@weavetab/mcp 2.5.0-beta.1 → 2.5.0-beta.4

package/dist/server.js

@@ -1,11 +1,12 @@
 /**
  * Weavetab — server.ts
- * MCP server: 43 browser automation tools with security, rate limiting, and visual overlay.
+ * MCP server: 44 browser automation tools with security, rate limiting, and visual overlay.
  * Weavetab by fy2ne
  */
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
+import { WEAVETAB_VERSION } from "./version.js";
 import { getOrConnect } from "./cdp/connector.js";
 import { checkRateLimit } from "./security/ratelimit.js";
 import { checkDomain, isToolAllowedInMode } from "./security/blacklist.js";
@@ -44,31 +45,32 @@ import { browserExtractDesign } from "./tools/design_extract.js";
 import { browserAutomation } from "./tools/automation.js";
 import { browserRecording } from "./tools/recording.js";
 import { browserPerformance } from "./tools/performance.js";
-import { compileTraceToMacro } from "./tools/macro_compiler.js";
 import { detectBrowsers } from "./tools/browser_detect.js";
 import { browserThought } from "./tools/thought.js";
 import { browserCaptcha } from "./tools/captcha.js";
 import { browserEmulate } from "./tools/emulation.js";
+import { browserCheckpoint } from "./tools/checkpoint.js";
 import { getActiveEngine } from "./cdp/connector.js";
 import { resetLoopCounter } from "./intelligence/trail.js";
-import { discoverPlugins } from "./plugin/loader.js";
+import { getSiteProfile, learnPattern, recordPatternExecution, recordQuirk, getPatternReliability, formatSiteProfileHint } from "./intelligence/patternCompiler.js";
+import { discoverPlugins, listInstalledPlugins, loadPluginByName } from "./plugin/loader.js";
+import { hookPipeline } from "./plugin/pipeline.js";
 import { agentAction } from "./sensors/pacing.js";
-import { getCachedConfig } from "./config/loader.js";
+import { getCachedConfig, getElectronApps } from "./config/loader.js";
 import { agentState } from "./state/agent.js";
+import { SessionSecretTracker } from "./security/secrets.js";
 import { sessionRegistry } from "./state/session.js";
 // GitHub tools
-import { githubAnalyze } from "./tools/github/analyze.js";
-import { githubRead } from "./tools/github/read.js";
-import { githubIssues } from "./tools/github/issues.js";
-import { githubGetPr } from "./tools/github/pr.js";
+import { browserGithub } from "./tools/github/index.js";
 // Office document tools
 import { browserOfficeParse, browserOfficeList } from "./tools/office/index.js";
+const activeLoadedPlugins = new Map();
 const ROLE_TOOL_ALLOW = {
     admin: new Set(["*"]),
     operator: new Set(["*"]),
-    viewer: new Set(["browser_map", "browser_find", "browser_scrape", "browser_console", "browser_eval", "browser_inspect", "browser_extract_design", "browser_snapshot", "browser_screenshot", "browser_pdf", "browser_cookies", "browser_tabs", "browser_wait"]),
+    viewer: new Set(["browser_map", "browser_find", "browser_scrape", "browser_console", "browser_eval", "browser_inspect", "browser_extract_design", "browser_snapshot", "browser_screenshot", "browser_pdf", "browser_cookies", "browser_tabs", "browser_wait", "browser_pattern_learn", "browser_github"]),
     automation: new Set(["*"]), // Allowed all except interactive tools (enforced in isToolAllowedForRole)
-    system: new Set(["browser_thoughts", "browser_reset_loop_counter", "browser_detect", "browser_performance"]),
+    system: new Set(["browser_thoughts", "browser_detect", "browser_performance", "browser_checkpoint", "browser_pattern_learn"]),
 };
 function isToolAllowedForRole(role, toolName) {
     if (role === "automation" && toolName === "browser_thoughts") {
@@ -81,7 +83,7 @@ function isToolAllowedForRole(role, toolName) {
         return { allowed: true };
     if (allowed.has(toolName))
         return { allowed: true };
-    return { allowed: false, reason: `Role '${role}' does not have permission to use '${toolName}'. ${role === "viewer" ? "Viewer role only permits read-only tools (map/find/scrape/console/eval/inspect/snapshot/pdf/cookies/github_*)." : ""}` };
+    return { allowed: false, reason: `Role '${role}' does not have permission to use '${toolName}'. ${role === "viewer" ? "Viewer role only permits read-only tools (map/find/scrape/console/eval/inspect/snapshot/pdf/cookies/browser_github)." : ""}` };
 }
 /** Push a rich log card to every active browser session's overlay. Only shown when devMode is on. */
 async function pushRichLog(agentId, toolName, title, details, status, devMode = false) {
@@ -104,7 +106,69 @@ function withTimeoutGuard(fn, timeoutMs, label) {
     });
     return Promise.race([fn(), timeoutPromise]).finally(() => clearTimeout(timer));
 }
-async function withSecurity(config, toolName, handler, isOfficial = false) {
+function inferTargetApp(requestedApp, url, tabId) {
+    if (requestedApp) {
+        const lower = requestedApp.toLowerCase().trim();
+        if (lower === "browser" || lower === "chrome" || lower === "chromium") {
+            sessionRegistry.setLastActiveApp(null);
+            return undefined;
