@weavetab/mcp 2.5.0-beta.1 → 2.5.0-beta.4

package/dist/plugin/pipeline.js

@@ -0,0 +1,183 @@
+/**
+ * src/plugin/pipeline.ts — Central Hook Dispatch Pipeline for Weavetab Plugins
+ *
+ * Dispatches lifecycle events:
+ * - onBeforeAction / beforeToolCall: Intercept tool calls, modify arguments, or block unauthorized actions
+ * - onAfterAction / afterToolCall: Transform, redact, or augment tool return results
+ * - onDOMMutation: Stream real-time DOM mutation deltas to registered plugins
+ * - onPageNavigate: Notify plugins upon browser navigation
+ */
+class HookPipeline {
+    beforeToolCallHooks = [];
+    afterToolCallHooks = [];
+    onDOMMutationHooks = [];
+    onPageNavigateHooks = [];
+    /**
+     * Register hooks for a specific plugin.
+     */
+    registerPluginHooks(pluginName, hooks) {
+        if (!hooks)
+            return;
+        // 1. Before Action / Before Tool Call
+        const beforeFns = hooks.onBeforeAction || hooks.beforeToolCall;
+        if (beforeFns) {
+            const list = Array.isArray(beforeFns) ? beforeFns : [beforeFns];
+            for (const fn of list) {
+                if (typeof fn === "function") {
+                    this.beforeToolCallHooks.push({ pluginName, fn });
+                }
+            }
+        }
+        // 2. After Action (signature: (tool, result, session, args))
+        if (hooks.onAfterAction) {
+            const list = Array.isArray(hooks.onAfterAction) ? hooks.onAfterAction : [hooks.onAfterAction];
+            for (const fn of list) {
+                if (typeof fn === "function") {
+                    this.afterToolCallHooks.push({
+                        pluginName,
+                        fn: async (toolName, args, result, session) => {
+                            return await fn(toolName, result, session, args);
+                        },
+                    });
+                }
+            }
+        }
+        // Legacy After Tool Call (signature: (tool, args, result, session))
+        if (hooks.afterToolCall) {
+            const list = Array.isArray(hooks.afterToolCall) ? hooks.afterToolCall : [hooks.afterToolCall];
+            for (const fn of list) {
+                if (typeof fn === "function") {
+                    this.afterToolCallHooks.push({ pluginName, fn });
+                }
+            }
+        }
+        // 3. DOM Mutation Hooks
+        if (hooks.onDOMMutation) {
+            const list = Array.isArray(hooks.onDOMMutation) ? hooks.onDOMMutation : [hooks.onDOMMutation];
+            for (const fn of list) {
+                if (typeof fn === "function") {
+                    this.onDOMMutationHooks.push({ pluginName, fn });
+                }
+            }
+        }
+        // 4. Page Navigate Hooks
+        if (hooks.onPageNavigate) {
+            const list = Array.isArray(hooks.onPageNavigate) ? hooks.onPageNavigate : [hooks.onPageNavigate];
+            for (const fn of list) {
+                if (typeof fn === "function") {
+                    this.onPageNavigateHooks.push({ pluginName, fn });
+                }
+            }
+        }
+    }
+    /**
+     * Remove all hooks registered by a plugin on unload.
+     */
+    unregisterPluginHooks(pluginName) {
+        this.beforeToolCallHooks = this.beforeToolCallHooks.filter((h) => h.pluginName !== pluginName);
+        this.afterToolCallHooks = this.afterToolCallHooks.filter((h) => h.pluginName !== pluginName);
+        this.onDOMMutationHooks = this.onDOMMutationHooks.filter((h) => h.pluginName !== pluginName);
+        this.onPageNavigateHooks = this.onPageNavigateHooks.filter((h) => h.pluginName !== pluginName);
+    }
+    /**
+     * Dispatches beforeAction / beforeToolCall hooks in sequence.
+     * If a hook returns an object, arguments are augmented/modified.
