@weavetab/mcp 2.5.0-beta.1 → 2.5.0-beta.2

package/dist/cdp/bridge.js

@@ -12,8 +12,9 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import CDP from "chrome-remote-interface";
 import { readLock, writeLock, clearLock, isLockValid, isLockPending } from "./lock.js";
-import { getSessionProfile } from "./profiles.js";
-import { getOutputDir, getDownloadDir, getConfigHeadless, getConfigProxy, getConfigDisableExtensions, getConfigDevMode, getConfigBlock, getConfigAllow, getConfigBrowserType, getConfigBrowserPath, getConfigBrowserFlags, getConfigCookies, getConfigProfileDir, getSystemDir } from "../config/loader.js";
+import { getSessionProfile, getElectronProfile } from "./profiles.js";
+import net from "node:net";
+import { getOutputDir, getDownloadDir, getConfigHeadless, getConfigProxy, getConfigDevMode, getConfigBlock, getConfigAllow, getConfigBrowserType, getConfigBrowserPath, getConfigBrowserFlags, getConfigCookies, getConfigProfileDir, getSystemDir, getElectronAppConfig, getConfigExtension } from "../config/loader.js";
 import { createBrowserFingerprint } from "./security.js";
 function withCDPTimeout(promise, ms, label) {
     return Promise.race([
@@ -97,6 +98,37 @@ function isValidBrowserPath(browserPath) {
     }
     return true;
 }
+export function isValidElectronExecutablePath(execPath) {
+    if (!execPath || typeof execPath !== "string")
+        return false;
+    const normalizedPath = execPath.toLowerCase().trim();
+    // Check for suspicious patterns that might indicate command injection or shell escapes
+    const suspiciousPatterns = [
+        '..', // path traversal
+        '%', // URL encoding
+        'cmd.exe', 'powershell.exe', 'bash', 'sh', 'wscript.exe', 'cscript.exe'
+    ];
+    if (suspiciousPatterns.some(pattern => normalizedPath.includes(pattern))) {
+        logDebug(`[SECURITY] Electron path validation failed: suspicious pattern in path: ${execPath}`);
+        return false;
+    }
+    // Verify that the file actually exists
+    try {
+        if (!fs.existsSync(execPath)) {
+            logDebug(`[SECURITY] Electron path validation failed: file does not exist: ${execPath}`);
+            return false;
+        }
+        const stat = fs.statSync(execPath);
+        if (!stat.isFile()) {
+            logDebug(`[SECURITY] Electron path validation failed: target is not a file: ${execPath}`);
+            return false;
+        }
+    }
+    catch {
+        return false;
+    }
+    return true;
+}
 function pathsForPlatform(browserName) {
     const plat = os.platform();
     const winPaths = [];
@@ -424,14 +456,6 @@ function getLaunchFlags(config, extPath) {
         flags.push("--headless=new");
     if (getConfigProxy(config))
         flags.push(`--proxy-server=${getConfigProxy(config)}`);
-    // disableExtensions: NOTE — --disable-extensions kills ALL extensions including ours.
-    // --load-extension does NOT reliably override --disable-extensions on Edge.
-    // Since we can't disable other extensions while keeping ours (unpacked extensions
-    // have unpredictable IDs), we skip the flag entirely and let other extensions coexist.
-    // The user can manually disable extensions in their browser profile if needed.