+        }
+        sessionRegistry.setLastActiveApp(lower);
+        return lower;
+    }
+    // 1. Infer from tabId if provided
+    if (tabId) {
+        const registered = sessionRegistry.findClientByTargetId(tabId);
+        if (registered && registered.isElectron && registered.appName) {
+            sessionRegistry.setLastActiveApp(registered.appName);
+            return registered.appName;
+        }
+    }
+    // 2. Infer from URL domain if provided
+    if (url) {
+        const config = getCachedConfig();
+        const apps = getElectronApps(config);
+        const u = url.toLowerCase();
+        for (const appKey of Object.keys(apps)) {
+            if (appKey === "discord" && (u.includes("discord.com") || u.startsWith("discord:"))) {
+                logAction("target_router", "auto_route", `Auto-routing URL to Electron app "${appKey}"`);
+                sessionRegistry.setLastActiveApp(appKey);
+                return appKey;
+            }
+            if (appKey === "slack" && (u.includes("slack.com") || u.startsWith("slack:"))) {
+                logAction("target_router", "auto_route", `Auto-routing URL to Electron app "${appKey}"`);
+                sessionRegistry.setLastActiveApp(appKey);
+                return appKey;
+            }
+            if (appKey === "linear" && (u.includes("linear.app") || u.startsWith("linear:"))) {
+                logAction("target_router", "auto_route", `Auto-routing URL to Electron app "${appKey}"`);
+                sessionRegistry.setLastActiveApp(appKey);
+                return appKey;
+            }
+            if (appKey === "notion" && (u.includes("notion.so") || u.startsWith("notion:"))) {
+                logAction("target_router", "auto_route", `Auto-routing URL to Electron app "${appKey}"`);
+                sessionRegistry.setLastActiveApp(appKey);
+                return appKey;
+            }
+        }
+    }
+    // 3. Fall back to sticky active session if no web browser is running
+    const hasActiveBrowser = sessionRegistry.isBrowserSessionActive();
+    if (!hasActiveBrowser) {
+        const lastApp = sessionRegistry.getLastActiveApp();
+        if (lastApp) {
+            return lastApp;
+        }
+        const allElectrons = sessionRegistry.getActiveElectronClients();
+        if (allElectrons.length === 1 && allElectrons[0]?.appName) {
+            const soleApp = allElectrons[0].appName;
+            sessionRegistry.setLastActiveApp(soleApp);
+            return soleApp;
+        }
+    }
+    return undefined;
+}
+async function withSecurity(config, toolName, handler, isOfficial = false, targetApp) {
     const liveConfig = getCachedConfig();
     const rl = checkRateLimit(liveConfig);
     if (!rl.allowed) {
@@ -117,7 +181,8 @@ async function withSecurity(config, toolName, handler, isOfficial = false) {
             throw new Error(`[!] ${roleToolCheck.reason}`);
         }
     }
-    const { session } = await withTimeoutGuard(() => getOrConnect(liveConfig), 15000, `CDP Connection (${toolName})`);
+    const resolvedTargetApp = inferTargetApp(targetApp);
+    const { session } = await withTimeoutGuard(() => getOrConnect(liveConfig, resolvedTargetApp), 15000, `CDP Connection (${toolName}${resolvedTargetApp ? `:${resolvedTargetApp}` : ''})`);
     agentState.setSession(session);
     global.__wt_live_config = liveConfig;
     try {
@@ -141,8 +206,8 @@ async function withSecurity(config, toolName, handler, isOfficial = false) {
     }
     if (!isOfficial) {
         // Phase 7c: Domain policy check for read-only / deny / audit-only modes
-        const activeClient = sessionRegistry.getActive(liveConfig.agentId);
-        if (activeClient?.url) {
+        const activeClient = sessionRegistry.getActive(liveConfig.agentId, targetApp);
+        if (activeClient?.url && !activeClient.isElectron) {
             const domainCheck = checkDomain(activeClient.url, liveConfig);
             if (!domainCheck.allowed) {
                 throw new Error(`[!] ${domainCheck.reason}`);
@@ -198,7 +263,7 @@ async function withSecurity(config, toolName, handler, isOfficial = false) {
         const result = await withTimeoutGuard(() => handler(session, liveConfig), 22000, toolName);
         agentState.reportToolSuccess();
         const ms = Date.now() - t0;
-        const activeClient = sessionRegistry.getActive(liveConfig.agentId);
+        const activeClient = sessionRegistry.getActive(liveConfig.agentId, targetApp);
         logActionStructured({
             timestamp: new Date(t0).toISOString(),
             sessionId: activeClient?.targetId,
@@ -265,6 +330,13 @@ async function withSecurity(config, toolName, handler, isOfficial = false) {
                 { type: "image", data: base64Data, mimeType },
             ];
         }
+        else if (resultAny && typeof resultAny === 'object' && Array.isArray(resultAny.content)) {
+            // Passthrough if already conforming McpToolResult (prevents double JSON wrapping)
+            content = resultAny.content;
+        }
