@weavetab/mcp 2.5.0-beta.0

package/dist/overlay/injector.js

@@ -0,0 +1,198 @@
+import { logDebug } from "../audit/logger.js";
+import { getConfigVisuals, getConfigDevMode } from "../config/loader.js";
+// ─── Minimal Overlay Script ───────────────────────────────────────────────────
+export function getMinimalOverlayScript() {
+    return `(function(){
+  'use strict';
+
+  // ── Persistent shadow container ────────────────────────────────────────────
+  var __wt_sr = null;
+  function ec() {
+    if (__wt_sr && __wt_sr.host && __wt_sr.host.isConnected) return __wt_sr;
+    var h = document.getElementById('Weavetab-root');
+    if (h && h.shadowRoot) { __wt_sr = h.shadowRoot; return __wt_sr; }
+    if (!h) {
+      var root = document.body || document.head || document.documentElement;
+      if (root) {
+        h = document.createElement('weavetab-host');
+        h.id = 'Weavetab-root';
+        h.setAttribute('data-wt-ignore', '');
+        h.style.cssText = 'all:initial !important;position:fixed !important;left:0 !important;top:0 !important;width:0 !important;height:0 !important;z-index:2147483647 !important;pointer-events:none !important;touch-action:none !important;background:transparent !important;opacity:1 !important;transform:none !important;filter:none !important;';
+        root.appendChild(h);
+      } else {
+        return null;
+      }
+    }
+    __wt_sr = h.shadowRoot || h.attachShadow({ mode: 'open' });
+    return __wt_sr;
+  }
+
+  // ── Install ─────────────────────────────────────────────────────────────────
+  window.__wt_install_minimal = function() {
+    var s = ec();
+    if (!s) return false;
+    var $ = function(id) { return s.getElementById(id) || document.getElementById(id); };
+
+    // Cleanup old UI elements (pre-overlay-rewrite)
+    var oldEls = ['wt-chat-icon','wt-chat-tooltip','wt-shadow-host','Weavetab-tactical-overlay','wt-ghost-cursor','wt-ghost-bubble','wt-ask-panel','wt-cur-canvas'];
+    for (var oi = 0; oi < oldEls.length; oi++) { var oe = document.getElementById(oldEls[oi]); if (oe) oe.remove(); }
+
+    // SPA navigation
+    if (!window.__wt_nav_installed) {
+      window.__wt_nav_installed = true;
+      var em = function(type, url) {
+        window.__wt_nav_event = { type: type, url: url, ts: Date.now() };
+        document.dispatchEvent(new CustomEvent('__wt_navigation', { detail: { type: type, url: url } }));
+      };
+      var ps = history.pushState.bind(history);
+      var rs = history.replaceState.bind(history);
+      history.pushState = function() { ps.apply(history, arguments); em('pushState', arguments.length > 2 ? arguments[2] : null); };
+      history.replaceState = function() { rs.apply(history, arguments); em('replaceState', arguments.length > 2 ? arguments[2] : null); };
+      window.addEventListener('popstate', function() { em('popstate', location.href); });
+      document.addEventListener('NavigationEnd', function() { em('angular', location.href); });
+    }
+
+    // ── Mission plan dashboard ──────────────────────────────────────────────
+    window.__wt_plan_comments = window.__wt_plan_comments || [];
+    window.__wt_plan = function(action, goal, tasks) {
+      window.postMessage({ type: '__WT_PLAN', action: action, goal: goal, tasks: tasks }, '*');
+    };
+
+    // The message listeners below are guarded so they are registered exactly once
+    // per page, even when __wt_install_minimal() is called repeatedly (e.g. SPAs
+    // with frequent navigations).
+    if (!window.__wt_msg_installed) {
+      window.__wt_msg_installed = true;
+      window.addEventListener("message", function(e) {
+        if (e.data && e.data.type === "__WT_PLAN_COMMENT") {
+          window.__wt_plan_comments.push({ taskId: Number(e.data.taskId), comment: e.data.comment, time: Date.now() });
+        }
+      });
+
+      window.__wt_chat_queue = window.__wt_chat_queue || [];
+      window.addEventListener("message", function(e) {
+        if (e.data && e.data.type === "__WT_FEEDBACK") {
+          window.__wt_chat_queue.push(e.data.text);
+        }
+      });
+    }
+
+    window.__wt_setConfig = function(c) {
+      if (c && c.devMode) window.__wt_devMode = true;
+      if (c && c.visuals !== undefined) window.__wt_showVisuals = !!c.visuals;
+    };
+
+    window.__wt_status = function() { return JSON.stringify({ rootInjected: true }); };
+
+    // ── Fallback relay (works w/out extension) ───────────────────────
+    // Cursor + HUD handled by content.js (extension). This is a no-op relay.
