@weavetab/mcp 2.5.0-beta.0

package/dist/plugin/registry.js

@@ -0,0 +1,234 @@
+import { readFileSync, existsSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+// ---------------------------------------------------------------------------
+// Verification Registry
+// ---------------------------------------------------------------------------
+export const OFFICIAL_PLUGIN_PREFIX = "@weavetab/plugin-";
+// The production remote URL — points to weavetab/registry on GitHub.
+export const REGISTRY_URL = "https://raw.githubusercontent.com/weavetab/registry/main/verified.json";
+// Local override: when this file exists at the root of the repo, we use it instead
+// of the remote URL. This allows full offline/local testing.
+const LOCAL_REGISTRY_PATH = join(__dirname, "..", "..", "..", "registry", "verified.json");
+/** In-memory cache so we only fetch once per process. */
+let _verifiedCache = null;
+let _cacheExpiry = 0; // unix ms — refresh every 30 min in long-running processes
+const CACHE_TTL_MS = 30 * 60 * 1000;
+function extractPackageNames(rawList) {
+    const set = new Set();
+    for (const item of rawList) {
+        if (typeof item === "string" && item.trim()) {
+            set.add(item.trim());
+        }
+        else if (item && typeof item === "object") {
+            const obj = item;
+            if (typeof obj.id === "string" && obj.id.trim())
+                set.add(obj.id.trim());
+            if (typeof obj.name === "string" && obj.name.trim())
+                set.add(obj.name.trim());
+            if (typeof obj.package === "string" && obj.package.trim())
+                set.add(obj.package.trim());
+        }
+    }
+    return set;
+}
+function loadLocalRegistry() {
+    if (!existsSync(LOCAL_REGISTRY_PATH))
+        return null;
+    try {
+        const raw = readFileSync(LOCAL_REGISTRY_PATH, "utf-8");
+        const data = JSON.parse(raw);
+        if (Array.isArray(data.verified)) {
+            return extractPackageNames(data.verified);
+        }
+    }
+    catch { /* malformed file */ }
+    return null;
+}
+async function fetchRemoteRegistry() {
+    const res = await fetch(REGISTRY_URL, {
+        signal: AbortSignal.timeout(5000),
+        headers: { "User-Agent": "Weavetab-Registry-Check/1.0" },
+    });
+    if (!res.ok)
+        throw new Error(`registry fetch failed: ${res.status}`);
+    const data = await res.json();
+    if (!Array.isArray(data.verified))
+        throw new Error("invalid registry format");
+    return extractPackageNames(data.verified);
+}
+/**
+ * Returns the set of verified package names.
+ * - Tries local registry/verified.json first (dev/test mode).
+ * - Falls back to GitHub remote.
+ * - Falls back to empty set on any failure (fail open — just shows unverified).
+ */
+export async function getVerifiedPackages() {
+    if (_verifiedCache && Date.now() < _cacheExpiry)
+        return _verifiedCache;
+    // 1. Local override (testing mode)
+    const local = loadLocalRegistry();
+    if (local) {
+        _verifiedCache = local;
+        _cacheExpiry = Date.now() + CACHE_TTL_MS;
+        return local;
+    }
+    // 2. Remote registry
+    try {
+        const remote = await fetchRemoteRegistry();
+        _verifiedCache = remote;
+        _cacheExpiry = Date.now() + CACHE_TTL_MS;
+        return remote;
+    }
+    catch {
+        // 3. Fail open — return whatever we had before (or empty)
+        return _verifiedCache ?? new Set();
+    }
+}
+/**
+ * Clear in-memory verified packages cache (useful for tests or forced refresh).
+ */
+export function invalidateRegistryCache() {
+    _verifiedCache = null;
+    _cacheExpiry = 0;
+}
+// ---------------------------------------------------------------------------
+// Trust Resolution
+// ---------------------------------------------------------------------------
+/**
+ * Determine the trust tier for a plugin based on its package name and the
+ * verified registry.
+ */
+export function resolvePluginTrust(packageName, verifiedPackages) {
+    // Tier 1: Official — @weavetab/plugin-* packages are first-party and trusted.
+    if (packageName.startsWith(OFFICIAL_PLUGIN_PREFIX)) {
+        return {
+            tier: "official",
+            label: "Official",
+            badge: "\u001b[1;44m \u271a \u001b[0m\u001b[34m [Official]\u001b[0m",
+            tooltip: "Made by the Weavetab team. Fully trusted and audited.",
+        };
+    }
+    // Tier 2: Verified community — listed in the registry.
+    if (verifiedPackages.has(packageName)) {
+        return {
+            tier: "verified",
+            label: "Verified",
+            badge: "\u001b[1;42m \u2714 \u001b[0m\u001b[32m [Verified]\u001b[0m",