+        else if (typeof result === 'string') {
+            content = [{ type: "text", text: result }];
+        }
         else {
             content = [{ type: "text", text: JSON.stringify(result) }];
         }
@@ -322,7 +394,7 @@ async function withSecurity(config, toolName, handler, isOfficial = false) {
         const ms = Date.now() - t0;
         const errMsg = err instanceof Error ? err.message : String(err);
         agentState.reportToolError();
-        const activeClient = sessionRegistry.getActive(liveConfig.agentId);
+        const activeClient = sessionRegistry.getActive(liveConfig.agentId, targetApp);
         logActionStructured({
             timestamp: new Date(t0).toISOString(),
             sessionId: activeClient?.targetId,
@@ -340,13 +412,39 @@ async function withSecurity(config, toolName, handler, isOfficial = false) {
     }
 }
 function wrapError(err) {
-    const message = err instanceof Error ? err.message : String(err);
+    let message = err instanceof Error ? err.message : String(err);
+    message = SessionSecretTracker.redactAll(message);
     logAction("ERROR", "server", message);
     return { content: [{ type: "text", text: message }], isError: true };
 }
 export async function startServer(config, transportMode = "stdio", wsPort = 3000) {
-    const server = new McpServer({ name: "Weavetab MCP", version: "3.0.0-beta" });
-    // Initialize agent state manager
+    const server = new McpServer({ name: "Weavetab MCP", version: WEAVETAB_VERSION });
+    // Intercept server.tool to inject global plugin middleware hooks (onBeforeAction, onAfterAction)
+    const rawTool = server.tool.bind(server);
+    server.tool = function (name, ...rest) {
+        const rawHandler = rest[rest.length - 1];
+        if (typeof rawHandler === "function") {
+            rest[rest.length - 1] = async (args, extra) => {
+                try {
+                    const session = agentState.getSession() ?? sessionRegistry.getActive(config.agentId)?.session;
+                    const dispatchedArgs = await hookPipeline.dispatchBeforeToolCall(name, args || {}, session);
+                    const result = await rawHandler(dispatchedArgs, extra);
+                    const finalResult = await hookPipeline.dispatchAfterToolCall(name, dispatchedArgs, result, session);
+                    return finalResult;
+                }
+                catch (err) {
+                    if (err?.isBlocked || err?.__blocked) {
+                        return {
+                            isError: true,
+                            content: [{ type: "text", text: `[!] Action '${name}' blocked by plugin: ${err.message}` }],
+                        };
+                    }
+                    throw err;
+                }
+            };
+        }
+        return rawTool(name, ...rest);
+    };
     agentState.setIdleTimeout(config.idleTimeout ?? 60000);
     agentState.setCallbacks({
         onStateChange: async (session, state, word) => {
@@ -360,35 +458,40 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
             }
         },
         onUpdateTabTitle: async (_session, _state) => {
-            // Handled robustly via Weavetab extension background & content scripts
+            // handled via extension background & content scripts
         },
     });
     // ── 1. browser_map ─────────────────────────────────────────────────────────
-    server.tool("browser_map", "Snapshot interactive DOM with volatile ref IDs that invalidate after DOM mutations. For complex SPAs (e.g. GitHub dashboards), use `scope` or `query` to reduce tokens. For forms/pagination/sequential loops, ALWAYS use `delta: true` to save 97% tokens.", {
+    server.tool("browser_map", "Snapshot interactive DOM with volatile ref IDs that invalidate after DOM mutations. For complex SPAs (e.g. GitHub dashboards), use `scope` or `query` to reduce tokens. For forms/pagination/sequential loops, ALWAYS use `delta: true` to save 97% tokens. For canvas/WebGL/Figma pages where the DOM has < 5 interactive elements, use `visual: \"auto\"` to get a numbered screenshot — then use browser_click({ mark: N }) to interact.", {
         full: z.boolean().optional().describe("Set to true to return a full markdown table (heavier context) instead of the lite list."),
-        scope: z.enum(["navigation", "main_content", "sidebar", "form", "modal", "utility"]).optional().describe("Restrict parsing to a semantic page area to save tokens. Crucial for complex dashboards."),
-        query: z.string().optional().describe("Filter returned elements by label or role substring. Crucial for complex dashboards."),
+        scope: z.enum(["navigation", "main_content", "sidebar", "form", "modal", "utility"]).optional().describe("Restrict parsing to a semantic page area to save tokens. Useful on dense dashboards."),
+        query: z.string().optional().describe("Filter returned elements by label or role substring. Useful on dense dashboards."),
