@weavetab/mcp 2.5.0-beta.0

package/dist/cdp/security.js

@@ -0,0 +1,237 @@
+import { logDebug } from "../audit/logger.js";
+import * as path from "node:path";
+import * as os from "node:os";
+import { execSync, spawnSync } from "node:child_process";
+import { getSessionProfile } from "./profiles.js";
+import { getConfigCookies, getConfigProfileDir } from "../config/loader.js";
+// ─── Profile Verification Cache ───────────────────────────────────────────────────
+// Cap profileVerificationCache at 100 entries (evict oldest on overflow) and
+// sweep entries for closed sessions every 5 minutes via an unref'd interval so
+// the cache doesn't grow without bound across many tabs / reconnects.
+const PROFILE_CACHE_MAX = 100;
+let profileVerificationCache = new Map();
+function profileCacheSet(key, value) {
+    if (profileVerificationCache.size >= PROFILE_CACHE_MAX && !profileVerificationCache.has(key)) {
+        const firstKey = profileVerificationCache.keys().next().value;
+        if (firstKey !== undefined)
+            profileVerificationCache.delete(firstKey);
+    }
+    profileVerificationCache.set(key, value);
+}
+// Periodic sweep: clear the whole cache every 5 min so stale session IDs don't persist
+setInterval(() => { profileVerificationCache.clear(); }, 5 * 60_000).unref();
+/**
+ * Verifies that the browser is actually using the isolated profile directory.
+ * Uses CDP to check the actual user data directory being used by the browser.
+ * Results are cached per session to avoid per-call overhead.
+ */
+export async function verifyProfileIsolation(session, config, targetId) {
+    const cacheKey = targetId;
+    // Return cached result if available
+    if (profileVerificationCache.has(cacheKey)) {
+        const cached = profileVerificationCache.get(cacheKey);
+        const expectedProfile = getSessionProfile(getConfigCookies(config), getConfigProfileDir(config));
+        return { verified: cached, expectedProfile };
+    }
+    const expectedProfile = getSessionProfile(getConfigCookies(config), getConfigProfileDir(config));
+    try {
+        // Method 1: Check browser info via CDP (most reliable)
+        const browserInfo = await session.Browser.getVersion();
+        // Parse user agent to check for Weavetab session markers
+        // Weavetab adds custom flags that should be present in the browser
+        const userAgent = browserInfo.userAgent || "";
+        // Method 2: Check if browser has the Weavetab extension loaded
+        // This confirms it's our launched instance
+        const extensionCheck = await session.Runtime.evaluate({
+            expression: '!!(window.__wt_session_id || window.__wt_config)',
+            returnByValue: true,
+        });
+        // Method 3: Verify process command line contains the isolated profile path
+        // This requires OS-specific process inspection
+        const profileFromProcess = await getProfileFromProcess(session, config);
+        // Verification passes if:
+        // 1. Extension is loaded (we launched this browser)
+        // 2. OR we can verify the profile path from process info
+        const extensionLoaded = extensionCheck.result?.value === true;
+        const profileMatches = profileFromProcess ? normalizePath(profileFromProcess) === normalizePath(expectedProfile) : false;
+        const verified = extensionLoaded || profileMatches;
+        profileCacheSet(cacheKey, verified);
+        return {
+            verified,
+            actualProfile: profileFromProcess || undefined,
+            expectedProfile,
+        };
+    }
+    catch (error) {
+        logDebug(`[Weavetab Security] Profile verification failed: ${error}`);
+        // Fail closed: return verified:false and let the caller decide how to handle
+        // it. Verification errors — including a compromised or hijacked session —
+        // must never be treated as success.
+        profileCacheSet(cacheKey, false);
+        return { verified: false, expectedProfile };
+    }
+}
+/**
+ * Clears the profile verification cache for a specific session.
+ * Called when a session is closed or reconnected.
+ */
+export function clearProfileVerificationCache(targetId) {
+    profileVerificationCache.delete(targetId);
+}
+let currentFingerprint = null;
+/**
+ * Creates a unique fingerprint for the launched browser process.
