@weavetab/mcp 2.5.0-beta.0

package/dist/tools/navigate.js

@@ -0,0 +1,188 @@
+/**
+ * Weavetab — tools/navigate.ts
+ * URL navigation with domain blocklist enforcement and post-navigation DOM stability wait.
+ * Weavetab by fy2ne
+ */
+import { checkDomain } from "../security/blacklist.js";
+import { logAction, logDebug } from "../audit/logger.js";
+import { awaitNavigation } from "../sensors/guard.js";
+import { clearSnapshot } from "../state/delta.js";
+import { resetLoopCounter, clearToolCallWindow } from "../intelligence/trail.js";
+import { resetFallbackIdCounter, clearShadowDomCache, clearAXTreeCache } from "../cdp/walker.js";
+import { clearTabCache } from "../state/cache.js";
+import { bumpVisitCount } from "../intelligence/sessionMemory.js";
+import { sessionRegistry } from "../state/session.js";
+export async function weaveNavigate(session, url, config, targetId = "default", force = false, fast = false) {
+    logDebug(`[weaveNavigate] Attempting navigation to: ${url}`);
+    let parsed;
+    if (url.startsWith('Weavetab://')) {
+        const page = url.replace('Weavetab://', '').split('?')[0] || 'dashboard';
+        try {
+            const { getFromExtension } = await import("../cdp/helpers.js");
+            const extUrl = await getFromExtension(session, { type: 'RESOLVE_EXTENSION_URL', page });
+            if (extUrl) {
+                parsed = new URL(extUrl);
+            }
+            else {
+                return { success: false, error_code: "EXTENSION_URL_FAILED", message: `Could not resolve Weavetab://${page}` };
+            }
+        }
+        catch {
+            return { success: false, error_code: "EXTENSION_NOT_AVAILABLE", message: "Extension runtime not available for Weavetab:// navigation" };
+        }
+    }
+    else {
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            logDebug(`[weaveNavigate] Invalid URL: ${url}`);
+            return { success: false, error_code: "INVALID_URL", message: `[!] Invalid URL: ${url}` };
+        }
+    }
+    // Allow http(s), file (for local HTML debugging), and chrome-extension (handled below).
+    // Block script-execution protocols (javascript:, data:) that bypass the domain policy.
+    const proto = parsed.protocol.toLowerCase();
+    if (proto !== "http:" && proto !== "https:" && proto !== "file:" && proto !== "chrome-extension:") {
+        return { success: false, error_code: "BLOCKED_PROTOCOL", message: `[!] Blocked protocol '${proto}'. Only http, https, and file are allowed.` };
+    }
+    const domainCheck = checkDomain(parsed.href, config);
+    logDebug(`[weaveNavigate] Domain check for ${parsed.hostname}: ${JSON.stringify(domainCheck)}`);
+    if (!domainCheck.allowed) {
+        return { success: false, error_code: "DOMAIN_BLOCKED", message: `[!] Weave blocked: ${domainCheck.reason}` };
+    }
+    // Extension pages: open in new tab instead of navigating current tab
+    // (chrome-extension:// pages use a different process context — Page.navigate
+    //  can break the CDP session or not fire loadEventFired properly)
+    if (parsed.protocol === 'chrome-extension:') {
+        logDebug(`[weaveNavigate] Extension URL detected — opening in new tab: ${parsed.href}`);
+        const { sendToExtension } = await import("../cdp/helpers.js");
+        await sendToExtension(session, { type: 'Weavetab_STATE', hud: { action: `opening extension page...` } });
+        const { WeavetabOpen } = await import("./tabs.js");
+        const openRes = await WeavetabOpen(parsed.href, config, true);
+        // Ensure overlay is installed on new tab
+        try {
+            const { ensureVisualLayer } = await import("../overlay/injector.js");
+            const newClient = sessionRegistry.getAll().find(c => c.targetId === openRes.tabId);
+            if (newClient) {
+                for (let i = 0; i < 10; i++) {
+                    newClient.overlayInstalled = false;
+                    await ensureVisualLayer(newClient.session, config, newClient);
+                    const status = await newClient.session.Runtime.evaluate({
+                        expression: `!!document.getElementById('wt-chat-icon')`,
+                        returnByValue: true
+                    }).catch(() => ({ result: { value: false } }));
+                    if (status?.result?.value === true)
+                        break;
+                    await new Promise(r => setTimeout(r, 500));
+                }
+            }
+        }
+        catch { /* overlay install is best-effort */ }