-    if (getConfigDisableExtensions(config)) {
-        logDebug("[Weavetab] [SAFETY] disableExtensions=true — cannot safely disable other extensions while keeping Weavetab extension. Loading extension alongside any existing ones.");
-    }
     // devMode: enable verbose remote debugging
     if (getConfigDevMode(config)) {
         flags.push("--enable-logging", "--v=1");
@@ -477,7 +501,7 @@ export async function launchWithBridge(config) {
             "  - Google Chrome (https://www.google.com/chrome/)\n" +
             "  - Brave (https://brave.com/)\n" +
             "  - Microsoft Edge (https://www.microsoft.com/edge)\n" +
-            "  If you have a browser installed in a custom location, set it via: wt config browserPath \"/path/to/browser\"");
+            "  If you have a browser installed in a custom location, set it via: weavetab config browserPath \"/path/to/browser\"");
     }
     const debugPort = 0;
     const lock = readLock();
@@ -524,45 +548,53 @@ export async function launchWithBridge(config) {
             await new Promise(r => setTimeout(r, 1500));
         }
         try {
-            let extPath = path.resolve(__dirname, "../../ext-dist");
-            const systemExtPath = getSystemDir("extension");
-            if (fs.existsSync(extPath)) {
-                try {
-                    fs.cpSync(extPath, systemExtPath, { recursive: true, force: true });
+            const enableExtension = getConfigExtension(config) !== false;
+            let extPath = "";
+            let normalizedExtPath = "";
+            if (enableExtension) {
+                extPath = path.resolve(__dirname, "../../ext-dist");
+                const systemExtPath = getSystemDir("extension");
+                if (fs.existsSync(extPath)) {
+                    try {
+                        fs.cpSync(extPath, systemExtPath, { recursive: true, force: true });
+                    }
+                    catch (e) {
+                        logDebug(`[Weavetab] Failed to sync extension to system directory: ${e}`);
+                    }
                 }
-                catch (e) {
-                    logDebug(`[Weavetab] Failed to sync extension to system directory: ${e}`);
+                else {
+                    if (fs.existsSync(systemExtPath)) {
+                        logDebug(`[Weavetab] Local extension missing. Falling back to system extension directory.`);
+                        extPath = systemExtPath;
+                    }
+                    else {
+                        throw new Error(`[Weavetab] Extension directory does not exist: ${extPath}. Build the extension first.`);
+                    }
                 }
-            }
-            else {
-                if (fs.existsSync(systemExtPath)) {
-                    logDebug(`[Weavetab] Local extension missing. Falling back to system extension directory.`);
-                    extPath = systemExtPath;
+                const manifestPath = path.join(extPath, "manifest.json");
+                const contentPath = path.join(extPath, "content.js");
+                const backgroundPath = path.join(extPath, "background.js");
+                if (!fs.existsSync(manifestPath)) {
+                    throw new Error(`[Weavetab] Extension manifest missing: ${manifestPath}`);
                 }
-                else {
-                    throw new Error(`[Weavetab] Extension directory does not exist: ${extPath}. Build the extension first.`);
+                if (!fs.existsSync(contentPath)) {
+                    throw new Error(`[Weavetab] Extension content script missing: ${contentPath}`);
                 }
+                if (!fs.existsSync(backgroundPath)) {
+                    throw new Error(`[Weavetab] Extension background script missing: ${backgroundPath}`);
+                }
+                normalizedExtPath = os.platform() === 'win32'
+                    ? extPath.replace(/\//g, '\\')
+                    : extPath;
             }
-            const manifestPath = path.join(extPath, "manifest.json");
-            const contentPath = path.join(extPath, "content.js");
-            const backgroundPath = path.join(extPath, "background.js");
-            if (!fs.existsSync(manifestPath)) {
-                throw new Error(`[Weavetab] Extension manifest missing: ${manifestPath}`);
-            }
-            if (!fs.existsSync(contentPath)) {
-                throw new Error(`[Weavetab] Extension content script missing: ${contentPath}`);
-            }
-            if (!fs.existsSync(backgroundPath)) {
-                throw new Error(`[Weavetab] Extension background script missing: ${backgroundPath}`);
+            else {
+                logDebug(`[Weavetab] Browser extension loading disabled via config (extension: false).`);
             }
             const resolvedDownloadDir = getDownloadDir(config) && getDownloadDir(config).trim()
                 ? getDownloadDir(config).trim()
                 : getOutputDir("downloads", config);
             // Normalize paths for cross-platform compatibility
             const platform = os.platform();
-            const normalizedExtPath = platform === 'win32'
-                ? extPath.replace(/\//g, '\\')
-                : extPath;
             const normalizedProfileDir = platform === 'win32'
                 ? profileDir.replace(/\//g, '\\')
                 : profileDir;
@@ -584,40 +616,34 @@ export async function launchWithBridge(config) {
                     fs.unlinkSync(singletonCookie);
             }
             catch { /* non-fatal */ }
-            // Wipe the MV3 service worker cache before every launch so Chrome always
-            // executes the latest background.js from disk rather than a stale cached
-            // script stored in the profile. Without this, edits to ext-dist/background.js
-            // have no effect until Chrome manually reloads the extension — the SW cache
-            // (Default/Service Worker/ScriptCache + Default/Service Worker/Database) is
-            // keyed by URL hash and persists across sessions in the user-data-dir.
-            // This ensures any future background.js change takes effect immediately
-            // on all existing profiles without manual cache clearing.
-            try {
-                const swBase = path.join(profileDir, "Default", "Service Worker");
-                const swScriptCache = path.join(swBase, "ScriptCache");
-                const swDatabase = path.join(swBase, "Database");
-                if (fs.existsSync(swScriptCache)) {
-                    fs.rmSync(swScriptCache, { recursive: true, force: true });
-                    logDebug("[Weavetab] Wiped SW ScriptCache to force background.js reload.");
+            if (enableExtension) {
+                // Wipe the MV3 service worker cache before every launch so Chrome always
+                // executes the latest background.js from disk rather than a stale cached
+                // script stored in the profile.