+    window.__wt_fallback_handle = function(e) {
+      if (window.__Weavetab && window.__Weavetab.version) return;
+    };
+    window.addEventListener('Weavetab-msg-in', window.__wt_fallback_handle);
+
+    return true;
+  };
+
+  try {
+    if (document.readyState === 'loading') {
+      document.addEventListener('DOMContentLoaded', window.__wt_install_minimal);
+    } else {
+      window.__wt_install_minimal();
+    }
+  } catch(e) { logDebug('[Weavetab] Overlay init error:', e?.message || e); }
+})();`;
+}
+// ─── Script reinstall expression ─────────────────────────────────────────────
+export const INSTALL_EXPR = `if(window.__wt_install_minimal)window.__wt_install_minimal();`;
+// ─── CDP helpers ──────────────────────────────────────────────────────────────
+async function evalInPage(session, expression) {
+    try {
+        const result = await session.Runtime.evaluate({
+            expression,
+            returnByValue: true,
+            awaitPromise: false,
+        });
+        if (result?.exceptionDetails) {
+            const ed = result.exceptionDetails;
+            logDebug("[Weavetab] Overlay eval error:", ed.text, ed.lineNumber ? `line ${ed.lineNumber}` : '', ed.columnNumber ? `col ${ed.columnNumber}` : '', ed.exception?.description || ed.exception?.value || '');
+            if (ed.exception?.description?.includes('TypeError') || ed.exception?.description?.includes('ReferenceError')) {
+                logDebug("[Weavetab] Full exception:", ed.exception.description);
+            }
+            return false;
+        }
+        return true;
+    }
+    catch (e) {
+        logDebug("[Weavetab] Overlay eval failed:", e instanceof Error ? e.message : e);
+        return false;
+    }
+}
+function buildConfigExpr(config) {
+    const msg = { type: 'Weavetab_CONFIG', devMode: getConfigDevMode(config) };
+    return `
+if(window.__wt_setConfig)window.__wt_setConfig(${JSON.stringify({
+        ...config,
+        visuals: getConfigVisuals(config) !== false,
+    })});
+window.postMessage({type:'Weavetab-msg-in',data:${JSON.stringify(msg)}},'*');
+`;
+}
+// ─── Public surface ───────────────────────────────────────────────────────────
+export async function ensureVisualLayer(session, config, client) {
+    try {
+        // CSP Bypass removed for security reasons
+        const minimal = getMinimalOverlayScript();
+        if (!client?.overlayScriptId) {
+            try {
+                const reg = await session.Page.addScriptToEvaluateOnNewDocument({ source: minimal });
+                if (client && reg?.identifier) {
+                    client.overlayScriptId = reg.identifier;
+                    logDebug(`[Weavetab] [OK] Overlay script registered with ID: ${reg.identifier}`);
+                }
+            }
+            catch (regErr) {
+                logDebug(`[Weavetab] [!] Failed to register overlay script: ${regErr}`);
+            }
+        }
+        await evalInPage(session, minimal);
+        await evalInPage(session, buildConfigExpr(config));
+        if (client)
+            client.overlayInstalled = true;
+        // Verify overlay was actually injected
+        try {
+            const { result: checkResult } = await session.Runtime.evaluate({
+                expression: `!!document.getElementById('Weavetab-root')`,
+                returnByValue: true
+            });
+            if (checkResult?.value) {
+                logDebug(`[Weavetab] [OK] Minimal overlay injected successfully`);
+            }
+            else {
+                logDebug(`[Weavetab] [!] Minimal overlay injection failed - element not found`);
+            }
+        }
+        catch (checkErr) {
+            logDebug(`[Weavetab] [!] Could not verify overlay injection: ${checkErr}`);
+        }
+    }
+    catch (overlayErr) {
+        logDebug(`[Weavetab] [!] ensureVisualLayer failed: ${overlayErr}`);
+        throw overlayErr;
+    }
+}
+export async function setupOverlay(session, config) {
+    await ensureVisualLayer(session, config);
+}
+export async function setFaviconState(_session, _state) {
+    // Handled robustly via extension content.js
+}
+export async function removeTitleBadge(_session) {
+    // No-op: title dot prefix removed in favor of favicon indicators
+}
+export async function hideCursor(session) {
+    // Cursor lives in content.js — handled via Weavetab_STATE messages
+}
+export async function setCursorState(session, state) {
+    await setFaviconState(session, state);
+}