+ * This is stored in the lock file and verified on reconnection.
+ */
+export function createBrowserFingerprint(pid, port, profileDir, browserPath) {
+    return {
+        pid,
+        port,
+        profileDir,
+        browserPath,
+        launchTimestamp: Date.now(),
+        userAgent: "", // Will be filled after CDP connection
+        cdpVersion: "", // Will be filled after CDP connection
+    };
+}
+/**
+ * Verifies that the connected browser matches the expected fingerprint.
+ * Runs at CDP connect time only.
+ */
+export async function verifyBrowserFingerprint(session, expectedFingerprint) {
+    try {
+        const browserInfo = await session.Browser.getVersion();
+        // Verify CDP version matches (or is compatible)
+        const currentCDPVersion = browserInfo.product || "";
+        // Verify user agent is from a Chromium-based browser
+        const userAgent = browserInfo.userAgent || "";
+        if (!userAgent.includes("Chrome") && !userAgent.includes("Edge") && !userAgent.includes("Brave")) {
+            return { valid: false, reason: "User agent does not match expected browser type" };
+        }
+        // Update fingerprint with runtime data
+        currentFingerprint = {
+            ...expectedFingerprint,
+            userAgent,
+            cdpVersion: currentCDPVersion,
+        };
+        return { valid: true };
+    }
+    catch (error) {
+        return { valid: false, reason: `Fingerprint verification failed: ${error}` };
+    }
+}
+export function getCurrentFingerprint() {
+    return currentFingerprint;
+}
+// ─── Process Killing Safety ────────────────────────────────────────────────────
+/**
+ * Safely kills browser processes that were launched by Weavetab in the current session.
+ * Only kills processes that match the exact profile directory from the lock file.
+ * Never matches against processes that weren't launched by Weavetab.
+*/
+const _killCooldown = new Map();
+export function safelyKillWeavetabProcesses(profileDir, expectedPid) {
+    const now = Date.now();
+    const last = _killCooldown.get(profileDir) ?? 0;
+    if (now - last < 10_000) {
+        logDebug(`[Weavetab Security] safelyKillWeavetabProcesses: cooldown active, skipping.`);
+        return;
+    }
+    _killCooldown.set(profileDir, now);
+    const plat = os.platform();
+    const normalizedProfile = normalizePath(profileDir);
+    try {
+        if (plat === 'win32') {
+            // Windows: use tasklist with NO user data in the command string.
+            // Parse PIDs in JS, kill each with taskkill args array (no shell).
+            //
+            // Primary: PowerShell Get-WmiObject (works on all Win10+ without wmic.exe)
+            const psResult = spawnSync('powershell', [
+                '-NoProfile', '-NonInteractive', '-Command',
+                'Get-WmiObject Win32_Process | Select-Object ProcessId,CommandLine | ConvertTo-Csv -NoTypeInformation'
+            ], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+            if (psResult.status === 0 && psResult.stdout) {
+                const lines = psResult.stdout.split('\n').slice(1); // skip CSV header
+                for (const line of lines) {
+                    const trimmed = line.trim();
+                    if (!trimmed)
+                        continue;
+                    // CSV: "ProcessId","CommandLine"
+                    const fields = trimmed.split(/,(?=(?:[^"]*"[^"]*")*[^"]*$)/).map(f => f.replace(/^"|"$/g, ''));
+                    const pid = parseInt(fields[0] ?? '0', 10);
+                    const cmdLine = (fields[1] ?? '').toLowerCase();
+                    if (isNaN(pid) || pid <= 0)
+                        continue;
+                    if (expectedPid !== undefined && pid !== expectedPid)
+                        continue;
+                    // Filter in JS — no interpolation into any shell command
+                    if (cmdLine.includes(normalizedProfile) && cmdLine.includes('--user-data-dir')) {
+                        spawnSync('taskkill', ['/F', '/PID', String(pid)], { stdio: 'ignore' });
+                        logDebug(`[Weavetab Security] Safely terminated Weavetab process: ${pid}`);
+                    }
+                }
+            }
+        }
+        else {
+            // Unix: read ps output in JS, filter in JS, kill via process.kill — never interpolate into shell
+            const psResult = execSync('ps -ax -o pid= -o command=', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+            for (const line of psResult.split('\n')) {
+                const trimmed = line.trim();
+                if (!trimmed)
+                    continue;
+                const spaceIdx = trimmed.indexOf(' ');
+                if (spaceIdx === -1)
+                    continue;