+     * If a hook returns { __blocked: true, reason } or throws, execution is aborted.
+     */
+    async dispatchBeforeToolCall(toolName, args, session) {
+        let currentArgs = { ...args };
+        for (const { pluginName, fn } of this.beforeToolCallHooks) {
+            try {
+                const modified = await fn(toolName, currentArgs, session);
+                if (modified && typeof modified === "object") {
+                    if (modified.__blocked) {
+                        const reason = modified.reason || `Action '${toolName}' blocked by plugin '${pluginName}'`;
+                        const blockError = new Error(reason);
+                        blockError.isBlocked = true;
+                        blockError.pluginName = pluginName;
+                        throw blockError;
+                    }
+                    if (!Array.isArray(modified)) {
+                        currentArgs = { ...currentArgs, ...modified };
+                    }
+                }
+            }
+            catch (err) {
+                if (err?.isBlocked) {
+                    throw err;
+                }
+                process.stderr.write(`[Weavetab Hooks] Error in beforeToolCall (${pluginName} on ${toolName}): ${err?.message || err}\n`);
+            }
+        }
+        return currentArgs;
+    }
+    /**
+     * Alias for dispatchBeforeToolCall.
+     */
+    async dispatchBeforeAction(toolName, args, session) {
+        return this.dispatchBeforeToolCall(toolName, args, session);
+    }
+    /**
+     * Dispatches afterAction / afterToolCall hooks in sequence.
+     * Allows plugins to inspect, transform, or redact tool results.
+     */
+    async dispatchAfterToolCall(toolName, args, result, session) {
+        let currentResult = result;
+        for (const { pluginName, fn } of this.afterToolCallHooks) {
+            try {
+                const modified = await fn(toolName, args, currentResult, session);
+                if (modified !== undefined) {
+                    currentResult = modified;
+                }
+            }
+            catch (err) {
+                process.stderr.write(`[Weavetab Hooks] Error in afterToolCall (${pluginName} on ${toolName}): ${err?.message || err}\n`);
+            }
+        }
+        return currentResult;
+    }
+    /**
+     * Alias for dispatchAfterToolCall.
+     */
+    async dispatchAfterAction(toolName, result, session, args) {
+        return this.dispatchAfterToolCall(toolName, args || {}, result, session);
+    }
+    /**
+     * Dispatches DOM mutation deltas to all listening plugins.
+     */
+    async dispatchDOMMutation(delta, session) {
+        if (this.onDOMMutationHooks.length === 0)
+            return;
+        for (const { pluginName, fn } of this.onDOMMutationHooks) {
+            try {
+                await fn(delta, session);
+            }
+            catch (err) {
+                process.stderr.write(`[Weavetab Hooks] Error in onDOMMutation (${pluginName}): ${err?.message || err}\n`);
+            }
+        }
+    }
+    /**
+     * Dispatches onPageNavigate hooks when navigation occurs.
+     */
+    async dispatchPageNavigate(url, session) {
+        for (const { pluginName, fn } of this.onPageNavigateHooks) {
+            try {
+                await fn(url, session);
+            }
+            catch (err) {
+                process.stderr.write(`[Weavetab Hooks] Error in onPageNavigate (${pluginName}): ${err?.message || err}\n`);
+            }
+        }
+    }
+    /**
+     * Clears all registered hooks.
+     */
+    clearAllHooks() {
+        this.beforeToolCallHooks = [];
+        this.afterToolCallHooks = [];
+        this.onDOMMutationHooks = [];
+        this.onPageNavigateHooks = [];
+    }
+}
+export const hookPipeline = new HookPipeline();