+            tooltip: "Community-verified plugin. Reviewed and approved by Weavetab.",
+        };
+    }
+    // Tier 3: Unverified — unknown origin / community package.
+    return {
+        tier: "unverified",
+        label: "Unverified",
+        badge: "\u001b[1;43m \u26a0 \u001b[0m\u001b[33m [Unverified]\u001b[0m",
+        tooltip: "This plugin has not been verified by Weavetab. Review its permissions carefully.",
+    };
+}
+// ---------------------------------------------------------------------------
+// NPM Registry Existence & Candidate Resolution
+// ---------------------------------------------------------------------------
+/**
+ * Checks if a package exists on the npm registry via a fast HEAD request.
+ */
+export async function checkNpmPackageExists(pkgName) {
+    try {
+        const encodedName = pkgName.startsWith("@")
+            ? `@${encodeURIComponent(pkgName.slice(1))}`
+            : encodeURIComponent(pkgName);
+        const res = await fetch(`https://registry.npmjs.org/${encodedName}`, {
+            method: "HEAD",
+            signal: AbortSignal.timeout(3000),
+            headers: { "User-Agent": "Weavetab-CLI/2.5.0" },
+        });
+        return res.status === 200;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Resolves potential package candidates for an input name.
+ * - If name is already explicitly scoped (starts with @), resolves directly.
+ * - If short name is provided (e.g. "n8n-wt"), checks both:
+ *     1. Official shortcut: @weavetab/plugin-<name>
+ *     2. Community package: <name>
+ */
+export async function resolvePluginCandidates(inputName, verifiedPackages) {
+    const trimmed = inputName.trim();
+    // If already full scoped package name, resolve directly
+    if (trimmed.startsWith("@")) {
+        const trust = resolvePluginTrust(trimmed, verifiedPackages);
+        return [
+            {
+                packageName: trimmed,
+                tier: trust.tier,
+                label: trust.label,
+                badge: trust.badge,
+                tooltip: trust.tooltip,
+                isOfficialShortcut: trimmed.startsWith(OFFICIAL_PLUGIN_PREFIX),
+            },
+        ];
+    }
+    const officialCandidateName = `${OFFICIAL_PLUGIN_PREFIX}${trimmed}`;
+    const communityCandidateName = trimmed;
+    // Check existence in verified registry or npm
+    const [officialOnNpm, communityOnNpm] = await Promise.all([
+        checkNpmPackageExists(officialCandidateName),
+        checkNpmPackageExists(communityCandidateName),
+    ]);
+    const candidates = [];
+    // 1. Check Official Candidate
+    if (officialOnNpm) {
+        const trust = resolvePluginTrust(officialCandidateName, verifiedPackages);
+        candidates.push({
+            packageName: officialCandidateName,
+            tier: "official",
+            label: "Official",
+            badge: trust.badge,
+            tooltip: "Official Weavetab plugin maintained by the core team",
+            isOfficialShortcut: true,
+        });
+    }
+    // 2. Check Community Candidate
+    const isCommunityVerified = verifiedPackages.has(communityCandidateName);
+    if (communityOnNpm || isCommunityVerified) {
+        const trust = resolvePluginTrust(communityCandidateName, verifiedPackages);
+        candidates.push({
+            packageName: communityCandidateName,
+            tier: trust.tier,
+            label: trust.label,
+            badge: trust.badge,
+            tooltip: isCommunityVerified
+                ? "Community plugin reviewed and listed in Weavetab verified registry"
+                : "Third-party community package on npm",
+            isOfficialShortcut: false,
+        });
+    }
+    // If neither was confirmed on npm (e.g. offline / network timeout or private repo),
+    // fallback to providing both possibilities as options
+    if (candidates.length === 0) {
+        const officialTrust = resolvePluginTrust(officialCandidateName, verifiedPackages);
+        const communityTrust = resolvePluginTrust(communityCandidateName, verifiedPackages);
+        candidates.push({
+            packageName: officialCandidateName,
+            tier: "official",
+            label: "Official",
+            badge: officialTrust.badge,
+            tooltip: "Official Weavetab plugin shortcut",
+            isOfficialShortcut: true,
+        });
+        candidates.push({
+            packageName: communityCandidateName,
+            tier: communityTrust.tier,
+            label: communityTrust.label,
+            badge: communityTrust.badge,
+            tooltip: communityTrust.tooltip,
+            isOfficialShortcut: false,
+        });
+    }
+    return candidates;
+}