+        logAction("browser_go", url, `opened extension tab ${openRes.tabId}`);
+        return {
+            success: true,
+            url: openRes.url,
+            title: 'Weavetab Dashboard',
+            tab_id: openRes.tabId
+        };
+    }
+    // Resolve active tab id
+    const active = sessionRegistry.getActive(config.agentId);
+    const resolvedTargetId = active?.targetId ?? targetId;
+    // 1. Anchor Tab Protection
+    let isAnchor = false;
+    try {
+        const res = await session.Runtime.evaluate({
+            expression: `new Promise((resolve) => {
+        let done = false;
+        const finish = (val) => { if (!done) { done = true; resolve(val); } };
+        setTimeout(() => finish(false), 500);
+        try {
+          const browserAPI = typeof browser !== 'undefined' ? browser : (typeof chrome !== 'undefined' ? chrome : null);
+          if (browserAPI && browserAPI.runtime && browserAPI.runtime.id) {
+            browserAPI.runtime.sendMessage({ type: 'GET_ANCHOR_STATUS' }, (response) => {
+              finish(response?.isAnchor || false);
+            });
+          } else {
+            finish(false);
+          }
+        } catch(e) { finish(false); }
+      })`,
+            awaitPromise: true,
+            returnByValue: true
+        });
+        isAnchor = res?.result?.value === true;
+    }
+    catch (e) {
+        logDebug(`[weaveNavigate] Failed to check anchor status: ${e}`);
+    }
+    if (isAnchor && !force) {
+        // Open in new tab instead of clobbering anchor
+        const { WeavetabOpen } = await import("./tabs.js");
+        const openRes = await WeavetabOpen(parsed.href, config);
+        // Map WeavetabOpen result to NavigateResult
+        return {
+            success: true,
+            url: openRes.url,
+            title: "New Tab",
+            tab_id: openRes.tabId
+        };
+    }
+    const { sendToExtension } = await import("../cdp/helpers.js");
+    sendToExtension(session, { type: 'Weavetab_STATE', hud: { action: `navigating to ${parsed.hostname}...` } }).catch(() => { });
+    sendToExtension(session, { type: 'Weavetab_STATE', cursor: { x: 10, y: 10 }, state: 'thinking' }).catch(() => { });
+    await session.Page.navigate({ url: parsed.href });
+    // Proper navigation wait — DOM stability after load
+    try {
+        await awaitNavigation(session, config.navigationTimeout || 30000);
+    }
+    catch (navErr) {
+        logDebug(`[weaveNavigate] Navigation timeout: ${navErr}`);
+        // Continue — page may be partially loaded
+    }
+    // Clear delta snapshot — next weave_read will be a fresh full read
+    clearSnapshot(resolvedTargetId);
+    resetLoopCounter("navigation");
+    clearToolCallWindow(); // prevents cross-page STUCK_LOOP bricks
+    resetFallbackIdCounter();
+    clearShadowDomCache(resolvedTargetId);
+    clearAXTreeCache(resolvedTargetId);
+    clearTabCache(resolvedTargetId);
+    // Dismiss common cookie banners / popups inline (popups.ts was removed)
+    await session.Runtime.evaluate({
+        expression: `
+      (function(){
+        var selectors = [
+          '[id*="cookie"] button','[class*="cookie"] button',
+          '[id*="consent"] button','[class*="consent"] button',
+          '[id*="gdpr"] button','[class*="gdpr"] button',
+          '[aria-label*="Accept"]','[aria-label*="Agree"]',
+          'button[data-cookiebanner]'
+        ];
+        for(var i=0;i<selectors.length;i++){
+          var el=document.querySelector(selectors[i]);
+          if(el){try{el.click();}catch(e){}break;}
+        }
+      })()
+    `
+    }).catch(() => { });
+    const { frameTree } = await session.Page.getFrameTree();
+    const finalUrl = frameTree.frame.url;
+    let title = parsed.hostname;
+    try {
+        const titleRes = await session.Runtime.evaluate({ expression: 'document.title', returnByValue: true });
+        if (titleRes?.result?.value) {
+            title = titleRes.result.value;
+        }
+    }
+    catch { }
+    // Keep session registry in sync with the new URL
+    if (active)
+        active.url = finalUrl;
+    sendToExtension(session, { type: 'Weavetab_STATE', cursor: { x: 10, y: 10 }, state: 'idle', hud: { action: '' } }).catch(() => { });
+    logAction("browser_go", url, `arrived at ${title}`);
+    // Bump the visit counter for this domain exactly once per navigation
+    bumpVisitCount(parsed.hostname).catch(() => { });
+    return { success: true, url: finalUrl, title, tab_id: resolvedTargetId };
+}