package/dist/plugin/registry.js

@@ -1,6 +1,17 @@
 import { readFileSync, existsSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
+import { createRequire } from "node:module";
+import { WEAVETAB_VERSION } from "../version.js";
+const _require = createRequire(import.meta.url);
+function getVersion() {
+    try {
+        return _require("../../package.json").version || WEAVETAB_VERSION;
+    }
+    catch {
+        return WEAVETAB_VERSION;
+    }
+}
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // ---------------------------------------------------------------------------
@@ -142,7 +153,7 @@ export async function checkNpmPackageExists(pkgName) {
         const res = await fetch(`https://registry.npmjs.org/${encodedName}`, {
             method: "HEAD",
             signal: AbortSignal.timeout(3000),
-            headers: { "User-Agent": "Weavetab-CLI/2.5.0" },
+            headers: { "User-Agent": `Weavetab/${getVersion()}` },
         });
         return res.status === 200;
     }

package/dist/plugin/storage.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Interface for isolated plugin file and key-value storage.
+ */
+export interface IPluginStorage {
+    get<T = any>(key: string, defaultValue?: T): Promise<T | null>;
+    set<T = any>(key: string, value: T): Promise<void>;
+    delete(key: string): Promise<boolean>;
+    getJSON<T = any>(filename: string): Promise<T | null>;
+    setJSON<T = any>(filename: string, data: T): Promise<void>;
+    getPath(subpath?: string): string;
+    list(subpath?: string): Promise<string[]>;
+}
+/**
+ * Creates an isolated storage sandbox for a plugin under:
+ * ~/.weavetab/plugins/<plugin-name>/
+ */
+export declare class PluginStorageManager implements IPluginStorage {
+    readonly pluginName: string;
+    private readonly pluginDir;
+    private readonly configPath;
+    private readonly kvStorePath;
+    private inMemoryKV;
+    constructor(pluginName: string);
+    /**
+     * Returns the absolute path to the plugin's isolated directory.
+     */
+    getDirectory(): string;
+    /**
+     * Returns the absolute path to the plugin's config.json.
+     */
+    getConfigPath(): string;
+    private ensureDir;
+    /**
+     * Loads the plugin's isolated config.json. If it does not exist and a defaultConfig is provided,
+     * writes the default config to ~/.weavetab/plugins/<plugin-name>/config.json.
+     */
+    loadConfig(defaultConfig?: Record<string, any>): Record<string, any>;
+    /**
+     * Saves updated configuration to ~/.weavetab/plugins/<plugin-name>/config.json.
+     */
+    saveConfig(configData: Record<string, any>): void;
+    private loadKV;
+    private persistKV;
+    get<T = any>(key: string, defaultValue?: T): Promise<T | null>;
+    set<T = any>(key: string, value: T): Promise<void>;
+    delete(key: string): Promise<boolean>;
+    getPath(subpath?: string): string;
+    getJSON<T = any>(filename: string): Promise<T | null>;
+    setJSON<T = any>(filename: string, data: T): Promise<void>;
+    list(subpath?: string): Promise<string[]>;
+}