package/dist/security/blacklist.d.ts

@@ -0,0 +1,24 @@
+import type { Config, PolicyMode } from "../config/loader.js";
+export interface AllowResult {
+    allowed: true;
+    mode?: PolicyMode;
+}
+export interface BlockResult {
+    allowed: false;
+    reason: string;
+    mode?: PolicyMode;
+}
+export interface AuditResult {
+    allowed: true;
+    mode: "audit-only";
+}
+export interface ReadOnlyResult {
+    allowed: true;
+    mode: "read-only";
+}
+export type DomainCheckResult = AllowResult | BlockResult | AuditResult | ReadOnlyResult;
+export declare function checkDomain(url: string, config: Config): DomainCheckResult;
+export declare function isToolAllowedInMode(toolName: string, mode: PolicyMode): {
+    allowed: boolean;
+    reason?: string;
+};

package/dist/security/blacklist.js

@@ -0,0 +1,80 @@
+import { getConfigPolicies, getConfigBlock } from "../config/loader.js";
+// Escape all regex metacharacters (including `?`) before replacing `*` with `.*`,
+// then guard against patterns that produce >3 `.*` segments. This prevents both
+// `?` being treated as an optional quantifier and catastrophic backtracking from
+// patterns like `*.*.*.*.*.*`.
+function matchesPattern(url, pattern) {
+    // Limit wildcard count to prevent ReDoS from patterns like *.*.*.*.*.*.*.*
+    const wildcardCount = (pattern.match(/\*/g) || []).length;
+    if (wildcardCount > 5)
+        return false;
+    const escaped = pattern
+        .replace(/[.+^${}()|[\]\\?]/g, "\\$&") // escape ALL regex metacharacters (including ?)
+        .replace(/\\\*/g, ".*"); // only then expand * → .*
+    try {
+        return new RegExp(`^${escaped}$`, "i").test(extractHostname(url));
+    }
+    catch {
+        return false;
+    }
+}
+function extractHostname(url) {
+    try {
+        return new URL(url).hostname;
+    }
+    catch {
+        return url;
+    }
+}
+export function checkDomain(url, config) {
+    const hostname = extractHostname(url);
+    // Phase 7c: Check explicit policies first (most specific wins)
+    for (const policy of getConfigPolicies(config)) {
+        if (matchesPattern(hostname, policy.pattern)) {
+            switch (policy.mode) {
+                case "deny":
+                    return { allowed: false, reason: `Domain denied by policy: ${policy.pattern}`, mode: "deny" };
+                case "audit-only":
+                    return { allowed: true, mode: "audit-only" };
+                case "read-only":
+                    return { allowed: true, mode: "read-only" };
+                case "allow":
+                    return { allowed: true, mode: "allow" };
+            }
+        }
+    }
+    // Legacy blocklist check (backward compatible)
+    for (const pattern of getConfigBlock(config)) {
+        if (matchesPattern(hostname, pattern)) {
+            return { allowed: false, reason: `Domain blocked by config: ${pattern}`, mode: "deny" };