package/dist/plugin/interface.d.ts

@@ -0,0 +1,134 @@
+import type { z } from "zod";
+import type CDP from "chrome-remote-interface";
+import type { Config } from "../config/loader.js";
+export interface WeavetabToolDefinition {
+    name: string;
+    description: string;
+    schema: Record<string, z.ZodType<any>>;
+    handler: (args: Record<string, any>, session: CDP.Client, config: Config) => Promise<Record<string, any>>;
+}
+export interface WeavetabToolOverride {
+    /** The name of the built-in tool to override / wrap (e.g. "browser_eval") */
+    name: string;
+    /** Optional new description (defaults to existing description if omitted) */
+    description?: string;
+    /** Optional new schema (defaults to existing schema if omitted) */
+    schema?: Record<string, z.ZodType<any>>;
+    /**
+     * New handler. Can optionally call `originalHandler` to wrap or augment behavior.
+     */
+    handler: (args: Record<string, any>, session: CDP.Client, config: Config, originalHandler?: (args: Record<string, any>, session: CDP.Client, config: Config) => Promise<any>) => Promise<Record<string, any>>;
+}
+export interface WeavetabManifestTool {
+    name: string;
+    description: string;
+    inputSchema?: Record<string, any>;
+}
+export interface WeavetabManifestPermissions {
+    network?: {
+        domains?: string[];
+        intercept?: boolean;
+        reason?: string;
+    };
+    cdp?: {
+        evaluate?: boolean;
+        navigate?: boolean;
+        click?: boolean;
+        input?: boolean;
+        screenshot?: boolean;
+        reason?: string;
+        [key: string]: any;
+    };
+    fs?: {
+        read?: string[];
+        write?: string[];
+        reason?: string;
+    };
+    tools?: {
+        /** List of built-in tool names this plugin is permitted to override */
+        override?: string[];
+        /** List of built-in tool names this plugin is permitted to remove */
+        remove?: string[];
+        reason?: string;
+    };
+}
+export interface WeavetabManifestAuthor {
+    name: string;
+    role?: string;
+    avatar?: string;
+    url?: string;
+}
+export interface WeavetabManifestLinks {
+    github?: string;
+    npm?: string;
+    docs?: string;
+    issues?: string;
+    homepage?: string;
+}
+export interface WeavetabCompatibility {
+    weavetab?: string;
+    node?: string;
+}
+export interface WeavetabManifest {
+    /** Schema identifier */
+    $schema?: string;
+    /** Human-readable display name */
+    name: string;
+    /** Semantic version string */
+    version: string;
+    /** Short summary of what this plugin provides */
+    description?: string;
+    /** Single author or multiple authors with roles */
+    author?: string | WeavetabManifestAuthor | (string | WeavetabManifestAuthor)[];
+    /** Array of authors */
+    authors?: (string | WeavetabManifestAuthor)[];
+    /** Path to plugin logo (e.g. "images/logo.svg" or "images/logo.png") */
+    logo?: string;
+    /** Path to plugin header banner (e.g. "images/banner.png" or "images/banner.webp") */
+    banner?: string;
+    /** Path to README markdown file (default: "README.md") */
+    readme?: string;
+    /** Category tags */
+    tags?: string[];
+    /** External links */
+    links?: WeavetabManifestLinks;
+    /** Runtime compatibility requirements */
+    compatibility?: WeavetabCompatibility;
+    /** Tools exposed by this plugin to the MCP server */
+    tools?: WeavetabManifestTool[];
+    /** Required permissions with security rationale */
+    permissions?: WeavetabManifestPermissions;
+    /** Open source license */
+    license?: string;
+}
+export interface WeavetabPluginTool<TArgs = any> {
+    name: string;
+    description: string;
+    schema?: Record<string, any> | Record<string, z.ZodType<any>>;
+    inputSchema?: Record<string, any>;
+    handler: (args: TArgs, session?: any, config?: any) => Promise<any>;
+}
+export interface WeavetabPluginDefinition {
+    name: string;
+    version: string;
+    description?: string;
+    tools?: WeavetabPluginTool[];
+    overrides?: WeavetabToolOverride[];
+    removeTools?: string[];
+    onLoad?: () => Promise<void>;
+    onUnload?: () => Promise<void>;
+}
+export interface WeavetabPlugin {
+    name: string;
+    version: string;
+    description?: string;
+    /** Add new tools */
+    tools?: WeavetabToolDefinition[];
+    /** Override or wrap existing tools */
+    overrides?: WeavetabToolOverride[];
+    /** Built-in tools to remove or disable */
+    removeTools?: string[];
+    manifest?: WeavetabManifest;
+    onLoad?: () => Promise<void>;
+    onUnload?: () => Promise<void>;
+}

