@weavetab/mcp 2.5.0-beta.0

package/dist/audit/logger.js

@@ -0,0 +1,177 @@
+/**
+ * Weavetab — audit/logger.ts
+ * Appends structured action records to ~/.weavetab-system/logs/mission_<timestamp>.log and JSON lines to mission_<timestamp>.jsonl.
+ * Only writes logs when devMode is true to prevent storage spam.
+ * Weavetab by fy2ne
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { broadcastTelemetry } from "./telemetry.js";
+import { getSystemDir, getCachedConfig } from "../config/loader.js";
+// Mission logs always go to the system dir (~/.weavetab-system/logs)
+// to avoid polluting user workspaces with large log files.
+const missionId = new Date().toISOString().replace(/[:.]/g, "-");
+function getLogDir() { return getSystemDir("logs"); }
+function getLogPath() { return path.join(getLogDir(), `mission_${missionId}.log`); }
+function getJsonLogPath() { return path.join(getLogDir(), `mission_${missionId}.jsonl`); }
+// Check if logging should be enabled based on devMode
+let _isCheckingConfig = false;
+function isLoggingEnabled() {
+    if (_isCheckingConfig)
+        return false;
+    try {
+        _isCheckingConfig = true;
+        const config = getCachedConfig();
+        return config ? (config.devMode || false) : false;
+    }
+    catch {
+        return false; // Fail safe - no logging if config can't be read
+    }
+    finally {
+        _isCheckingConfig = false;
+    }
+}
+// Redact sensitive data patterns from logs
+function redactSensitiveData(text) {
+    if (!text || typeof text !== 'string')
+        return text;
+    let redacted = text;
+    // Redact common secret patterns
+    const patterns = [
+        // API keys, tokens, secrets in URLs
+        /([?&](api_key|token|secret|password|credential|auth|access_token|refresh_token)=[^&\s]+)/gi,
+        // Bearer tokens
+        /(Bearer\s+[A-Za-z0-9\-._~+/]+)/gi,
+        // Basic auth in URLs
+        /(\/\/[^:]+:[^@]+@)/g,
+        // UUIDs that might be tokens
+        /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/gi,
+        // Long alphanumeric strings that might be keys (30+ chars)
+        /\b[A-Za-z0-9+/]{30,}={0,2}\b/g,
+    ];
+    for (const pattern of patterns) {
+        redacted = redacted.replace(pattern, (match) => {
+            // Keep the parameter name but redact the value
+            if (match.includes('=')) {
+                const [key, value] = match.split('=');
+                return `${key}=[REDACTED]`;
+            }
+            return '[REDACTED]';
+        });
+    }
+    return redacted;
+}
+const plainBuffer = { lines: [], timer: null };
+const jsonBuffer = { lines: [], timer: null };
+function scheduleFlush(buffer, filePath) {
+    if (buffer.timer)
+        return; // already scheduled
+    buffer.timer = setTimeout(() => {
+        buffer.timer = null;
+        if (buffer.lines.length === 0)
+            return;
+        const chunk = buffer.lines.join("");
+        buffer.lines = [];
+        fs.appendFile(filePath, chunk, () => { });
+    }, 100);
+    buffer.timer.unref?.();
+}
+// On exit, flush remaining buffered lines synchronously so no log is lost
+process.on("exit", () => {
+    try {
+        if (plainBuffer.lines.length > 0) {
+            if (plainBuffer.timer) {
+                clearTimeout(plainBuffer.timer);
+                plainBuffer.timer = null;
+            }
+            fs.appendFileSync(getLogPath(), plainBuffer.lines.join(""), "utf-8");
+            plainBuffer.lines = [];
+        }
+        if (jsonBuffer.lines.length > 0) {
+            if (jsonBuffer.timer) {
+                clearTimeout(jsonBuffer.timer);
+                jsonBuffer.timer = null;
+            }
+            fs.appendFileSync(getJsonLogPath(), jsonBuffer.lines.join(""), "utf-8");
+            jsonBuffer.lines = [];
+        }
+    }
+    catch { /* ignore — best-effort */ }
+});
+export function logAction(action, target, result) {
+    try {
+        // Redact sensitive data before logging
+        // Use a session-agnostic redaction for general logs (no specific session ID)
+        const redactedTarget = redactSensitiveData(target);
+        const redactedResult = redactSensitiveData(result);
+        // Always broadcast telemetry (separate from file logging)
+        broadcastTelemetry({ type: "log", payload: { action, target: redactedTarget, result: redactedResult } });
+        // Only write to log files if devMode is enabled
+        if (!isLoggingEnabled()) {
+            return;
+        }
+        const timestamp = new Date().toISOString();
+        const paddedAction = action.padEnd(10);
+        const line = `[${timestamp}]  ${paddedAction}  ${redactedTarget}  →  ${redactedResult}\n`;
+        // Ensure the log directory exists (only if we're about to write the first line)
+        if (plainBuffer.lines.length === 0) {
+            const dir = getLogDir();
+            if (!fs.existsSync(dir))
+                fs.mkdirSync(dir, { recursive: true });
+        }
+        plainBuffer.lines.push(line);
+        scheduleFlush(plainBuffer, getLogPath());
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[!] Weave warning: Failed to write audit log: ${msg}\n`);
+    }
+}
+export function logActionStructured(entry) {
+    try {
+        // Redact sensitive data before logging
+        const redactedEntry = {
+            ...entry,
+            parameters: entry.parameters ? redactSensitiveDataInObject(entry.parameters) : undefined,
+            pageUrl: entry.pageUrl ? redactSensitiveData(entry.pageUrl) : undefined,
+            result: entry.result ? redactSensitiveData(entry.result) : "",
+        };
+        // Only write to log files if devMode is enabled
+        if (!isLoggingEnabled()) {
+            return;
+        }
+        const line = JSON.stringify(redactedEntry) + "\n";
+        if (jsonBuffer.lines.length === 0) {
+            const dir = getLogDir();
+            if (!fs.existsSync(dir))
+                fs.mkdirSync(dir, { recursive: true });
+        }
+        jsonBuffer.lines.push(line);
+        scheduleFlush(jsonBuffer, getJsonLogPath());
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[!] Weave warning: Failed to write structured audit log: ${msg}\n`);
+    }
+}
+// Recursively redact sensitive data in objects
+function redactSensitiveDataInObject(obj) {
+    const result = {};
+    for (const [key, value] of Object.entries(obj)) {
+        if (typeof value === 'string') {
+            result[key] = redactSensitiveData(value);
+        }
+        else if (typeof value === 'object' && value !== null) {
+            result[key] = redactSensitiveDataInObject(value);
+        }
+        else {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+export function logDebug(message, ...optionalParams) {
+    if (!isLoggingEnabled())
+        return;
+    process.stderr.write(`${message} ${optionalParams.join(' ')}\n`);
+}