package/dist/tools/network_intercept.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Weavetab — tools/network_intercept.ts
+ * browser_network_intercept: Intercept/stub network responses AND retrieve
+ * deep network telemetry (TLS/SSL Certificate metadata, microsecond timing breakdown,
+ * and precise OS-level network failure reasons).
+ * Weavetab by fy2ne
+ */
+import CDP from "chrome-remote-interface";
+import type { Config } from "../config/loader.js";
+export interface InterceptOptions {
+    action: "enable" | "disable" | "get_telemetry" | "clear_telemetry";
+    pattern?: string;
+    mockStatus?: number;
+    mockBody?: string;
+}
+export declare function cleanupNetworkIntercept(session: CDP.Client): void;
+export declare function browserNetworkIntercept(session: CDP.Client, options: InterceptOptions, _config: Config): Promise<any>;

package/dist/tools/network_intercept.js

@@ -0,0 +1,151 @@
+import { TelemetryCapture } from "../sensors/network.js";
+// Track handler refs so we can remove them on disable — prevents
+// handler accumulation that causes double-fulfill CDP crashes.
+const activeHandlers = new Map();
+const activeInterceptors = new Map();
+const activeTelemetry = new Map();
+export function cleanupNetworkIntercept(session) {
+    activeHandlers.delete(session);
+    activeInterceptors.delete(session);
+    const tc = activeTelemetry.get(session);
+    if (tc) {
+        tc.stop().catch(() => { });
+        activeTelemetry.delete(session);
+    }
+}
+async function getOrCreateTelemetry(session) {
+    let tc = activeTelemetry.get(session);
+    if (!tc) {
+        tc = new TelemetryCapture(session);
+        await tc.start();
+        activeTelemetry.set(session, tc);
+    }
+    return tc;
+}
+export async function browserNetworkIntercept(session, options, _config) {
+    // ── Action: get_telemetry ──────────────────────────────────────────────
+    if (options.action === "get_telemetry") {
+        const tc = activeTelemetry.get(session);
+        if (!tc) {
+            await getOrCreateTelemetry(session);
+            return {
+                success: true,
+                message: "Network telemetry capture started. No network requests recorded yet. Make network requests and call get_telemetry again.",
+                count: 0,
+                requests: []
+            };
+        }
+        const report = await tc.stop();
+        // Restart capture for continuous monitoring
+        await tc.start();
+        let requests = report.networkRequests;
+        if (options.pattern) {
+            const regexPattern = options.pattern.replace(/\*/g, '.*').replace(/\?/g, '.');
+            const reg = new RegExp(regexPattern);
+            requests = requests.filter(r => reg.test(r.url));
+        }
+        return {
+            success: true,
+            message: `Retrieved ${requests.length} captured network request(s) with raw protocol metadata.`,
+            count: requests.length,
+            requests,
+            navigationOccurred: report.navigationOccurred,
+            newUrl: report.newUrl,
+            errors: report.errors
+        };
+    }
+    // ── Action: clear_telemetry ────────────────────────────────────────────
+    if (options.action === "clear_telemetry") {
+        const tc = activeTelemetry.get(session);
+        if (tc) {
+            await tc.start();
+        }
+        else {
+            await getOrCreateTelemetry(session);
+        }
+        return { success: true, message: "Network telemetry buffer cleared and capture reset." };
+    }
+    // Auto-start telemetry background listener when enable/disable is called
+    await getOrCreateTelemetry(session).catch(() => { });
+    const { sendToExtension } = await import("../cdp/helpers.js");
+    const hasExt = await session.Runtime.evaluate({