package/dist/plugin/storage.js

@@ -0,0 +1,164 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { GLOBAL_CONFIG_DIR } from "../config/loader.js";
+import { logDebug } from "../audit/logger.js";
+/**
+ * Creates an isolated storage sandbox for a plugin under:
+ * ~/.weavetab/plugins/<plugin-name>/
+ */
+export class PluginStorageManager {
+    pluginName;
+    pluginDir;
+    configPath;
+    kvStorePath;
+    inMemoryKV = null;
+    constructor(pluginName) {
+        this.pluginName = pluginName;
+        // Sanitize plugin name for safe filesystem directory creation
+        const safeName = pluginName.replace(/[^a-zA-Z0-9_.-]/g, "_");
+        this.pluginDir = path.join(GLOBAL_CONFIG_DIR, "plugins", safeName);
+        this.configPath = path.join(this.pluginDir, "config.json");
+        this.kvStorePath = path.join(this.pluginDir, "storage.json");
+        this.ensureDir(this.pluginDir);
+    }
+    /**
+     * Returns the absolute path to the plugin's isolated directory.
+     */
+    getDirectory() {
+        return this.pluginDir;
+    }
+    /**
+     * Returns the absolute path to the plugin's config.json.
+     */
+    getConfigPath() {
+        return this.configPath;
+    }
+    ensureDir(dir) {
+        if (!fs.existsSync(dir)) {
+            try {
+                fs.mkdirSync(dir, { recursive: true });
+            }
+            catch (e) {
+                logDebug(`[Weavetab PluginStorage] Failed to create dir ${dir}:`, e);
+            }
+        }
+    }
+    /**
+     * Loads the plugin's isolated config.json. If it does not exist and a defaultConfig is provided,
+     * writes the default config to ~/.weavetab/plugins/<plugin-name>/config.json.
+     */
+    loadConfig(defaultConfig = {}) {
+        try {
+            if (fs.existsSync(this.configPath)) {
+                const raw = fs.readFileSync(this.configPath, "utf-8").trim();
+                if (raw) {
+                    return JSON.parse(raw);
+                }
+            }
+            // If config.json doesn't exist yet, save default config
+            this.ensureDir(this.pluginDir);
+            fs.writeFileSync(this.configPath, JSON.stringify(defaultConfig, null, 2), "utf-8");
+            logDebug(`[Weavetab PluginStorage] Created default config for "${this.pluginName}" at: ${this.configPath}`);
+            return { ...defaultConfig };
+        }
+        catch (e) {
+            logDebug(`[Weavetab PluginStorage] Error loading config for "${this.pluginName}":`, e);
+            return { ...defaultConfig };
+        }
+    }
+    /**
+     * Saves updated configuration to ~/.weavetab/plugins/<plugin-name>/config.json.
+     */
+    saveConfig(configData) {
+        try {
+            this.ensureDir(this.pluginDir);
+            fs.writeFileSync(this.configPath, JSON.stringify(configData, null, 2), "utf-8");
+        }
+        catch (e) {
+            logDebug(`[Weavetab PluginStorage] Error saving config for "${this.pluginName}":`, e);
+            throw e;
+        }
+    }
+    loadKV() {
+        if (this.inMemoryKV !== null)
+            return this.inMemoryKV;
+        try {
+            if (fs.existsSync(this.kvStorePath)) {
+                const raw = fs.readFileSync(this.kvStorePath, "utf-8").trim();
+                this.inMemoryKV = raw ? JSON.parse(raw) : {};
+            }
+            else {
+                this.inMemoryKV = {};
+            }
+        }
+        catch {
+            this.inMemoryKV = {};
+        }
+        return this.inMemoryKV || {};
+    }
+    persistKV() {
+        try {
+            this.ensureDir(this.pluginDir);
+            fs.writeFileSync(this.kvStorePath, JSON.stringify(this.inMemoryKV || {}, null, 2), "utf-8");
+        }
+        catch (e) {
+            logDebug(`[Weavetab PluginStorage] Failed to persist KV for "${this.pluginName}":`, e);
+        }
+    }
+    async get(key, defaultValue) {
+        const kv = this.loadKV();
+        return key in kv ? kv[key] : defaultValue !== undefined ? defaultValue : null;
+    }
+    async set(key, value) {
+        const kv = this.loadKV();
+        kv[key] = value;
+        this.persistKV();
+    }
+    async delete(key) {
+        const kv = this.loadKV();
+        if (key in kv) {
+            delete kv[key];
+            this.persistKV();
+            return true;
+        }
+        return false;
+    }
+    getPath(subpath = "") {
+        const resolved = path.resolve(this.pluginDir, subpath);
+        // Security check: ensure subpath does not escape the plugin directory
+        if (!resolved.startsWith(this.pluginDir)) {
+            throw new Error(`Security Violation: Path "${subpath}" attempts to escape plugin directory.`);
+        }
+        return resolved;
+    }
+    async getJSON(filename) {
+        const filePath = this.getPath(filename);
+        if (!fs.existsSync(filePath))
+            return null;
+        try {
+            const raw = fs.readFileSync(filePath, "utf-8");
+            return JSON.parse(raw);
+        }
+        catch (e) {
+            logDebug(`[Weavetab PluginStorage] Error reading JSON from "${filePath}":`, e);
+            return null;
+        }
+    }
+    async setJSON(filename, data) {
+        const filePath = this.getPath(filename);
+        const parent = path.dirname(filePath);
+        this.ensureDir(parent);
+        fs.writeFileSync(filePath, JSON.stringify(data, null, 2), "utf-8");
+    }
+    async list(subpath = "") {
+        const targetDir = this.getPath(subpath);
+        if (!fs.existsSync(targetDir))
+            return [];
+        try {
+            return fs.readdirSync(targetDir);
+        }
+        catch {
+            return [];
+        }
+    }
+}

package/dist/security/secrets.d.ts

@@ -69,6 +69,7 @@ declare class SessionSecretTrackerImpl {
     isNodeSecret(sessionId: string, backendNodeId: number): boolean;
     registerSecretValue(sessionId: string, value: string): void;
     redact(sessionId: string, text: string): string;
+    redactAll(text: string): string;
     clearSession(sessionId: string): void;
 }
 export declare const SessionSecretTracker: SessionSecretTrackerImpl;

package/dist/security/secrets.js

@@ -357,6 +357,19 @@ class SessionSecretTrackerImpl {
         }
         return redacted;
     }
+    redactAll(text) {
+        if (!text || typeof text !== 'string')
+            return text;
+        let redacted = text;
+        for (const set of this.sessionSecrets.values()) {
+            for (const secret of set) {
+                if (secret && secret.length >= 3) {
+                    redacted = redacted.split(secret).join('[REDACTED]');
+                }
+            }
+        }
+        return redacted;
+    }
     clearSession(sessionId) {
         this.trackedNodes.delete(sessionId);
         this.sessionSecrets.delete(sessionId);

