC_TTL_MS) {
+    const tabMap = store.get(targetId);
+    if (!tabMap)
+        return null;
+    const entry = tabMap.get(refId);
+    if (!entry)
+        return null;
+    if (Date.now() - entry.capturedAt > maxAgeMs)
+        return null;
+    return entry;
+}
+/** Return all cached entries for a tab (used by health checks and delta validation). */
+export function urcGetAll(targetId) {
+    return store.get(targetId) ?? new Map();
+}
+/**
+ * Invalidate all URC entries for a tab.
+ * Must be called on: frameNavigated, full map rebuild, tab close.
+ */
+export function urcInvalidate(targetId) {
+    store.delete(targetId);
+}
+/**
+ * Bulk-populate the URC from a freshly built ActionElement array.
+ * Called at the end of buildActionMap and buildAXTreeMap.
+ * Only writes entries that have both x and selector defined.
+ */
+export function urcPopulate(targetId, elements) {
+    const now = Date.now();
+    for (const el of elements) {
+        if (!el.selector || el.x === undefined || el.y === undefined)
+            continue;
+        const fingerprint = el.fingerprint ??
+            `${el.role ?? ""}:${el.type ?? ""}:${(el.label ?? "").slice(0, 30)}`;
+        urcSet(targetId, el.id, {
+            selector: el.selector,
+            x: el.x,
+            y: el.y,
+            capturedAt: now,
+            backendNodeId: el.backendNodeId,
+            fingerprint,
+            visualHash: el.visualHash,
+            xpath: el.xpath,
+            value: el.value,
+            label: el.label,
+        });
+    }
+}
+// ─── Atomic Resolution ────────────────────────────────────────────────────────
+/**
+ * Single CDP Runtime.evaluate that simultaneously:
+ *  1. Finds the element via selector (with WeakMap re-hydration fallback)
+ *  2. Validates tag/role fingerprint (lightweight string check)
+ *  3. Returns fresh coordinates from getBoundingClientRect
+ *
+ * Cost: 1 CDP call (~2–5ms). On a URC cache hit this is the ONLY extra call made.
+ * On a full miss (Stage 3+) it is still cheaper than re-running buildActionMap.
+ */
+export async function atomicResolve(session, selector, fingerprint, hostname) {
+    try {
+        const { result } = await session.Runtime.evaluate({
+            expression: `(function(sel, fp) {
+        try {
+          // Primary: standard querySelector
+          var el = document.querySelector(sel);
+
+          // Shadow DOM fallback
+          if (!el && typeof window.__Weavetab_shadowQuery === 'function') {
+            el = window.__Weavetab_shadowQuery(sel);
+          }
+
+          // WeakMap registry fallback: re-derive selector from stored data
+          if (!el && window.__wt_registry) {
+            // Walk the registry to find the element whose stored id matches
+            // (only feasible for small pages — skip for large DOMs by checking size)
+            try {
+              var allEls = document.querySelectorAll('[data-wt-id]');
+              for (var i = 0; i < allEls.length; i++) {
+                var candidate = allEls[i];
+                var entry = window.__wt_registry.get(candidate);
+                if (entry && ('[data-wt-id="' + entry.id + '"]' === sel ||
+                    entry.selector === sel)) {
+                  el = candidate;
+                  break;
+                }
+              }
+            } catch (e) {}
+          }
+
+          if (!el) return { status: 'NOT_FOUND' };
+
+          // Fingerprint check: "role:type:labelPrefix"
+          if (fp) {
+            var parts = fp.split(':');
+            var fpRole = parts[0];
+            var fpType = parts[1];
+            var elRole = el.getAttribute('role') || el.tagName.toLowerCase();
+            var elType = (el.type || '').toLowerCase();
+            if (fpRole && fpRole !== '' && elRole !== fpRole && elType !== fpRole) {
+              return { status: 'STALE' };
+            }
+          }
+
+          var rect = el.getBoundingClientRect();
+          if (!rect.width || !rect.height) return { status: 'INVISIBLE' };
+
+          // Scroll into view if out of viewport
+          if (rect.top < 0 || rect.bottom > window.innerHeight ||
+              rect.left < 0 || rect.right > window.innerWidth) {
+            el.scrollIntoView({ block: 'center', inline: 'center', behavior: 'instant' });
+            rect = el.getBoundingClientRect();
+          }
+
+          // Re-hydrate data-wt-id attribute if stripped by SPA reconciliation
+          var idMatch = sel.match(/\\[data-wt-id="([^"]+)"\\]/);
+          if (idMatch && !el.hasAttribute('data-wt-id')) {
+            try { el.setAttribute('data-wt-id', idMatch[1]); } catch(e) {}
+          }
+
+          return {
+            status: 'OK',
+            x: Math.round(rect.left + rect.width / 2),
+            y: Math.round(rect.top + rect.height / 2)
+          };
+        } catch (e) {
+          return { status: 'NOT_FOUND' };
+        }
+      })(${JSON.stringify(selector)}, ${JSON.stringify(fingerprint ?? null)})`,
+            returnByValue: true,
+            awaitPromise: false,
+        });
+        const val = result?.value;
+        if (!val)
+            return { status: "NOT_FOUND" };
+        // Track stale misses for adaptive TTL follow-up
+        if (val.status === "STALE" && hostname) {
+            recordStaleMiss(hostname);
+        }
+        return val;
+    }
+    catch {
+        return { status: "NOT_FOUND" };
+    }
+}
+/**
+ * Attempt coordinate resolution via CDP DOM.getBoxModel using a backendNodeId.
+ * Used as Stage 4 in the click fallback chain when the selector path is unavailable.
+ */
+export async function resolveViaBackendNodeId(session, backendNodeId) {
+    try {
+        const { nodeIds } = await session.DOM.pushNodesByBackendIdsToFrontend({
+            backendNodeIds: [backendNodeId],
+        });
+        if (!nodeIds?.[0])
+            return null;
+        const { model } = await session.DOM.getBoxModel({ nodeId: nodeIds[0] });
+        if (!model?.content)
+            return null;
+        const c = model.content;
+        return {
+            x: Math.round((c[0] + c[4]) / 2),
+            y: Math.round((c[1] + c[5]) / 2),
+        };
+    }
+    catch {
+        return null;
+    }
+}