+        expression: `!!window.__Weavetab`,
+        returnByValue: true
+    }).catch(() => null);
+    if (hasExt?.result?.value) {
+        // ── Extension path (preferred) ────────────────────────────────────────
+        if (options.action === "enable") {
+            if (!options.pattern)
+                throw new Error("enable requires 'pattern'");
+            await sendToExtension(session, {
+                type: 'NETWORK_INTERCEPT_ENABLE',
+                pattern: options.pattern,
+                mockStatus: options.mockStatus || 200,
+                mockBody: options.mockBody || '{}'
+            });
+            activeInterceptors.set(session, { pattern: options.pattern, mockStatus: options.mockStatus || 200, mockBody: options.mockBody || '{}' });
+            return { success: true, message: `Extension interception enabled for ${options.pattern}` };
+        }
+        if (options.action === "disable") {
+            await sendToExtension(session, { type: 'NETWORK_INTERCEPT_DISABLE' });
+            activeInterceptors.delete(session);
+            return { success: true, message: "Extension interception disabled" };
+        }
+    }
+    // ── CDP Fetch domain fallback ───────────────────────────────────────────
+    if (options.action === "enable") {
+        if (!options.pattern)
+            throw new Error("enable requires 'pattern'");
+        const mockStatus = options.mockStatus || 200;
+        const mockBody = options.mockBody || '{}';
+        const regexPattern = options.pattern.replace(/\*/g, '.*').replace(/\?/g, '.');
+        // Remove stale handler from previous enable() to prevent accumulation
+        const oldHandler = activeHandlers.get(session);
+        if (oldHandler) {
+            try {
+                session.removeListener('Fetch.requestPaused', oldHandler);
+            }
+            catch { }
+        }
+        try {
+            await session.Fetch.enable({ patterns: [{ urlPattern: options.pattern, requestStage: 'Response' }] });
+            const handler = async (params) => {
+                if (params.request?.url?.match(new RegExp(regexPattern))) {
+                    await session.Fetch.fulfillRequest({
+                        requestId: params.requestId,
+                        responseCode: mockStatus,
+                        responseHeaders: [{ name: 'Content-Type', value: 'application/json' }],
+                        body: Buffer.from(mockBody).toString('base64'),
+                    }).catch(() => { });
+                }
+                else {
+                    await session.Fetch.continueRequest({ requestId: params.requestId }).catch(() => { });
+                }
+            };
+            session.on('Fetch.requestPaused', handler);
+            activeHandlers.set(session, handler);
+            activeInterceptors.set(session, { pattern: options.pattern, mockStatus, mockBody });
+            return { success: true, message: `CDP Fetch interception enabled for ${options.pattern} (fallback mode)` };
+        }
+        catch (e) {
+            throw new Error(`Failed to enable CDP Fetch interception: ${e.message}`);
+        }
+    }
+    if (options.action === "disable") {
+        try {
+            const existingHandler = activeHandlers.get(session);
+            if (existingHandler) {
+                try {
+                    session.removeListener('Fetch.requestPaused', existingHandler);
+                }
+                catch { }
+                activeHandlers.delete(session);
+            }
+            await session.Fetch.disable().catch(() => { });
+        }
+        catch { /* ignore */ }
+        activeInterceptors.delete(session);
+        return { success: true, message: "CDP Fetch interception disabled" };
+    }
+    throw new Error(`Unknown action: ${options.action}`);
+}