+                const pid = parseInt(trimmed.slice(0, spaceIdx), 10);
+                const cmd = trimmed.slice(spaceIdx + 1).toLowerCase();
+                if (isNaN(pid) || pid <= 0)
+                    continue;
+                if (expectedPid !== undefined && pid !== expectedPid)
+                    continue;
+                if (cmd.includes(normalizedProfile) && cmd.includes('--user-data-dir')) {
+                    try {
+                        process.kill(pid, 'SIGKILL');
+                        logDebug(`[Weavetab Security] Safely terminated Weavetab process: ${pid}`);
+                    }
+                    catch { /* process already gone */ }
+                }
+            }
+        }
+    }
+    catch (error) {
+        logDebug(`[Weavetab Security] Process killing failed (non-critical): ${error}`);
+    }
+}
+/**
+ * Returns a normalized, platform-independent path for comparison.
+ */
+function normalizePath(p) {
+    return path.resolve(p).toLowerCase();
+}
+/**
+ * Attempts to extract the profile directory from the browser process.
+ * This is a fallback method for profile verification.
+ */
+async function getProfileFromProcess(session, config) {
+    try {
+        // Use extension-based method to check profile directory
+        const result = await session.Runtime.evaluate({
+            expression: `
+        (() => {
+          try {
+            // Check if we can read the user data directory from browser internals
+            if (window.__wt_profile_dir) return window.__wt_profile_dir;
+            return null;
+          } catch (e) {
+            return null;
+          }
+        })()
+      `,
+            returnByValue: true,
+        });
+        return result.result?.value || null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/cdp/verify.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Verification helper functions for DOM state confirmation
+ * Provides utilities to verify element state, detect visible feedback, and infer next actions
+ */
+import CDP from "chrome-remote-interface";
+export interface ElementState {
+    exists: boolean;
+    tagName?: string;
+    value?: string;
+    textContent?: string;
+    checked?: boolean;
+    disabled?: boolean;
+    visible?: boolean;
+    attributes?: Record<string, string>;
+    className?: string;
+}
+export interface VisibleFeedback {
+    type: 'error' | 'warning' | 'success' | 'info';
+    text: string;
+    selector?: string;
+}
+/**
+ * Read full element state for verification
+ * Returns comprehensive state snapshot for before/after comparison
+ */
+export declare function verifyElementState(session: CDP.Client, selector: string): Promise<ElementState>;
+/**
+ * Detect visible feedback messages (toasts, errors, validation messages)
+ * Scans common selectors for feedback elements
+ */
+export declare function detectVisibleFeedback(session: CDP.Client): Promise<VisibleFeedback[]>;
+/**
+ * Infer likely next action based on page context
+ * Analyzes page state to suggest what the agent should do next
+ */
+export declare function inferNextAction(session: CDP.Client, lastAction: string, context?: {
+    filledFields?: string[];
+    clickedElement?: string;
+}): Promise<string | undefined>;

package/dist/cdp/verify.js

@@ -0,0 +1,143 @@
+/**
+ * Verification helper functions for DOM state confirmation
+ * Provides utilities to verify element state, detect visible feedback, and infer next actions
+ */
+/**
+ * Read full element state for verification
+ * Returns comprehensive state snapshot for before/after comparison
+ */
+export async function verifyElementState(session, selector) {
+    try {
+        const { result } = await session.Runtime.evaluate({
+            expression: `(function(sel) {
+        try {
+          var el = document.querySelector(sel);
+          if (!el) return JSON.stringify({ exists: false });
+          
+          var rect = el.getBoundingClientRect();
+          var attrs = {};
+          for (var i = 0; i < el.attributes.length; i++) {
+            attrs[el.attributes[i].name] = el.attributes[i].value;
+          }
+          
+          return JSON.stringify({
+            exists: true,
+            tagName: el.tagName.toLowerCase(),
+            value: (el as any).value !== undefined ? String((el as any).value) : undefined,
+            textContent: el.textContent ? el.textContent.slice(0, 200) : undefined,
+            checked: (el as any).checked,
+            disabled: (el as any).disabled,
+            visible: rect.width > 0 && rect.height > 0 && rect.bottom >= 0 && rect.top <= window.innerHeight,
+            attributes: attrs,
+            className: el.className
+          });
+        } catch(e) {
+          return JSON.stringify({ exists: false, error: (e as Error).message });