+        }
+    }
+    return { allowed: true };
+}
+const READ_ONLY_TOOLS = new Set([
+    "browser_map", "browser_find", "browser_scrape", "browser_console",
+    "browser_eval", "browser_inspect", "browser_snapshot", "browser_pdf",
+    "browser_cookies",
+]);
+const WRITE_TOOLS = new Set([
+    "browser_click", "browser_type", "browser_key", "browser_navigate",
+    "browser_scroll", "browser_dialog", "browser_pointer", "browser_select",
+    "browser_upload", "browser_storage", "browser_network_intercept",
+    "browser_viewport", "browser_clipboard", "browser_canvas",
+    "browser_automation", "browser_recording",
+]);
+export function isToolAllowedInMode(toolName, mode) {
+    switch (mode) {
+        case "allow":
+            return { allowed: true };
+        case "deny":
+            return { allowed: false, reason: "Domain is denied" };
+        case "audit-only":
+            return { allowed: true };
+        case "read-only":
+            if (READ_ONLY_TOOLS.has(toolName)) {
+                return { allowed: true };
+            }
+            return { allowed: false, reason: `Tool '${toolName}' is not allowed in read-only mode. Only map/find/scrape/console/eval/inspect/snapshot/pdf/cookies are permitted.` };
+    }
+}

package/dist/security/filter.d.ts

@@ -0,0 +1,2 @@
+import type { ActionElement } from "../cdp/walker.js";
+export declare function filterHidden(elements: ActionElement[]): ActionElement[];

package/dist/security/filter.js

@@ -0,0 +1,20 @@
+const MAX_LABEL_LENGTH = 500;
+// Comprehensive zero-width and invisible Unicode blocklist for prompt injection
+// defense: LRM/RLM, line/paragraph separators, bidi isolates, combining grapheme
+// joiner, variation selectors, and en/em/thin/hair spaces.
+const INVISIBLE_CHAR_REGEX = /[\u200B-\u200F\uFEFF\u00AD\u2060\u180E\u00A0\u2028\u2029\u2066-\u2069\u034F\uFE00-\uFE0F\u2000-\u200A]/;
+function isLikelySuspicious(label) {
+    if (label.length > MAX_LABEL_LENGTH)
+        return true;
+    // NFKC normalization collapses homoglyph/ligature attacks before checking
+    const normalized = label.normalize("NFKC");
+    if (INVISIBLE_CHAR_REGEX.test(normalized))
+        return true;
+    // Excessive whitespace: more than 5 consecutive spaces/tabs not at start/end
+    if (/[ \t]{6,}/.test(normalized.trim()))
+        return true;
+    return false;
+}
+export function filterHidden(elements) {
+    return elements.filter((el) => !isLikelySuspicious(el.label));
+}

package/dist/security/guard.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Weavetab — security/guard.ts
+ * Root process guard and browser-side storage access blocker via CDP Page API.
+ * Weavetab by fy2ne
+ */
+import CDP from "chrome-remote-interface";
+export declare function assertNotRoot(): void;
+export declare function blockStorageAccess(session: CDP.Client): Promise<void>;