package/dist/tools/office/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Weavetab — tools/office/index.ts
+ * Re-exports office document tools for agent consumption.
+ * Weavetab by fy2ne
+ */
+export { browserOfficeParse } from "./parse.js";
+export type { OfficeParseOptions, OfficeParseResult } from "./parse.js";
+export { browserOfficeList } from "./list.js";
+export type { OfficeListResult } from "./list.js";

package/dist/tools/office/index.js

@@ -0,0 +1,7 @@
+/**
+ * Weavetab — tools/office/index.ts
+ * Re-exports office document tools for agent consumption.
+ * Weavetab by fy2ne
+ */
+export { browserOfficeParse } from "./parse.js";
+export { browserOfficeList } from "./list.js";

package/dist/tools/office/list.d.ts

@@ -0,0 +1,15 @@
+import CDP from "chrome-remote-interface";
+import type { Config } from "../../config/loader.js";
+export interface OfficeListOptions {
+}
+export interface OfficeListResult {
+    success: boolean;
+    files: {
+        filename: string;
+        size: number;
+        created_at: string;
+        extension: string;
+    }[];
+    directory: string;
+}
+export declare function browserOfficeList(session: CDP.Client, options: OfficeListOptions, config: Config): Promise<OfficeListResult>;

package/dist/tools/office/list.js

@@ -0,0 +1,41 @@
+import { getOutputDir } from "../../config/loader.js";
+import fs from "fs";
+import path from "path";
+import { logAction } from "../../audit/logger.js";
+export async function browserOfficeList(session, options, config) {
+    const downloadDir = getOutputDir("downloads", config);
+    if (!fs.existsSync(downloadDir)) {
+        return {
+            success: true,
+            files: [],
+            directory: downloadDir,
+        };
+    }
+    const files = fs.readdirSync(downloadDir);
+    const resultFiles = [];
+    for (const file of files) {
+        const fullPath = path.join(downloadDir, file);
+        try {
+            const stats = fs.statSync(fullPath);
+            if (stats.isFile()) {
+                resultFiles.push({
+                    filename: file,
+                    size: stats.size,
+                    created_at: stats.birthtime.toISOString(),
+                    extension: path.extname(file).toLowerCase(),
+                });
+            }
+        }
+        catch {
+            // Ignore files that can't be statted
+        }
+    }
+    // Sort by newest first
+    resultFiles.sort((a, b) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime());
+    logAction("browser_office_list", "read", `Listed ${resultFiles.length} files in downloads`);
+    return {
+        success: true,
+        files: resultFiles,
+        directory: downloadDir,
+    };
+}

package/dist/tools/office/parse.d.ts

@@ -0,0 +1,20 @@
+import CDP from "chrome-remote-interface";
+import type { Config } from "../../config/loader.js";
+export interface OfficeParseOptions {
+    /** URL to a remote document (PDF, XLSX, DOCX, CSV). Fetched in-browser using the user's active cookies. */
+    url?: string;
+    /** Exact filename from the local downloads directory (legacy mode). */
+    filename?: string;
+    max_rows?: number;
+    max_chars?: number;
+}
+export interface OfficeParseResult {
+    success: boolean;
+    source: string;
+    type: string;
+    content?: string;
+    data?: any;
+    error?: string;
+    truncated?: boolean;
+}
+export declare function browserOfficeParse(session: CDP.Client, options: OfficeParseOptions, config: Config): Promise<OfficeParseResult>;