         delta: z.boolean().optional().describe("Diff mode: return ONLY elements that changed since the last browser_map call (added, removed, or modified). Diffs across time — distinct from prune. Cuts prompt tokens by up to 97% on consecutive calls."),
         ax_tree: z.boolean().optional().describe("Bypass the extension entirely and read raw Chrome Accessibility Tree. Use this if Shadow DOMs hide elements."),
         tab_id: z.string().optional().describe("Read a specific background tab instead of the active one."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
         show_overlays: z.boolean().optional().describe("Default false. Debug only — draws colored element borders via extension (ugly). The blue edge glow is the standard visual indicator, shown automatically during reading states. Only enable this for debugging element boundaries."),
-        force: z.boolean().optional().describe("Force a full DOM map rebuild even if loop detection says nothing changed. Bypasses the map skip guard."),
+        force: z.boolean().optional().describe("Force a full DOM map rebuild even if loop detection says nothing changed. Bypasses the map skip guard and resets loop strikes."),
         prune: z.boolean().optional().describe("Semantic DOM pruning: compress the current snapshot before returning. Drops hidden elements with no interactive descendants and not referenced by any toggle trigger (aria-controls etc.). Replaces SVG icons with [SVG Icon: label] tokens. Distinct from delta:true — delta diffs across time, prune compresses this snapshot once. Combine both for maximum token efficiency."),
+        visual: z.union([z.boolean(), z.literal("auto")]).optional().describe("Set-of-Marks visual grounding. true = always inject numbered badges + return annotated screenshot. \"auto\" = only activate when DOM interactive count < 5 (canvas/WebGL/Figma pages). After receiving marks, use browser_click({ mark: N }) to interact with numbered elements."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_map", async (session, liveConfig) => {
                 let targetSession = session;
                 let targetId = "default";
                 const { sessionRegistry } = await import("./state/session.js");
-                const active = sessionRegistry.getActive(liveConfig.agentId);
+                const active = sessionRegistry.getActive(liveConfig.agentId, args.app);
                 if (active)
                     targetId = active.targetId;
                 if (args.tab_id) {
                     const { connectToTab } = await import("./cdp/connector.js");
-                    const client = await connectToTab(args.tab_id);
+                    const client = await connectToTab(args.tab_id, undefined, undefined, undefined, args.app);
                     targetSession = client.session;
                     targetId = args.tab_id;
                 }
+                if (args.force) {
+                    resetLoopCounter("map_force");
+                }
                 // Structural block — map after no-change click/type is a pure wasted round-trip
                 // Skip the skip guard if the user explicitly requests force or delta diff
                 if (!args.force && !args.delta) {
@@ -408,99 +511,129 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
                     }
                 }
                 const result = await agentAction(targetSession, 'reading', () => browserMap(targetSession, args, targetId, liveConfig), 'browser_map');
+                // Handle visual grounding result (text + annotated image)
+                if (result && typeof result === 'object' && 'text' in result) {
+                    const vr = result;
+                    const content = [
+                        { type: "text", text: vr.text },
+                    ];
+                    if (vr.imageBase64) {
+                        content.push({ type: "image", data: vr.imageBase64, mimeType: "image/jpeg" });
+                    }
+                    return { content };
+                }
                 return { content: [{ type: "text", text: result }] };
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
         }
     });
     // ── 2. browser_navigate ────────────────────────────────────────────────────
-    server.tool("browser_navigate", "Navigate to a URL.", {
-        url: z.string().describe("Absolute URL to navigate to (must include https://)."),
+    server.tool("browser_navigate", "Navigate to a URL or launch/focus a configured Electron app.", {
+        url: z.string().optional().describe("Absolute URL to navigate to (must include https:// or app URL). Optional if 'app' is specified."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron' (e.g. 'example' or 'my-dev-app'). When specified, targets or launches the Electron app."),
         force: z.boolean().optional().describe("If true, overwrites current tab even if it's protected (anchor tab). Otherwise opens a new tab automatically."),
         tab_id: z.string().optional().describe("Target a specific tab ID for navigation instead of the active tab.")