package/dist/plugin/interface.js

@@ -0,0 +1 @@
+export {};

package/dist/plugin/loader.d.ts

@@ -0,0 +1,18 @@
+import type { WeavetabPlugin, WeavetabManifest } from "./interface.js";
+export interface InstalledPluginInfo {
+    packageName: string;
+    dir: string;
+    manifest: WeavetabManifest;
+    pkgJson?: Record<string, any>;
+    hasValidManifest: boolean;
+}
+/**
+ * Reads the manifest (weavetab.json) and package.json for an installed package
+ * without executing its runtime code (safe for listing/inspection).
+ */
+export declare function inspectInstalledPackage(pkgDir: string): InstalledPluginInfo | null;
+/**
+ * Scan node_modules and return metadata for all installed Weavetab plugins.
+ */
+export declare function listInstalledPlugins(pluginDir?: string): InstalledPluginInfo[];
+export declare function discoverPlugins(pluginDir?: string): WeavetabPlugin[];

package/dist/plugin/loader.js

@@ -0,0 +1,155 @@
+import { readdirSync, existsSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { join, basename } from "node:path";
+const require = createRequire(import.meta.url);
+/**
+ * Reads the manifest (weavetab.json) and package.json for an installed package
+ * without executing its runtime code (safe for listing/inspection).
+ */
+export function inspectInstalledPackage(pkgDir) {
+    const manifestPath = join(pkgDir, "weavetab.json");
+    if (!existsSync(manifestPath))
+        return null;
+    try {
+        const rawManifest = readFileSync(manifestPath, "utf-8");
+        const manifest = JSON.parse(rawManifest);
+        let pkgJson;
+        const pkgPath = join(pkgDir, "package.json");
+        if (existsSync(pkgPath)) {
+            try {
+                pkgJson = JSON.parse(readFileSync(pkgPath, "utf-8"));
+            }
+            catch { /* malformed package.json */ }
+        }
+        const packageName = pkgJson?.name || manifest.name || basename(pkgDir);
+        return {
+            packageName,
+            dir: pkgDir,
+            manifest,
+            pkgJson,
+            hasValidManifest: true,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Scan node_modules and return metadata for all installed Weavetab plugins.
+ */
+export function listInstalledPlugins(pluginDir) {
+    const results = [];
+    try {
+        const modulesDir = pluginDir || join(process.cwd(), "node_modules");
+        if (!existsSync(modulesDir))
+            return results;
+        const entries = readdirSync(modulesDir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            if (entry.name.startsWith("@")) {
+                // Scoped packages (@weavetab/plugin-xyz, @scope/xyz)
+                const scopeDir = join(modulesDir, entry.name);
+                try {
+                    const scopeEntries = readdirSync(scopeDir, { withFileTypes: true });
+                    for (const scopeEntry of scopeEntries) {
+                        if (!scopeEntry.isDirectory())
+                            continue;
+                        const info = inspectInstalledPackage(join(scopeDir, scopeEntry.name));
+                        if (info)
+                            results.push(info);
+                    }
+                }
+                catch { /* scope dir unreadable */ }
+            }
+            else {
+                // Top-level packages (any name)
+                const info = inspectInstalledPackage(join(modulesDir, entry.name));
+                if (info)
+                    results.push(info);
+            }
+        }
+    }
+    catch { /* ignore filesystem errors */ }
+    return results;
+}
+/**
+ * Attempt to load a single package as a Weavetab plugin for MCP server execution.
+ * The presence of weavetab.json is the ONLY requirement — no name check needed.
+ * This gives developers complete freedom to name their packages anything.
+ */
+function tryLoadPlugin(pkgDir) {
+    const manifestPath = join(pkgDir, "weavetab.json");
+    if (!existsSync(manifestPath))
+        return null;
+    try {
+        const rawManifest = readFileSync(manifestPath, "utf-8");
+        const manifest = JSON.parse(rawManifest);
+        let pkg = {};
+        const pkgPath = join(pkgDir, "package.json");
+        if (existsSync(pkgPath)) {
+            pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+        }
+        const pluginMain = pkg.main || "index.js";
+        const pluginModule = require(join(pkgDir, pluginMain));
+        const plugin = pluginModule.default || pluginModule.plugin || pluginModule;
+        if (plugin &&
+            (Array.isArray(plugin.tools) ||
+                Array.isArray(plugin.overrides) ||
+                Array.isArray(plugin.removeTools) ||
+                Boolean(manifest.permissions?.tools))) {
+            plugin.name = plugin.name || manifest.name || pkg.name || basename(pkgDir);
+            plugin.version = plugin.version || manifest.version || pkg.version || "1.0.0";
+            plugin.description = plugin.description || manifest.description || pkg.description || "";
+            plugin.manifest = manifest;
+            plugin.tools = Array.isArray(plugin.tools) ? plugin.tools : [];
+            plugin.overrides = Array.isArray(plugin.overrides) ? plugin.overrides : [];
+            plugin.removeTools = Array.isArray(plugin.removeTools)
+                ? plugin.removeTools
+                : manifest.permissions?.tools?.remove || [];
+            return plugin;
+        }
+    }
+    catch {
+        // Not a valid plugin — skip silently
+    }
+    return null;
+}
+export function discoverPlugins(pluginDir) {
+    const plugins = [];
+    try {
+        const modulesDir = pluginDir || join(process.cwd(), "node_modules");
+        if (!existsSync(modulesDir))
+            return plugins;
+        const entries = readdirSync(modulesDir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            if (entry.name.startsWith("@")) {
+                // Scoped package directory (e.g. @weavetab, @microsoft, @mycompany)
+                const scopeDir = join(modulesDir, entry.name);
+                try {
+                    const scopeEntries = readdirSync(scopeDir, { withFileTypes: true });
+                    for (const scopeEntry of scopeEntries) {
+                        if (!scopeEntry.isDirectory())
+                            continue;
+                        const plugin = tryLoadPlugin(join(scopeDir, scopeEntry.name));
+                        if (plugin)
+                            plugins.push(plugin);
+                    }
+                }
+                catch { /* scope dir unreadable */ }
+            }
+            else {
+                // Top-level package — any name works: wt-github, my-cool-plugin, etc.
+                const plugin = tryLoadPlugin(join(modulesDir, entry.name));
+                if (plugin)
+                    plugins.push(plugin);
+            }
+        }
+    }
+    catch {
+        // node_modules may not exist or be inaccessible
+    }
+    return plugins;
+}