package/dist/tools/office/parse.js

@@ -0,0 +1,172 @@
+import { getOutputDir } from "../../config/loader.js";
+import fs from "fs";
+import path from "path";
+import { logAction, logDebug } from "../../audit/logger.js";
+// @ts-ignore
+import { parse as parseCsv } from "csv-parse/sync";
+// @ts-ignore
+import pdfParse from "pdf-parse";
+// @ts-ignore
+import mammoth from "mammoth";
+// @ts-ignore
+import * as xlsx from "xlsx";
+/** Fetch a URL inside the browser's context using fetch(), return base64-encoded bytes + MIME type. */
+async function cdpFetchAsBase64(session, url) {
+    const expression = `(async () => {
+    try {
+      const resp = await fetch(${JSON.stringify(url)}, { credentials: 'include' });
+      if (!resp.ok) return JSON.stringify({ error: 'HTTP ' + resp.status + ' ' + resp.statusText });
+      const mime = resp.headers.get('content-type') || 'application/octet-stream';
+      const buf = await resp.arrayBuffer();
+      const bytes = new Uint8Array(buf);
+      let binary = '';
+      for (let i = 0; i < bytes.byteLength; i++) binary += String.fromCharCode(bytes[i]);
+      const b64 = btoa(binary);
+      return JSON.stringify({ base64: b64, mimeType: mime });
+    } catch (e) {
+      return JSON.stringify({ error: e.message || String(e) });
+    }
+  })()`;
+    try {
+        const { result } = await session.Runtime.evaluate({
+            expression,
+            awaitPromise: true,
+            returnByValue: true,
+        });
+        const raw = result?.value;
+        if (!raw)
+            return { error: "No response from in-browser fetch" };
+        return JSON.parse(raw);
+    }
+    catch (e) {
+        return { error: `CDP evaluate failed: ${e.message}` };
+    }
+}
+/** Infer file extension from URL path or MIME type. */
+function inferExtension(url, mimeType) {
+    // Try URL path first
+    try {
+        const pathname = new URL(url).pathname;
+        const ext = path.extname(pathname).toLowerCase();
+        if ([".pdf", ".xlsx", ".xls", ".docx", ".csv"].includes(ext))
+            return ext;
+    }
+    catch { /* ignore */ }
+    // Fall back to MIME type
+    if (mimeType.includes("pdf"))
+        return ".pdf";
+    if (mimeType.includes("spreadsheetml") || mimeType.includes("excel"))
+        return ".xlsx";
+    if (mimeType.includes("wordprocessingml") || mimeType.includes("msword"))
+        return ".docx";
+    if (mimeType.includes("csv") || mimeType.includes("text/plain"))
+        return ".csv";
+    return ".bin";
+}
+async function parseBuffer(buffer, ext, source, max_rows, max_chars) {
+    try {
+        if (ext === ".csv") {
+            const fileContent = buffer.toString("utf-8");
+            const records = parseCsv(fileContent, { columns: true, skip_empty_lines: true });
+            const truncated = records.length > max_rows;
+            const data = truncated ? records.slice(0, max_rows) : records;
+            return { success: true, source, type: "csv", data, truncated };
+        }
+        if (ext === ".pdf") {
+            const data = await pdfParse(buffer);
+            let text = data.text;
+            let truncated = false;
+            if (text.length > max_chars) {
+                text = text.substring(0, max_chars) + "\n...[TRUNCATED]...";
+                truncated = true;
+            }
+            return {
+                success: true,
+                source,
+                type: "pdf",
+                content: text.trim(),
+                truncated,
+                data: { numpages: data.numpages, info: data.info },
+            };
+        }
+        if (ext === ".docx") {
+            const result = await mammoth.extractRawText({ buffer });
+            let text = result.value;
+            let truncated = false;
+            if (text.length > max_chars) {
+                text = text.substring(0, max_chars) + "\n...[TRUNCATED]...";
+                truncated = true;
+            }
+            const warnings = result.messages.map((m) => m.message);
+            if (warnings.length > 0)
+                logDebug(`[Office] Mammoth warnings: ${warnings.join(", ")}`);
+            return { success: true, source, type: "docx", content: text.trim(), truncated };