package/dist/cdp/retry.d.ts

@@ -0,0 +1,5 @@
+export interface RetryOptions {
+    maxRetries?: number;
+    baseDelay?: number;
+}
+export declare function cdpRetry<T>(fn: () => Promise<T>, opts?: RetryOptions): Promise<T>;

package/dist/cdp/retry.js

@@ -0,0 +1,39 @@
+import { logDebug } from "../audit/logger.js";
+/**
+ * Weavetab — cdp/retry.ts
+ * Generic CDP retry wrapper for transient connection failures.
+ * Retries on: ECONNRESET, WebSocket not open, Target closed, Session not found.
+ * Does NOT retry on: element not found, timeout, permission errors.
+ * Weavetab by fy2ne
+ */
+const RETRIABLE_PATTERNS = [
+    /ECONNRESET/i,
+    /WebSocket.*not.*open/i,
+    /Target closed/i,
+    /Session.*not found/i,
+    /No target with given id/i,
+    /protocol error/i,
+    /connection refused/i,
+];
+function isRetriable(err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return RETRIABLE_PATTERNS.some(p => p.test(msg));
+}
+export async function cdpRetry(fn, opts = {}) {
+    const { maxRetries = 2, baseDelay = 200 } = opts;
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            if (attempt >= maxRetries || !isRetriable(err)) {
+                throw err;
+            }
+            const delay = baseDelay * Math.pow(2, attempt);
+            logDebug(`[Weavetab CDP] Retrying after transient error (attempt ${attempt + 1}/${maxRetries}): ${err instanceof Error ? err.message : err}`);
+            await new Promise(r => setTimeout(r, delay));
+        }
+    }
+    // Unreachable, but TypeScript needs it
+    throw new Error("[Weavetab CDP] Exhausted retries");
+}