+                try {
+                    const swBase = path.join(profileDir, "Default", "Service Worker");
+                    const swScriptCache = path.join(swBase, "ScriptCache");
+                    const swDatabase = path.join(swBase, "Database");
+                    if (fs.existsSync(swScriptCache)) {
+                        fs.rmSync(swScriptCache, { recursive: true, force: true });
+                        logDebug("[Weavetab] Wiped SW ScriptCache to force background.js reload.");
+                    }
+                    if (fs.existsSync(swDatabase)) {
+                        fs.rmSync(swDatabase, { recursive: true, force: true });
+                        logDebug("[Weavetab] Wiped SW Database to force background.js reload.");
+                    }
                 }
-                if (fs.existsSync(swDatabase)) {
-                    fs.rmSync(swDatabase, { recursive: true, force: true });
-                    logDebug("[Weavetab] Wiped SW Database to force background.js reload.");
+                catch (swErr) {
+                    logDebug(`[Weavetab] SW cache wipe failed (non-fatal): ${swErr}`);
                 }
             }
-            catch (swErr) {
-                logDebug(`[Weavetab] SW cache wipe failed (non-fatal): ${swErr}`);
-            }
             const args = [
                 `--remote-debugging-port=${debugPort}`,
                 `--user-data-dir=${normalizedProfileDir}`,
                 `--default-download-dir=${normalizedDownloadDir}`,
                 ...getLaunchFlags(config, extPath),
                 ...filterBrowserFlags(getConfigBrowserFlags(config) || []),
-                `--load-extension=${normalizedExtPath}`,
-                // NOTE: --disable-extensions-except was removed. It was killing any
-                // extensions the user manually loaded into the Weavetab profile.
-                // --load-extension alone is sufficient to auto-load the Weavetab extension.
+                ...(enableExtension ? [`--load-extension=${normalizedExtPath}`] : []),
                 "about:blank",
             ];
             let pid;
@@ -686,25 +712,27 @@ export async function launchWithBridge(config) {
             }
             else {
                 logDebug(`[Weavetab] [OK] ${browser.name} ready on :${actualPort} (attempt ${attempt})`);
-                // Verify extension loaded by checking for extension pages.
+                // Verify extension loaded by checking for extension pages if extension is enabled.
                 // MV3 service workers can take 1-3s to initialize after Chrome starts,
                 // so we wait briefly before querying targets.
-                try {
-                    await new Promise(r => setTimeout(r, 1500));
-                    const testSession = await withCDPTimeout(CDP({ host: "127.0.0.1", port: actualPort }), 4000, "CDP connect");
-                    const { targetInfos } = await withCDPTimeout(testSession.Target.getTargets(), 4000, "getTargets");
-                    const extensionTargets = targetInfos.filter(t => t.type === "service_worker" || (t.type === "page" && t.url.startsWith("chrome-extension://")));
-                    await testSession.close();
-                    if (extensionTargets.length > 0) {
-                        logDebug(`[Weavetab] [OK] Extension loaded - found ${extensionTargets.length} extension target(s)`);
+                if (enableExtension) {
+                    try {
+                        await new Promise(r => setTimeout(r, 1500));
+                        const testSession = await withCDPTimeout(CDP({ host: "127.0.0.1", port: actualPort }), 4000, "CDP connect");
+                        const { targetInfos } = await withCDPTimeout(testSession.Target.getTargets(), 4000, "getTargets");
+                        const extensionTargets = targetInfos.filter(t => t.type === "service_worker" || (t.type === "page" && t.url.startsWith("chrome-extension://")));
+                        await testSession.close();
+                        if (extensionTargets.length > 0) {
+                            logDebug(`[Weavetab] [OK] Extension loaded - found ${extensionTargets.length} extension target(s)`);
+                        }
+                        else {
+                            logDebug(`[Weavetab] [!] Extension may not have loaded - no extension targets found. Check chrome://extensions in the browser.`);
+                        }
                     }
-                    else {
-                        logDebug(`[Weavetab] [!] Extension may not have loaded - no extension targets found. Check chrome://extensions in the browser.`);