     }, async (args) => {
         try {
+            if (!args.url && !args.app) {
+                throw new Error("Either 'url' or 'app' must be provided to browser_navigate.");
+            }
+            const resolvedApp = inferTargetApp(args.app, args.url, args.tab_id);
             return await withSecurity(config, "browser_navigate", async (session, liveConfig) => {
                 let targetSession = session;
                 let targetId = "default";
                 if (args.tab_id) {
                     const { connectToTab } = await import("./cdp/connector.js");
-                    const client = await connectToTab(args.tab_id);
+                    const client = await connectToTab(args.tab_id, undefined, undefined, undefined, resolvedApp);
                     targetSession = client.session;
                     targetId = args.tab_id;
                 }
-                return await agentAction(targetSession, 'navigating', () => weaveNavigate(targetSession, args.url, liveConfig, targetId, args.force), 'browser_navigate');
-            });
+                if (args.url) {
+                    const navResult = await agentAction(targetSession, 'navigating', () => weaveNavigate(targetSession, args.url, liveConfig, targetId, args.force), 'browser_navigate');
+                    await hookPipeline.dispatchPageNavigate(args.url, targetSession);
+                    return navResult;
+                }
+                return { success: true, app: resolvedApp, message: `Connected to Electron app "${resolvedApp}".` };
+            }, false, resolvedApp);
         }
         catch (e) {
             return wrapError(e);
         }
     });
     // ── 3. browser_click ───────────────────────────────────────────────────────
-    server.tool("browser_click", "Click a DOM element. Use browser_canvas for charts/canvas. If stuck_warning=true, stop and use browser_map.", {
+    server.tool("browser_click", "Click a DOM element. Use browser_canvas for charts/canvas. If stuck_warning=true, stop and use browser_map. Pass mark: N to click a numbered element from browser_map({ visual: true/\"auto\" }) without any DOM re-scan.", {
         id: z.string().optional().describe("Ref ID from browser_map (e.g. 'w:42'). Primary targeting method. DO NOT SPAM. If stuck_warning is returned, stop retrying and call browser_map first."),
+        ref: z.string().optional().describe("Alias for id (e.g. 'w:42')."),
         selector: z.string().optional().describe("CSS selector of the element to click."),
         target: z.string().optional().describe("CSS selector or query string. Alias for selector."),
         label: z.string().optional().describe("Visible text or aria-label to click."),
         intent: z.string().optional().describe("Semantic description of the action (e.g. 'submit login form'). WeaveTab checks learned memory first — if a high-confidence selector is found it clicks immediately without DOM resolution. Falls through to normal resolution on a miss; does not error."),
+        mark: z.number().int().positive().optional().describe("Mark number from browser_map({ visual: true/\"auto\" }). Clicks the center of the numbered badge seen in the annotated screenshot. Zero DOM walk — instant coordinate dispatch. Use when the page is canvas/WebGL and DOM refs are unavailable."),
         backendNodeId: z.number().optional().describe("Raw CDP backendNodeId for direct hardware targeting."),
         x: z.number().optional().describe("Raw X coordinate. Use for precise positional clicks when element ID is not available."),
         y: z.number().optional().describe("Raw Y coordinate. Use for precise positional clicks when element ID is not available."),
         include_map: z.boolean().optional().describe("Set true to include a full updated page_map in the response. Default false — omit when you already have ref IDs or don't need a DOM refresh."),
         tab_id: z.string().optional().describe("Execute in a specific tab instead of active."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_click", async (session, liveConfig) => {
                 let targetSession = session;
                 if (args.tab_id) {
                     const { connectToTab } = await import("./cdp/connector.js");
-                    const client = await connectToTab(args.tab_id);
+                    const client = await connectToTab(args.tab_id, undefined, undefined, undefined, args.app);
                     targetSession = client.session;
                 }
                 const normalizedArgs = { ...args };
+                if (args.ref && !normalizedArgs.id)
+                    normalizedArgs.id = args.ref;
                 if (args.selector && !normalizedArgs.id)
                     normalizedArgs.id = args.selector;
                 if (args.target && !normalizedArgs.id)