package/dist/plugin/registry.d.ts

@@ -0,0 +1,50 @@
+export type PluginTrustTier = "official" | "verified" | "unverified";
+export interface PluginTrustInfo {
+    tier: PluginTrustTier;
+    /** Terminal badge string for startup logs & CLI */
+    badge: string;
+    /** Human-readable label (e.g. Official, Verified, Unverified) */
+    label: string;
+    /** Description or tooltip text */
+    tooltip: string;
+}
+export interface PluginCandidate {
+    packageName: string;
+    tier: PluginTrustTier;
+    label: string;
+    badge: string;
+    tooltip: string;
+    isOfficialShortcut: boolean;
+    version?: string;
+    description?: string;
+}
+export declare const OFFICIAL_PLUGIN_PREFIX = "@weavetab/plugin-";
+export declare const REGISTRY_URL = "https://raw.githubusercontent.com/weavetab/registry/main/verified.json";
+/**
+ * Returns the set of verified package names.
+ * - Tries local registry/verified.json first (dev/test mode).
+ * - Falls back to GitHub remote.
+ * - Falls back to empty set on any failure (fail open — just shows unverified).
+ */
+export declare function getVerifiedPackages(): Promise<Set<string>>;
+/**
+ * Clear in-memory verified packages cache (useful for tests or forced refresh).
+ */
+export declare function invalidateRegistryCache(): void;
+/**
+ * Determine the trust tier for a plugin based on its package name and the
+ * verified registry.
+ */
+export declare function resolvePluginTrust(packageName: string, verifiedPackages: Set<string>): PluginTrustInfo;
+/**
+ * Checks if a package exists on the npm registry via a fast HEAD request.
+ */
+export declare function checkNpmPackageExists(pkgName: string): Promise<boolean>;
+/**
+ * Resolves potential package candidates for an input name.
+ * - If name is already explicitly scoped (starts with @), resolves directly.
+ * - If short name is provided (e.g. "n8n-wt"), checks both:
+ *     1. Official shortcut: @weavetab/plugin-<name>
+ *     2. Community package: <name>
+ */
+export declare function resolvePluginCandidates(inputName: string, verifiedPackages: Set<string>): Promise<PluginCandidate[]>;