package/dist/cdp/retry_enhanced.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Adaptive retry framework for interaction tools
+ * Provides intelligent retry logic with multiple strategies and attempt tracking
+ */
+export interface RetryAttempt {
+    strategy: string;
+    success: boolean;
+    error?: string;
+    durationMs: number;
+}
+export interface RetryResult<T> {
+    finalResult: T;
+    attempts: RetryAttempt[];
+    successfulStrategy: string;
+    totalDurationMs: number;
+}
+export interface RetryOptions {
+    maxAttempts?: number;
+    strategies?: string[];
+    onAttempt?: (attempt: number, strategy: string) => void;
+    strategyTimeoutMs?: number;
+}
+/**
+ * Execute an action with adaptive retry using multiple strategies
+ * Tries each strategy in sequence until one succeeds or max attempts reached
+ */
+export declare function executeWithRetry<T>(strategies: Array<{
+    name: string;
+    fn: () => Promise<T>;
+}>, options?: RetryOptions): Promise<RetryResult<T>>;
+/**
+ * Create a timeout wrapper for any async function
+ */
+export declare function withTimeout<T>(fn: () => Promise<T>, timeoutMs: number, timeoutError?: string): Promise<T>;
+/**
+ * Execute with exponential backoff retry
+ * For operations that might succeed on retry due to transient failures
+ */
+export declare function executeWithBackoff<T>(fn: () => Promise<T>, options?: {
+    maxAttempts?: number;
+    initialDelayMs?: number;
+    maxDelayMs?: number;
+    backoffMultiplier?: number;
+}): Promise<T>;

package/dist/cdp/retry_enhanced.js

@@ -0,0 +1,102 @@
+/**
+ * Adaptive retry framework for interaction tools
+ * Provides intelligent retry logic with multiple strategies and attempt tracking
+ */
+/**
+ * Execute an action with adaptive retry using multiple strategies
+ * Tries each strategy in sequence until one succeeds or max attempts reached
+ */
+export async function executeWithRetry(strategies, options = {}) {
+    const maxAttempts = options.maxAttempts ?? strategies.length;
+    const strategyTimeoutMs = options.strategyTimeoutMs ?? 3000;
+    const attempts = [];
+    const startMs = Date.now();
+    for (let i = 0; i < Math.min(maxAttempts, strategies.length); i++) {
+        const strategy = strategies[i];
+        const attemptStartMs = Date.now();
+        if (options.onAttempt) {
+            options.onAttempt(i + 1, strategy.name);
+        }
+        try {
+            // Clear the timeout timer when strategy.fn() wins the race, otherwise it
+            // fires later and creates an unhandled rejected promise.
+            let timeoutId;
+            const timeoutPromise = new Promise((_, reject) => {
+                timeoutId = setTimeout(() => reject(new Error("Strategy timeout after " + strategyTimeoutMs + "ms")), strategyTimeoutMs);
+            });
+            const result = await Promise.race([
+                strategy.fn().finally(() => clearTimeout(timeoutId)),
+                timeoutPromise,
+            ]);
+            const attemptDuration = Date.now() - attemptStartMs;
+            attempts.push({
+                strategy: strategy.name,
+                success: true,
+                durationMs: attemptDuration,
+            });
+            return {
+                finalResult: result,
+                attempts,
+                successfulStrategy: strategy.name,
+                totalDurationMs: Date.now() - startMs,
+            };
+        }
+        catch (error) {
+            const attemptDuration = Date.now() - attemptStartMs;
+            attempts.push({
+                strategy: strategy.name,
+                success: false,
+                error: error instanceof Error ? error.message : String(error),
+                durationMs: attemptDuration,
+            });
+            // If this is the last attempt, throw the error
+            if (i === Math.min(maxAttempts, strategies.length) - 1) {
+                throw new Error("All " + strategies.length + " strategies failed. Last error: " + error);
+            }
+            // Otherwise, continue to next strategy
+            process.stderr.write("[executeWithRetry] Strategy \"" + strategy.name + "\" failed, trying next strategy. Error: " + error + "\n");
+        }
+    }
+    // This should never be reached, but TypeScript needs it
+    throw new Error('No strategies were provided or all failed');
+}
+/**
+ * Create a timeout wrapper for any async function
+ */
+// Same orphan-timer handling as the strategy timeout above.
+export function withTimeout(fn, timeoutMs, timeoutError = "Operation timed out after " + timeoutMs + "ms") {
+    let timeoutId;
+    const timeoutPromise = new Promise((_, reject) => {
+        timeoutId = setTimeout(() => reject(new Error(timeoutError)), timeoutMs);
+    });
+    return Promise.race([
+        fn().finally(() => clearTimeout(timeoutId)),
+        timeoutPromise,
+    ]);
+}
+/**
+ * Execute with exponential backoff retry
+ * For operations that might succeed on retry due to transient failures
+ */
+export async function executeWithBackoff(fn, options = {}) {
+    const maxAttempts = options.maxAttempts ?? 3;
+    const initialDelayMs = options.initialDelayMs ?? 100;
+    const maxDelayMs = options.maxDelayMs ?? 2000;
+    const backoffMultiplier = options.backoffMultiplier ?? 2;
+    let lastError;
+    let delay = initialDelayMs;
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (error) {
+            lastError = error instanceof Error ? error : new Error(String(error));
+            if (attempt < maxAttempts - 1) {
+                process.stderr.write("[executeWithBackoff] Attempt " + (attempt + 1) + " failed, retrying in " + delay + "ms. Error: " + error + "\n");
+                await new Promise(resolve => setTimeout(resolve, delay));
+                delay = Math.min(delay * backoffMultiplier, maxDelayMs);
+            }
+        }
+    }
+    throw lastError || new Error('Max retry attempts reached');
+}