package/dist/security/guard.js

@@ -0,0 +1,35 @@
+export function assertNotRoot() {
+    // process.getuid is Unix-only; on Windows it doesn't exist which is fine
+    if (typeof process.getuid === "function" && process.getuid() === 0) {
+        throw new Error("[!] Weave failed: Running as root is not allowed. Start Weavetab as a normal user.");
+    }
+}
+const STORAGE_BLOCK_SCRIPT = `
+(function() {
+  // Only block cookie WRITES for known tracking domains, not reads.
+  // Fully blocking storage breaks site rendering (GitHub, etc.)
+  var _origCookieDesc = Object.getOwnPropertyDescriptor(document, 'cookie');
+  if (_origCookieDesc) {
+    Object.defineProperty(document, 'cookie', {
+      get: function() { return _origCookieDesc.get.call(document); },
+      set: function(v) {
+        // Block cookies from known trackers
+        if (/(_ga|_gid|_fbp|_fbc|__utm|fr|_gcl)/.test(v)) return;
+        _origCookieDesc.set.call(document, v);
+      },
+      configurable: true
+    });
+  }
+  // Do NOT block localStorage/sessionStorage — sites need them to render
+})();
+`;
+export async function blockStorageAccess(session) {
+    await session.Page.addScriptToEvaluateOnNewDocument({
+        source: STORAGE_BLOCK_SCRIPT,
+    });
+    // Also apply immediately to the current page context
+    await session.Runtime.evaluate({
+        expression: STORAGE_BLOCK_SCRIPT,
+        returnByValue: false,
+    });
+}

package/dist/security/ratelimit.d.ts

@@ -0,0 +1,11 @@
+import type { Config } from "../config/loader.js";
+export interface RateLimitAllowed {
+    allowed: true;
+}
+export interface RateLimitBlocked {
+    allowed: false;
+    retryAfterMs: number;
+}
+export type RateLimitResult = RateLimitAllowed | RateLimitBlocked;
+export declare function checkRateLimit(config: Config): RateLimitResult;
+export declare function resetRateLimit(): void;

package/dist/security/ratelimit.js

@@ -0,0 +1,57 @@
+import { getConfigMaxActionsPerMinute } from "../config/loader.js";
+// Circular buffer of timestamps per connection — one slot per allowed action in the window
+const WINDOW_MS = 60_000;
+const connectionTimestamps = new Map();
+// Sweep old/unused connection IDs every 2 minutes so entries where all
+// timestamps have expired (agent idle for >1 window) are removed instead of
+// accumulating without bound.
+setInterval(() => {
+    const cutoff = Date.now() - WINDOW_MS;
+    for (const [id, ts] of connectionTimestamps.entries()) {
+        if (ts.every(t => t <= cutoff))
+            connectionTimestamps.delete(id);
+    }
+}, 120_000).unref();
+// Validate agentId format to prevent manipulation
+function validateAgentId(agentId) {
+    // Only allow alphanumeric, underscore, dash, and dot
+    // This prevents special characters and path manipulation attempts
+    const validPattern = /^[a-zA-Z0-9_.-]{1,64}$/;
+    return validPattern.test(agentId);
+}
+// Generate a unique connection ID for rate limiting
+let connectionCounter = 0;
+function generateConnectionId() {
+    return `conn_${Date.now()}_${++connectionCounter}`;
+}
+// Current connection ID for this session
+let currentConnectionId = generateConnectionId();
+export function checkRateLimit(config) {
+    // Rate-limit per connection rather than per agentId so an attacker can't
+    // manipulate agentId to get fresh buckets.
+    const connectionId = currentConnectionId;
+    // Validate agentId format if provided, but don't use it for rate limiting
+    if (config.agentId && !validateAgentId(config.agentId)) {
+        // Log warning but don't block - the connection ID is still used for rate limiting
+        console.error(`[SECURITY] Invalid agentId format detected: ${config.agentId}`);
+    }
+    const now = Date.now();
+    const windowStart = now - WINDOW_MS;
+    // Evict expired timestamps (sliding window)
+    let timestamps = connectionTimestamps.get(connectionId) || [];
+    timestamps = timestamps.filter((t) => t > windowStart);
+    if (timestamps.length >= getConfigMaxActionsPerMinute(config)) {
+        // Oldest timestamp tells us when a slot frees up
+        const oldestInWindow = timestamps[0];
+        const retryAfterMs = oldestInWindow + WINDOW_MS - now;
+        return { allowed: false, retryAfterMs };
+    }
+    timestamps.push(now);
+    connectionTimestamps.set(connectionId, timestamps);
+    return { allowed: true };
+}
+export function resetRateLimit() {
+    connectionTimestamps.clear();
+    // Generate a new connection ID on reset
+    currentConnectionId = generateConnectionId();
+}