package/dist/audit/telemetry.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Weavetab — audit/telemetry.ts
+ * UDP IPC for broadcasting live telemetry to the CLI dashboard without breaking stdio MCP.
+ * Also tracks tool usage analytics locally (Phase 10g).
+ * Weavetab by fy2ne
+ */
+export interface TelemetryEvent {
+    type: "log" | "state" | "browser" | "tool_start" | "tool_end" | "chat";
+    timestamp: number;
+    payload: any;
+}
+export interface ToolUsageEntry {
+    tool: string;
+    domain: string;
+    duration: number;
+    success: boolean;
+    timestamp: string;
+}
+export interface ToolUsageStats {
+    totalCalls: number;
+    perTool: Record<string, {
+        calls: number;
+        failures: number;
+        avgDurationMs: number;
+    }>;
+    perDomain: Record<string, {
+        calls: number;
+        failures: number;
+    }>;
+    recentEntries: ToolUsageEntry[];
+}
+export declare function recordToolUsage(entry: ToolUsageEntry): void;
+export declare function getToolUsageStats(): ToolUsageStats;
+export declare function clearToolUsageStats(): void;
+/** Broadcast a telemetry event to any listening dashboard (wb run) */
+export declare function broadcastTelemetry(event: Omit<TelemetryEvent, "timestamp">): void;