+                    catch (extCheckErr) {
+                        logDebug(`[Weavetab] [!] Could not verify extension load: ${extCheckErr}`);
                     }
                 }
-                catch (extCheckErr) {
-                    logDebug(`[Weavetab] [!] Could not verify extension load: ${extCheckErr}`);
-                }
             }
             await writeLock({ pid, port: actualPort, profileDir, browserPath: browser.path, mode: "session", pending: false });
             recordLaunchSuccess(profileDir);
@@ -838,3 +866,181 @@ async function resolvePortFromStderr(proc, pid, _engine) {
         });
     });
 }
+export async function getFreePort(preferredPort = 9222) {
+    const isAvailable = (p) => {
+        return new Promise((resolve) => {
+            const s = net.createServer();
+            s.once("error", () => resolve(false));
+            s.once("listening", () => {
+                s.close(() => resolve(true));
+            });
+            s.listen(p, "127.0.0.1");
+        });
+    };
+    if (preferredPort > 0 && (await isAvailable(preferredPort))) {
+        return preferredPort;
+    }
+    return new Promise((resolve, reject) => {
+        const s = net.createServer();
+        s.once("error", reject);
+        s.once("listening", () => {
+            const addr = s.address();
+            const p = typeof addr === "object" && addr ? addr.port : 9222;
+            s.close(() => resolve(p));
+        });
+        s.listen(0, "127.0.0.1");
+    });
+}
+export function testPortListening(port) {
+    return new Promise((resolve) => {
+        const socket = new net.Socket();
+        const timeout = setTimeout(() => {
+            socket.destroy();
+            resolve(false);
+        }, 1000);
+        socket.connect(port, "127.0.0.1", () => {
+            clearTimeout(timeout);
+            socket.destroy();
+            resolve(true);
+        });
+        socket.on("error", () => {
+            clearTimeout(timeout);
+            resolve(false);
+        });
+    });
+}
+export async function launchElectronApp(appName, config) {
+    const appCfg = getElectronAppConfig(appName, config);
+    if (!appCfg) {
+        throw new Error(`[Weavetab] ✗ Electron app "${appName}" is not configured in config.json.\n` +
+            `  Please add an entry under "electron": { "${appName}": "C:\\\\path\\\\to\\\\app.exe" } in your config.`);
+    }
+    // 1. Direct port dev attach mode (e.g., dev server or npm run dev)
+    if (appCfg.port && !appCfg.path) {
+        const isAlive = await testPortListening(appCfg.port);
+        if (isAlive) {
+            logDebug(`[Weavetab] Attached to live Electron dev server on port ${appCfg.port}`);
+            return { path: "dev-server", name: appName, port: appCfg.port, engine: "chromium", isElectron: true };
+        }
+        throw new Error(`[Weavetab] ✗ Electron dev app "${appName}" on port ${appCfg.port} is not responding. Ensure your dev server is running.`);
+    }
+    // 2. Direct URL dev attach mode
+    if (appCfg.url && !appCfg.path) {
+        try {
+            const parsed = new URL(appCfg.url);
+            const port = parseInt(parsed.port || (parsed.protocol === "https:" ? "443" : "80"), 10);
+            const isAlive = await testPortListening(port);
+            if (isAlive) {
+                logDebug(`[Weavetab] Attached to live Electron app at ${appCfg.url} (port ${port})`);
+                return { path: appCfg.url, name: appName, port, engine: "chromium", isElectron: true };
+            }
+            throw new Error(`[Weavetab] ✗ Electron dev app "${appName}" at ${appCfg.url} is not responding.`);
+        }
+        catch (e) {
+            throw new Error(`[Weavetab] ✗ Invalid or unreachable dev URL for "${appName}": ${e?.message || e}`);
+        }
+    }
+    const execPath = appCfg.path;
+    if (!execPath || !isValidElectronExecutablePath(execPath)) {
+        throw new Error(`[Weavetab] ✗ Invalid or non-existent Electron executable path for "${appName}": ${execPath}`);
+    }
+    // Check app-scoped lock
+    const lock = readLock(appName);
+    if (lock && lock.mode === "session") {
+        if (isLockPending(lock)) {
+            logDebug(`[Weavetab] Launch already in progress for ${appName} (PID: ${lock.pid}). Waiting...`);
+            throw new Error(`Launch already in progress for ${appName}. Wait for it to complete.`);
+        }
+        const valid = await isLockValid(lock);
+        if (valid) {
+            logDebug(`[Weavetab] [OK] Reusing valid Electron lock for ${appName} (PID: ${lock.pid}, Port: ${lock.port})`);