                     normalizedArgs.id = args.target;
                 return await agentAction(targetSession, 'clicking', () => weaveClick(targetSession, normalizedArgs, liveConfig), 'browser_click');
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
         }
     });
     // ── 4. browser_type ────────────────────────────────────────────────────────
-    server.tool("browser_type", "Type text into a single input field (use browser_fill for smart multi-field forms). If NOT_EDITABLE, fallback to click + browser_key. Use browser_map if stuck.", {
-        id: z.string().optional().describe("Ref ID from browser_map. Primary targeting — always prefer this over label when you have a ref ID."),
-        selector: z.string().optional().describe("CSS selector of the input field. Use when you know the exact selector."),
+    server.tool("browser_type", "Type text into an input field or currently focused element. If id/selector/label is omitted, automatically types directly into document.activeElement without needing a redundant click or browser_map. If target is already focused, skips click to prevent unfocus bugs.", {
+        id: z.string().optional().describe("Ref ID from browser_map (e.g. 'w:42'). If omitted, types directly into the currently focused element or single page input."),
+        ref: z.string().optional().describe("Alias for id (e.g. 'w:42')."),
+        selector: z.string().optional().describe("CSS selector of the input field."),
         target: z.string().optional().describe("CSS selector or query string. Alias for selector."),
         label: z.string().optional().describe("Field label or placeholder text. Used for fuzzy matching."),
         intent: z.string().optional().describe("Semantic description of the field (e.g. 'search box', 'username field'). Checked against learned memory first."),
-        x: z.number().optional().describe("Raw X coordinate to focus before typing. Use as last resort when no id/selector/label is available."),
-        y: z.number().optional().describe("Raw Y coordinate to focus before typing. Use as last resort when no id/selector/label is available."),
-        text: z.string().describe("Text to type. If a NOT_EDITABLE error is returned: (1) use browser_click on the field, then (2) use browser_key with the text as individual keypresses."),
-        clearFirst: z.boolean().optional().describe("Wipe existing field content before typing. May break React/Vue controlled inputs — avoid unless field already has wrong text in it."),
-        paste: z.boolean().optional().describe("Instant paste mode via clipboard. Auto-enabled for text longer than 8 chars. Best for long URLs or multi-word strings."),
+        x: z.number().optional().describe("Raw X coordinate to focus before typing."),
+        y: z.number().optional().describe("Raw Y coordinate to focus before typing."),
+        text: z.string().describe("Text to type into the field."),
+        clearFirst: z.boolean().optional().describe("Wipe existing field content before typing."),
+        paste: z.boolean().optional().describe("Instant paste mode via clipboard. Auto-enabled for text longer than 8 chars."),
         include_map: z.boolean().optional().describe("Set true to include a full updated page_map in the response. Default false."),
         tab_id: z.string().optional().describe("Execute in a specific tab instead of active."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_type", async (session, liveConfig) => {
                 let targetSession = session;
                 if (args.tab_id) {
                     const { connectToTab } = await import("./cdp/connector.js");
-                    const client = await connectToTab(args.tab_id);
+                    const client = await connectToTab(args.tab_id, undefined, undefined, undefined, args.app);
                     targetSession = client.session;
                 }
                 const normalizedArgs = { ...args };
+                if (args.ref && !normalizedArgs.id)
+                    normalizedArgs.id = args.ref;
                 if (args.selector && !normalizedArgs.id)
                     normalizedArgs.id = args.selector;
                 if (args.target && !normalizedArgs.id)
                     normalizedArgs.id = args.target;
                 return await agentAction(targetSession, 'typing', () => weaveType(targetSession, normalizedArgs, liveConfig), 'browser_type');
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -509,13 +642,18 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
     // ── 4b. browser_type_secret ────────────────────────────────────────────────
     server.tool("browser_type_secret", "Inject a secret from an environment variable.", {
         id: z.string().optional().describe("Ref ID from browser_map."),
+        ref: z.string().optional().describe("Alias for id (e.g. 'w:42')."),