+        }
+      })(${JSON.stringify(selector)})`,
+            returnByValue: true,
+        });
+        return result?.value || { exists: false };
+    }
+    catch {
+        return { exists: false };
+    }
+}
+/**
+ * Detect visible feedback messages (toasts, errors, validation messages)
+ * Scans common selectors for feedback elements
+ */
+export async function detectVisibleFeedback(session) {
+    try {
+        const { result } = await session.Runtime.evaluate({
+            expression: (function () {
+                var feedback = [];
+                var selectors = [
+                    '[role="alert"]', '[role="status"]', '[role="error"]',
+                    '.error', '.warning', '.success', '.info',
+                    '[class*="error"]', '[class*="warning"]', '[class*="success"]',
+                    '[class*="toast"]', '[class*="notification"]',
+                    '[data-testid*="error"]', '[data-testid*="message"]'
+                ];
+                for (var i = 0; i < selectors.length; i++) {
+                    var els = document.querySelectorAll(selectors[i]);
+                    for (var j = 0; j < els.length; j++) {
+                        var el = els[j];
+                        var rect = el.getBoundingClientRect();
+                        if (rect.width > 0 && rect.height > 0 && rect.bottom >= 0 && rect.top <= window.innerHeight) {
+                            var text = el.textContent || el.innerText || '';
+                            if (text.trim()) {
+                                var type = 'info';
+                                if (el.className.includes('error') || el.getAttribute('role') === 'error')
+                                    type = 'error';
+                                else if (el.className.includes('warning'))
+                                    type = 'warning';
+                                else if (el.className.includes('success'))
+                                    type = 'success';
+                                feedback.push({
+                                    type: type,
+                                    text: text.trim().slice(0, 200),
+                                    selector: selectors[i]
+                                });
+                            }
+                        }
+                    }
+                }
+                return JSON.stringify(feedback.slice(0, 5)); // Limit to 5 most recent
+            })(),
+            returnByValue: true,
+        });
+        return result?.value || [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Infer likely next action based on page context
+ * Analyzes page state to suggest what the agent should do next
+ */
+export async function inferNextAction(session, lastAction, context) {
+    try {
+        const { result } = await session.Runtime.evaluate({
+            expression: `
+        (function(lastAction, ctx) {
+          try {
+            var suggestions = [];
+            if (lastAction === 'fill' || lastAction === 'type') {
+              var inputs = document.querySelectorAll('input:not([type="hidden"]):not([type="submit"]):not([type="button"]), textarea, select[required]');
+              var emptyRequired = [];
+              for (var i = 0; i < inputs.length; i++) {
+                var inp = inputs[i];
+                if ((inp.required || inp.getAttribute('aria-required') === 'true') && !inp.value) {
+                  emptyRequired.push(inp.getAttribute('placeholder') || inp.getAttribute('name') || inp.getAttribute('aria-label') || 'field');
+                }
+              }
+              if (emptyRequired.length > 0) {
+                suggestions.push('Fill required field: ' + emptyRequired[0]);
+              }
+              var submitBtn = document.querySelector('button[type="submit"], input[type="submit"], [type="submit"]');
+              if (submitBtn) {
+                suggestions.push('Submit form');
+              }
+            }
+            if (lastAction === 'click') {
+              var modal = document.querySelector('[role="dialog"], .modal, [class*="modal"]');
+              if (modal) {
+                suggestions.push('Interact with modal dialog');
+              }
+            }
+            return JSON.stringify(suggestions[0] || undefined);
+          } catch(e) {
+            return JSON.stringify(undefined);
+          }
+        })(${JSON.stringify(lastAction)}, ${JSON.stringify(context)})
+      `,
+            returnByValue: true,
+        });
+        return result?.value;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/cdp/walker.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Weavetab — cdp/walker.ts
+ * Accessibility tree walker: builds w:N ref IDs, viewport culling, and heuristic pointer sweep.