+            return { path: execPath, name: appName, port: lock.port, engine: "chromium", isElectron: true };
+        }
+        logDebug(`[Weavetab] [!] Stale lock detected for ${appName}. Clearing.`);
+        clearLock(appName);
+    }
+    else if (lock) {
+        clearLock(appName);
+    }
+    const profileDir = getElectronProfile(appName, appCfg.profileDir);
+    const actualPort = appCfg.port && appCfg.port > 0 ? appCfg.port : await getFreePort(9222);
+    // Clean up SingletonLock
+    const singletonLock = path.join(profileDir, "SingletonLock");
+    const singletonCookie = path.join(profileDir, "SingletonCookie");
+    try {
+        if (fs.existsSync(singletonLock))
+            fs.unlinkSync(singletonLock);
+    }
+    catch { /* non-fatal */ }
+    try {
+        if (fs.existsSync(singletonCookie))
+            fs.unlinkSync(singletonCookie);
+    }
+    catch { /* non-fatal */ }
+    const platform = os.platform();
+    const normalizedProfileDir = platform === 'win32'
+        ? profileDir.replace(/\//g, '\\')
+        : profileDir;
+    const resolvedDownloadDir = getDownloadDir(config) && getDownloadDir(config).trim()
+        ? getDownloadDir(config).trim()
+        : getOutputDir("downloads", config);
+    const normalizedDownloadDir = platform === 'win32'
+        ? resolvedDownloadDir.replace(/\//g, '\\')
+        : resolvedDownloadDir;
+    // Notice: Clean Electron launch flags: only isolated user-data-dir, remote-debugging-port, and optional user args.
+    // We NEVER pass Chromium browser flags or extension flags to Electron binaries.
+    const args = [
+        `--remote-debugging-port=${actualPort}`,
+        `--user-data-dir=${normalizedProfileDir}`,
+        `--default-download-dir=${normalizedDownloadDir}`,
+        "--no-first-run",
+        "--no-default-browser-check",
+        ...(appCfg.args || []),
+    ];
+    const spawnOptions = {
+        detached: true,
+        stdio: "ignore",
+    };
+    if (platform === 'darwin' && execPath.includes('.app')) {
+        spawnOptions.shell = true;
+    }
+    const proc = spawn(execPath, args, spawnOptions);
+    proc.unref();
+    const pid = proc.pid;
+    logDebug(`[Weavetab] Launching Electron app ${appName} (PID: ${pid}, port: ${actualPort}).`);
+    // Poll CDP endpoint on actualPort
+    let confirmed = false;
+    for (let i = 0; i < 20; i++) {
+        try {
+            await withCDPTimeout(CDP.List({ host: "127.0.0.1", port: actualPort }), 1500, "CDP.List Electron");
+            confirmed = true;
+            break;
+        }
+        catch {
+            await new Promise(r => setTimeout(r, 600));
+        }
+    }
+    if (!confirmed) {
+        const isListening = await testPortListening(actualPort);
+        if (!isListening) {
+            try {
+                if (pid)
+                    process.kill(pid);
+            }
+            catch { /* ignore */ }
+            clearLock(appName);
+            throw new Error(`[Weavetab] Electron app ${appName} failed to start CDP listener on port ${actualPort} after 12s.`);
+        }
+    }
+    await writeLock({
+        pid,
+        port: actualPort,
+        profileDir,
+        browserPath: execPath,
+        mode: "session",
+        appName,
+        pending: false,
+        timestamp: Date.now(),
+    }, appName);
+    return { path: execPath, name: appName, port: actualPort, engine: "chromium", isElectron: true };
+}

package/dist/cdp/connector.d.ts

@@ -17,12 +17,14 @@ export interface BrowserClient {
     overlayInstalled: boolean;
     agentId: string;
     browserContextId?: string;
+    appName?: string;
+    isElectron?: boolean;
     /** Sticky pruning state: if true, all subsequent DOM reads by action tools (click, type, etc.) will also apply pruning. */
     pruneActive?: boolean;
 }
-export declare function getOrConnect(config: Config): Promise<BrowserClient>;
-export declare function getTabList(agentId?: string): Promise<any[]>;
-export declare function connectToTab(targetId: string, port?: number, agentId?: string, browserContextId?: string): Promise<BrowserClient>;
+export declare function getOrConnect(config: Config, targetApp?: string): Promise<BrowserClient>;
+export declare function getTabList(agentId?: string, targetApp?: string): Promise<any[]>;
+export declare function connectToTab(targetId: string, port?: number, agentId?: string, browserContextId?: string, appName?: string): Promise<BrowserClient>;
 /**
  * Cancel analytics intervals and close the CDP WebSocket sessions without
  * touching the browser process. Safe to call in server mode — the browser