         target: z.string().optional().describe("Alternative target input element identifier or CSS selector."),
         envKey: z.string().describe("The environment variable key containing the secret."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_type_secret", async (session, liveConfig) => {
-                return await agentAction(session, 'typing', () => weaveTypeSecret(session, args, liveConfig), 'browser_type_secret');
-            });
+                const normalizedArgs = { ...args };
+                if (args.ref && !normalizedArgs.id)
+                    normalizedArgs.id = args.ref;
+                return await agentAction(session, 'typing', () => weaveTypeSecret(session, normalizedArgs, liveConfig), 'browser_type_secret');
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -526,18 +664,19 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         key: z.string().describe("Key name: Enter, Escape, Tab, ArrowDown, F5, etc. DO NOT SPAM. If action fails or loops, STOP calling this tool and use browser_map to re-evaluate the page state."),
         modifiers: z.array(z.enum(["Alt", "Ctrl", "Meta", "Shift"])).optional().describe("Array of modifier keys to hold during the press."),
         tab_id: z.string().optional().describe("Execute in a specific tab instead of active."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
-        const { key, modifiers, tab_id } = args;
+        const { key, modifiers, tab_id, app } = args;
         try {
             return await withSecurity(config, "browser_key", async (session, liveConfig) => {
                 let targetSession = session;
                 if (tab_id) {
                     const { connectToTab } = await import("./cdp/connector.js");
-                    const client = await connectToTab(tab_id);
+                    const client = await connectToTab(tab_id, undefined, undefined, undefined, app);
                     targetSession = client.session;
                 }
                 return await weaveKey(targetSession, { key, modifiers }, liveConfig);
-            });
+            }, false, app);
         }
         catch (e) {
             return wrapError(e);
@@ -546,39 +685,48 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
     // ── 6. browser_scroll ──────────────────────────────────────────────────────
     server.tool("browser_scroll", "Scroll the page.", {
         id: z.string().optional().describe("Ref ID to scroll into view or scroll inside of. DO NOT SPAM. If action fails or loops, STOP calling this tool and use browser_map to re-evaluate the page state."),
+        ref: z.string().optional().describe("Alias for id (e.g. 'w:42')."),
         selector: z.string().optional().describe("CSS Selector of the element to scroll into view."),
         target: z.string().optional().describe("Alternative element identifier or query to scroll into view."),
         label: z.string().optional().describe("Element label to scroll into view."),
         direction: z.enum(["up", "down", "left", "right"]).describe("Scroll direction."),
         distance: z.number().optional().describe("Pixels to scroll (default 400)."),
         tab_id: z.string().optional().describe("Execute in a specific tab instead of active. DO NOT SPAM. If action fails or loops, STOP calling this tool and use browser_map to re-evaluate the page state."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_scroll", async (session, liveConfig) => {
                 let targetSession = session;
                 if (args.tab_id) {
                     const { connectToTab } = await import("./cdp/connector.js");
-                    const client = await connectToTab(args.tab_id);
+                    const client = await connectToTab(args.tab_id, undefined, undefined, undefined, args.app);
                     targetSession = client.session;
                 }
                 const normalizedArgs = { ...args };
+                if (args.ref && !normalizedArgs.id)
+                    normalizedArgs.id = args.ref;
                 if (args.selector && !normalizedArgs.id)
                     normalizedArgs.id = args.selector;
                 if (args.target && !normalizedArgs.id)
                     normalizedArgs.id = args.target;
                 return await browserScroll(targetSession, normalizedArgs, liveConfig);
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
         }
     });
     // ── 7. browser_dialog ──────────────────────────────────────────────────────
-    server.tool("browser_dialog", "Accept or dismiss JS dialogs.", {
+    server.tool("browser_dialog", "Accept or dismiss JS dialogs (alert, confirm, prompt). Browser sessions only.", {
         action: z.enum(["accept", "dismiss"]).describe("Action to perform on the dialog."),
         promptText: z.string().optional().describe("Text to enter if it is a prompt dialog.")