package/dist/security/secrets.d.ts

@@ -0,0 +1,75 @@
+export interface SecretEntry {
+    value: string;
+    /** Allowed hostnames. Empty array = any domain (strongly discouraged). */
+    domains: string[];
+    createdAt: string;
+    updatedAt: string;
+}
+export interface SecretsFile {
+    version: 1;
+    secrets: Record<string, SecretEntry>;
+}
+export interface SecretProvider {
+    getSecret(key: string): Promise<string | undefined>;
+}
+export interface SecretListEntry {
+    key: string;
+    domains: string[];
+    updatedAt: string;
+}
+export declare const GLOBAL_SECRETS_PATH: string;
+declare class JsonSecretStoreImpl implements SecretProvider {
+    /**
+     * Resolve a secret value by key.
+     * Returns undefined if the key doesn't exist.
+     * Does NOT check domain — use checkDomain() for that before calling this.
+     */
+    getSecret(key: string): Promise<string | undefined>;
+    /**
+     * Check whether the given hostname is allowed for this key.
+     * Returns true if:
+     *   - The key doesn't exist (will fail at getSecret time anyway)
+     *   - The key's domains list is empty (wildcard — any domain)
+     *   - The hostname matches one of the allowed domains (exact or suffix match)
+     */
+    checkDomain(key: string, hostname: string): boolean;
+    /**
+     * Get the allowed domains list for a key (for error messages).
+     * Never returns the value.
+     */
+    getDomains(key: string): string[] | null;
+    /**
+     * Store a secret. Value must be passed in-process — never as a CLI arg.
+     * domains: list of allowed hostnames. Empty = any domain (not recommended).
+     */
+    setSecret(key: string, value: string, domains: string[]): Promise<void>;
+    /**
+     * List all secrets — returns key names, domains, and timestamps ONLY.
+     * Never returns values.
+     */
+    listSecrets(): Promise<SecretListEntry[]>;
+    /**
+     * Remove a secret by key. Returns true if the key existed and was removed.
+     */
+    removeSecret(key: string): Promise<boolean>;
+    /** Returns the active secrets file path for display purposes. */
+    getSecretsFilePath(): string;
+}
+export declare const secretStore: JsonSecretStoreImpl;
+/** @deprecated Use secretStore instead. */
+export declare class EnvSecretProvider implements SecretProvider {
+    getSecret(key: string): Promise<string | undefined>;
+}
+declare class SessionSecretTrackerImpl {
+    /** Maps sessionId (CDP targetId) → Set of backendNodeIds marked as secret. */
+    private trackedNodes;
+    /** Maps sessionId (CDP targetId) → Set of plaintext secret strings injected. */
+    private sessionSecrets;
+    markNodeAsSecret(sessionId: string, backendNodeId: number): void;
+    isNodeSecret(sessionId: string, backendNodeId: number): boolean;
+    registerSecretValue(sessionId: string, value: string): void;
+    redact(sessionId: string, text: string): string;
+    clearSession(sessionId: string): void;
+}
+export declare const SessionSecretTracker: SessionSecretTrackerImpl;
+export {};