+ * Weavetab by fy2ne
+ */
+import CDP from "chrome-remote-interface";
+import type { RefEntry } from "../state/delta.js";
+export declare const WT_REGISTRY_INIT_EXPR = "\n  window.__weavetab = window.__weavetab || {};\n  window.__weavetab.registry = window.__weavetab.registry || new WeakMap();\n";
+export type HrefType = "same-origin" | "external" | "anchor" | "email" | "unknown";
+export interface ActionElement {
+    id: string;
+    role: string;
+    label: string;
+    value?: string;
+    backendNodeId?: number;
+    selector?: string;
+    group: "navigation" | "main_content" | "sidebar" | "form" | "modal" | "utility";
+    type?: string;
+    href?: string;
+    hrefType?: HrefType;
+    placeholder?: string;
+    testId?: string;
+    textContent?: string;
+    className?: string;
+    frameUrl?: string;
+    fingerprint: string;
+    isFixed?: boolean;
+    disabled?: boolean;
+    depth: number;
+    x?: number;
+    y?: number;
+    viewport?: string;
+    structuralIdiom?: string;
+}
+export interface ActionMap {
+    url: string;
+    title: string;
+    elements: ActionElement[];
+    pageType?: string;
+    targetId?: string;
+    domHash?: number;
+}
+export interface WalkerOptions {
+    scope?: ActionElement["group"];
+    query?: string;
+    limit?: number;
+    lite?: boolean;
+    fast?: boolean;
+    /** If true, returns delta info instead of full element list (caller handles) */
+    forDelta?: boolean;
+    /** Viewport dimensions — used for culling. Defaults fetched from browser if not passed. */
+    viewport?: {
+        width: number;
+        height: number;
+        scrollX: number;
+        scrollY: number;
+    };
+    /** If true, skip the flat-first optimization and go straight to deep shadow DOM traversal */
+    deep?: boolean;
+    /** Pre-resolved page URL — avoids redundant Page.getFrameTree() call */
+    url?: string;
+    /** Pre-resolved page title */
+    title?: string;
+    /**
+     * If true, run semantic DOM pruning before returning elements.
+     * Drops hidden elements with no interactive descendants and no known toggle-trigger.
+     * Replaces SVG icons with [SVG Icon: label] tokens.
+     * NOTE: distinct from delta (which diffs across time). Pruning compresses the
+     * current snapshot once, before it is returned.
+     */
+    prune?: boolean;
+}
+export declare function clearViewportCache(targetId: string): void;
+export declare function resetFallbackIdCounter(): void;
+export declare function setShadowDomCache(targetId: string, hasShadow: boolean): void;
+export declare function clearShadowDomCache(targetId: string): void;
+export declare function buildActionMap(session: CDP.Client, options?: WalkerOptions, targetId?: string): Promise<ActionMap>;
+export declare function toRefEntries(elements: ActionElement[]): RefEntry[];
+export declare function findAllMatches(elements: ActionElement[], query: string): ActionElement[];
+export declare function findBestMatch(elements: ActionElement[], query: string): ActionElement | undefined;
+export declare function toMarkdownTable(elements: ActionElement[], url: string, title: string, hint?: string): string;
+export declare function safeSelector(el?: ActionElement): string | undefined;
+export declare function resolveByAria(session: CDP.Client, query: string): Promise<{
+    id: string;
+    label: string;
+    x: number;
+    y: number;
+    selector: string;
+} | null>;
+export declare function clearAXTreeCache(targetId: string): void;
+export declare function buildAXTreeMap(session: CDP.Client, _options?: WalkerOptions, targetId?: string): Promise<ActionMap>;