package/dist/audit/telemetry.js

@@ -0,0 +1,162 @@
+/**
+ * Weavetab — audit/telemetry.ts
+ * UDP IPC for broadcasting live telemetry to the CLI dashboard without breaking stdio MCP.
+ * Also tracks tool usage analytics locally (Phase 10g).
+ * Weavetab by fy2ne
+ */
+import * as dgram from "node:dgram";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+import * as crypto from "node:crypto";
+const TELEMETRY_PORT = 9223;
+const STATS_FILE = path.join(os.homedir(), ".weavetab-system", "stats.json");
+let udpSocket = null;
+// Generate or load telemetry secret for authentication
+const TELEMETRY_SECRET_FILE = path.join(os.homedir(), ".weavetab-system", "telemetry-secret");
+let telemetrySecret;
+function getTelemetrySecret() {
+    if (telemetrySecret)
+        return telemetrySecret;
+    try {
+        if (fs.existsSync(TELEMETRY_SECRET_FILE)) {
+            telemetrySecret = fs.readFileSync(TELEMETRY_SECRET_FILE, "utf-8").trim();
+        }
+        else {
+            telemetrySecret = crypto.randomBytes(32).toString("hex");
+            const dir = path.dirname(TELEMETRY_SECRET_FILE);
+            if (!fs.existsSync(dir))
+                fs.mkdirSync(dir, { recursive: true });
+            fs.writeFileSync(TELEMETRY_SECRET_FILE, telemetrySecret, { mode: 0o600 });
+        }
+    }
+    catch {
+        telemetrySecret = crypto.randomBytes(32).toString("hex");
+    }
+    return telemetrySecret;
+}
+let statsCache = null;
+function loadStats() {
+    if (statsCache)
+        return statsCache;
+    try {
+        const data = fs.readFileSync(STATS_FILE, "utf-8");
+        statsCache = JSON.parse(data);
+        return statsCache;
+    }
+    catch {
+        statsCache = {
+            totalCalls: 0,
+            perTool: {},
+            perDomain: {},
+            recentEntries: [],
+        };
+        return statsCache;
+    }
+}
+let statsDirty = false;
+let saveStatsTimer = null;
+function saveStats() {
+    if (!statsCache)
+        return;
+    // Mark as dirty and schedule an async flush at most once per 5 seconds.
+    // Previously this was a synchronous writeFileSync on every tool call,
+    // blocking the event loop. Now we batch writes to avoid that overhead.
+    statsDirty = true;
+    if (!saveStatsTimer) {
+        saveStatsTimer = setTimeout(() => {
+            saveStatsTimer = null;
+            if (!statsDirty || !statsCache)
+                return;
+            statsDirty = false;
+            const dir = path.dirname(STATS_FILE);
+            try {
+                if (!fs.existsSync(dir))
+                    fs.mkdirSync(dir, { recursive: true });
+                const data = JSON.stringify(statsCache, null, 2);
+                fs.writeFile(STATS_FILE, data, () => { });
+            }
+            catch { /* ignore */ }
+        }, 5000);
+        // Allow the timer to not prevent process exit
+        saveStatsTimer.unref?.();
+    }
+}
+// Flush remaining dirty stats synchronously on exit so no data is lost
+process.on("exit", () => {
+    if (!statsDirty || !statsCache)
+        return;
+    try {
+        const dir = path.dirname(STATS_FILE);
+        if (!fs.existsSync(dir))
+            fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(STATS_FILE, JSON.stringify(statsCache, null, 2));
+    }
+    catch { /* ignore */ }
+});
+export function recordToolUsage(entry) {
+    const s = loadStats();
+    s.totalCalls++;
+    if (!s.perTool[entry.tool])
+        s.perTool[entry.tool] = { calls: 0, failures: 0, avgDurationMs: 0 };
+    const t = s.perTool[entry.tool];
+    t.calls++;
+    if (!entry.success)
+        t.failures++;
+    t.avgDurationMs = Math.round((t.avgDurationMs * (t.calls - 1) + entry.duration) / t.calls);
+    const domain = entry.domain || "(unknown)";
+    if (!s.perDomain[domain])
+        s.perDomain[domain] = { calls: 0, failures: 0 };
+    s.perDomain[domain].calls++;
+    if (!entry.success)
+        s.perDomain[domain].failures++;
+    s.recentEntries.unshift(entry);
+    if (s.recentEntries.length > 1000)
+        s.recentEntries.length = 1000;
+    saveStats();
+}
+export function getToolUsageStats() {
+    return loadStats();
+}
+export function clearToolUsageStats() {
+    statsCache = {
+        totalCalls: 0,
+        perTool: {},
+        perDomain: {},
+        recentEntries: [],
+    };
+    saveStats();
+}
+/** Broadcast a telemetry event to any listening dashboard (wb run) */
+export function broadcastTelemetry(event) {
+    if (!udpSocket) {
+        try {
+            udpSocket = dgram.createSocket("udp4");
+            // Prevent the socket from keeping the process alive
+            udpSocket.unref();
+        }
+        catch {
+            return;
+        }
+    }
+    const fullEvent = {
+        ...event,
+        timestamp: Date.now()
+    };
+    try {
+        const secret = getTelemetrySecret();
+        const payload = JSON.stringify(fullEvent);
+        const signature = crypto.createHmac("sha256", secret).update(payload).digest("hex");
+        const message = {
+            sig: signature,
+            payload: payload
+        };
+        const msg = Buffer.from(JSON.stringify(message) + "\n");
+        udpSocket.send(msg, 0, msg.length, TELEMETRY_PORT, "127.0.0.1", (err) => {
+            // Ignore broadcast errors (e.g. no dashboard listening)
+        });
+    }
+    catch {
+        // Ignore stringify/send errors
+    }
+}

package/dist/cdp/bridge.d.ts

@@ -0,0 +1,16 @@
+import type { Config, BrowserEngine } from "../config/loader.js";
+import CDP from "chrome-remote-interface";
+export interface BrowserInfo {
+    name: string;
+    path: string;
+}
+export declare function findBrowser(preferred?: string): BrowserInfo | null;
+export declare function findFirefox(): BrowserInfo | null;
+export declare function probeAllBrowsers(): BrowserInfo[];
+export declare function launchWithBridge(config: Config): Promise<{
+    path: string;
+    name: string;
+    port: number;
+    engine?: BrowserEngine;
+}>;
+export declare function injectStealthScript(session: CDP.Client): Promise<void>;