+        }
+        if (ext === ".xlsx" || ext === ".xls") {
+            const workbook = xlsx.read(buffer, { type: "buffer" });
+            const resultData = {};
+            let truncated = false;
+            for (const sheetName of workbook.SheetNames) {
+                const sheet = workbook.Sheets[sheetName];
+                const records = xlsx.utils.sheet_to_json(sheet);
+                if (records.length > max_rows) {
+                    resultData[sheetName] = records.slice(0, max_rows);
+                    truncated = true;
+                }
+                else {
+                    resultData[sheetName] = records;
+                }
+            }
+            return { success: true, source, type: "excel", data: resultData, truncated };
+        }
+        return {
+            success: false,
+            source,
+            type: ext,
+            error: `Unsupported file type: ${ext}. Supported: .csv, .pdf, .docx, .xlsx, .xls`,
+        };
+    }
+    catch (error) {
+        return { success: false, source, type: ext, error: `Failed to parse: ${error.message}` };
+    }
+}
+export async function browserOfficeParse(session, options, config) {
+    const { url, filename, max_rows = 500, max_chars = 50000 } = options;
+    if (!url && !filename) {
+        return { success: false, source: "", type: "unknown", error: "Provide either 'url' (remote document) or 'filename' (local download)." };
+    }
+    // ── URL mode: fetch in-browser via CDP Runtime.evaluate ───────────────────
+    if (url) {
+        logAction("browser_office_parse", "url", `Fetching ${url}`);
+        const fetchResult = await cdpFetchAsBase64(session, url);
+        if ("error" in fetchResult) {
+            return { success: false, source: url, type: "unknown", error: `Fetch failed: ${fetchResult.error}` };
+        }
+        const { base64, mimeType } = fetchResult;
+        const ext = inferExtension(url, mimeType);
+        const buffer = Buffer.from(base64, "base64");
+        logDebug(`[Office] URL fetch: ${url} → ${ext} (${buffer.length} bytes, mime=${mimeType})`);
+        logAction("browser_office_parse", ext, `Parsing ${url} (${buffer.length} bytes)`);
+        return parseBuffer(buffer, ext, url, max_rows, max_chars);
+    }
+    // ── Filename mode: legacy local file parsing ───────────────────────────────
+    if (filename) {
+        // Security: prevent path traversal
+        if (filename.includes("..") ||
+            filename.includes("/") ||
+            filename.includes("\\") ||
+            path.basename(filename) !== filename) {
+            return { success: false, source: filename, type: "unknown", error: "Invalid filename — must be a bare filename, not a path" };
+        }
+        const downloadDir = getOutputDir("downloads", config);
+        const filePath = path.join(downloadDir, filename);
+        if (!fs.existsSync(filePath)) {
+            return { success: false, source: filename, type: "unknown", error: `File not found: ${filename}` };
+        }
+        const ext = path.extname(filename).toLowerCase();
+        logAction("browser_office_parse", ext, `Parsing local file ${filename}`);
+        const buffer = fs.readFileSync(filePath);
+        return parseBuffer(buffer, ext, filename, max_rows, max_chars);
+    }
+    return { success: false, source: "", type: "unknown", error: "Unreachable" };
+}

package/dist/tools/pdf.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Weavetab — tools/pdf.ts
+ * browser_pdf: Generate a PDF of the current page.
+ * Weavetab by fy2ne
+ */
+import CDP from "chrome-remote-interface";
+import type { Config } from "../config/loader.js";
+export interface PdfOptions {
+    landscape?: boolean;
+    scale?: number;
+    pageRanges?: string;
+    filename?: string;
+    /** If false, keeps the WeaveTab UI overlay visible in the PDF.
+     * Default: true — overlay (cursor, thought bubble, HUD) is always hidden from PDFs. */
+    hideOverlay?: boolean;
+}
+export declare function browserPdf(session: CDP.Client, options: PdfOptions, config: Config): Promise<{
+    success: boolean;
+    path: string;
+    size: string;
+    filename: string;
+}>;