package/dist/sensors/actionability.js

@@ -23,7 +23,7 @@
  */
 // ── Constants ─────────────────────────────────────────────────────────────────
 /** Playwright's per-action retry backoff (ms). */
-const BACKOFF = [0, 20, 100, 100, 500];
+const BACKOFF = [0, 20, 100];
 /**
  * 4-way scroll alignment rotation — escape sticky headers.
  * undefined = browser default (nearest), then progressively more aggressive.
@@ -121,7 +121,6 @@ function buildPageExpression(selector, scrollOptions, fingerprint, stabilityMs)
     let stable = false;
     while (Date.now() < stabilityDeadline) {
       await new Promise(r => requestAnimationFrame(r));
-      await new Promise(r => requestAnimationFrame(r)); // two ticks like Playwright
       const cur = el.getBoundingClientRect();
       if (
         Math.abs(cur.x - prevRect.x) < 0.5 &&

package/dist/sensors/guard.js

@@ -148,9 +148,7 @@ export async function detectPageWeight(session) {
         };
     }
 }
-// ─── Navigation wait — used after clicks that trigger navigation ──────────────
-export async function awaitNavigation(session, timeout = 6000 // Reduced from 10000ms
-) {
+export async function awaitNavigation(session, timeout = 6000) {
     // Poll readyState instead of consuming one-shot event
     await pollUntil(async () => {
         const { result } = await session.Runtime.evaluate({
@@ -158,11 +156,7 @@ export async function awaitNavigation(session, timeout = 6000 // Reduced from 10
             returnByValue: true,
         }).catch(() => ({ result: { value: 'loading' } }));
         return result?.value === 'complete' || result?.value === 'interactive';
-    }, { timeout, interval: 50 }).catch(() => {
-        throw new Error(`Navigation timeout after ${timeout}ms`);
-    });
-    // After DOM content fires, detect page weight for post-load stability wait
-    const weight = await detectPageWeight(session);
-    const stabilityTimeout = weight.level === "heavy" ? 3000 : weight.level === "medium" ? 2000 : 1000; // Reduced from 5000/3000/2000
-    await waitForDOMStable(session, 50, stabilityTimeout); // Reduced quiet period from 100ms
+    }, { timeout, interval: 30 }).catch(() => { });
+    // Quick 40ms settle window for hydration/initial script exec
+    await new Promise(r => setTimeout(r, 40));
 }

package/dist/sensors/mutations.js

@@ -1,3 +1,4 @@
+import { hookPipeline } from "../plugin/pipeline.js";
 // Heuristics for "significant" changes
 const SIGNIFICANT_TAGS = new Set(['button', 'a', 'input', 'textarea', 'select', 'h1', 'h2', 'h3', '[role="button"]', '[role="link"]']);
 const MAX_TEXT_LEN = 150;
@@ -89,5 +90,16 @@ export async function watchMutations(session, durationMs) {
         // Disabling the DOM agent automatically removes all listeners.
         await DOM.disable();
     }
+    if (summary.significantChange || summary.newElements.length > 0 || summary.removedElements.length > 0 || summary.attributeChanges.length > 0) {
+        const delta = {
+            type: "cdp_mutation",
+            timestamp: Date.now(),
+            added: summary.newElements.map(e => ({ backendNodeId: e.backendNodeId, tag: e.tag, text: e.text, role: e.role })),
+            removed: summary.removedElements.map(e => ({ backendNodeId: e.backendNodeId, tag: e.tag })),
+            changed: summary.attributeChanges.map(a => ({ backendNodeId: a.backendNodeId, attribute: a.attribute, newValue: a.newValue })),
+            significantChange: summary.significantChange,
+        };
+        hookPipeline.dispatchDOMMutation(delta, session).catch(() => { });
+    }
     return summary;
 }

package/dist/sensors/operation_monitor.js

@@ -33,6 +33,7 @@ class OperationMonitor {
         const diagnosticsTimer = setInterval(() => {
             this.checkOperationHealth(operationId);
         }, 1000); // Check every 1 second (reduced from 2s for faster detection)
+        diagnosticsTimer.unref();
         this.activeOperations.get(operationId).diagnosticsTimer = diagnosticsTimer;
     }
     /**

package/dist/server.d.ts

@@ -1,6 +1,6 @@
 /**
  * Weavetab — server.ts
- * MCP server: 43 browser automation tools with security, rate limiting, and visual overlay.
+ * MCP server: 44 browser automation tools with security, rate limiting, and visual overlay.
  * Weavetab by fy2ne
  */
 import type { Config } from "./config/loader.js";