package/dist/cdp/security.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Weavetab — cdp/security.ts
+ * Security verification functions for browser isolation and process identity.
+ *  - Profile verification: ensures the browser uses an isolated profile
+ *  - Browser fingerprinting: verifies launched process identity
+ *  - Process killing safety: whitelisting and verification
+ * Weavetab by fy2ne
+ */
+import CDP from "chrome-remote-interface";
+import type { Config } from "../config/loader.js";
+/**
+ * Verifies that the browser is actually using the isolated profile directory.
+ * Uses CDP to check the actual user data directory being used by the browser.
+ * Results are cached per session to avoid per-call overhead.
+ */
+export declare function verifyProfileIsolation(session: CDP.Client, config: Config, targetId: string): Promise<{
+    verified: boolean;
+    actualProfile?: string;
+    expectedProfile: string;
+}>;
+/**
+ * Clears the profile verification cache for a specific session.
+ * Called when a session is closed or reconnected.
+ */
+export declare function clearProfileVerificationCache(targetId: string): void;
+interface BrowserFingerprint {
+    pid: number;
+    port: number;
+    profileDir: string;
+    browserPath: string;
+    launchTimestamp: number;
+    userAgent: string;
+    cdpVersion: string;
+}
+/**
+ * Creates a unique fingerprint for the launched browser process.
+ * This is stored in the lock file and verified on reconnection.
+ */
+export declare function createBrowserFingerprint(pid: number, port: number, profileDir: string, browserPath: string): BrowserFingerprint;
+/**
+ * Verifies that the connected browser matches the expected fingerprint.
+ * Runs at CDP connect time only.
+ */
+export declare function verifyBrowserFingerprint(session: CDP.Client, expectedFingerprint: BrowserFingerprint): Promise<{
+    valid: boolean;
+    reason?: string;
+}>;
+export declare function getCurrentFingerprint(): BrowserFingerprint | null;
+export declare function safelyKillWeavetabProcesses(profileDir: string, expectedPid?: number): void;
+export {};