     }, async (args) => {
         try {
+            const liveConfig = getCachedConfig();
+            const active = sessionRegistry.getActive(liveConfig.agentId);
+            if (active?.isElectron) {
+                return { content: [{ type: "text", text: "[Note] JS dialog interception is only available for web browser sessions (Electron apps handle dialogs natively)." }] };
+            }
             return await withSecurity(config, "browser_dialog", async (session) => {
                 return await browserDialog(session, args);
             });
@@ -588,70 +736,78 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         }
     });
     // ── 8. browser_burst ───────────────────────────────────────────────────────
-    server.tool("browser_burst", "Chain multiple tool calls in one round-trip. Use the 'click_and_wait' macro step instead of a standard click for buttons like login or buttons that will take time to load a new page.", {
+    server.tool("browser_burst", "HIGH-SPEED MULTI-ACTION PIPELINE: Executes 2 or more sequential browser actions in a single round-trip without waiting for LLM turns between steps. PREFER THIS over individual single-action calls (e.g. typing + pressing Enter, filling multiple form fields, clicking tabs/buttons then waiting, searching, navigating + reading) to drastically slash latency and token burn. Supports native primitives (browser_click, browser_fill, browser_type, browser_type_secret, browser_navigate, browser_key, browser_scroll, browser_wait, browser_map, etc.) plus ergonomic macro steps (type_and_send, click_and_wait, navigate_and_read, scroll_and_read, fill_form). If compile_from_history: true is passed, automatically compiles recent successful session trail actions into a burst macro.", {
         steps: z.array(z.object({
-            tool: z.enum(["browser_click", "browser_type", "browser_navigate", "browser_key", "browser_scroll", "browser_wait", "browser_map", "browser_pointer", "browser_eval", "browser_select", "type_and_send", "navigate_and_read", "click_and_wait", "scroll_and_read"]),
-            args: z.record(z.unknown()).describe("Arguments for the respective tool. For type_and_send: { text, x?, y?, id?, label?, pressEnter? }. For navigate_and_read: { url }. For click_and_wait: { id?, label?, x?, y?, wait_for?, wait_value? }. For scroll_and_read: { direction, distance? }.")
-        })).describe("Ordered array of tool calls to execute serially. Use macro steps to save tokens."),
-        batch: z.boolean().optional().describe("If true, defers action map generation until all steps are complete to save time.")
+            tool: z.string().describe("Tool name or macro step (e.g. browser_click, browser_fill, browser_type, type_and_send, click_and_wait, navigate_and_read, scroll_and_read, fill_form)."),
+            args: z.record(z.unknown()).optional().describe("Tool arguments. Alternatively, arguments may be specified flat on the step object."),
+        }).passthrough()).optional().describe("Ordered array of tool calls or macros to execute serially. Either 'steps' or 'actions' may be passed."),
+        actions: z.array(z.any()).optional().describe("Alias for 'steps'."),
+        compile_from_history: z.boolean().optional().describe("Compile recent successful session trail actions into a macro. If steps are omitted, executes the compiled macro directly."),
+        history_limit: z.number().optional().describe("Number of recent session trail entries to consider when compile_from_history is true (default: 20)."),
+        dry_run: z.boolean().optional().describe("If true with compile_from_history, returns the compiled steps without executing them."),
+        stop_on_error: z.boolean().optional().describe("Halt execution immediately if a step fails to prevent cascading failures (default: true)."),
+        batch: z.boolean().optional().describe("If true, defers action map generation until all steps are complete to maximize throughput."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_burst", async (session, liveConfig) => {
                 const { browserBurst } = await import("./tools/burst.js");
                 return await browserBurst(session, args, liveConfig);
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
         }
     });
     // ── 9. browser_tabs ───────────────────────────────────────────────────────
-    server.tool("browser_tabs", "Manage browser tabs (open, switch, close, list).", {
+    server.tool("browser_tabs", "Manage browser and Electron app tabs/windows (open, switch, close, list). Specify 'app' when targeting desktop apps (e.g. app: 'discord') to avoid opening web browser.", {
         action: z.enum(["list", "open", "close", "switch", "list_windows", "focus_window", "consolidate", "heal"]).describe("Action to perform. 'consolidate' deduplicates tabs. 'heal' recovers crashed tabs."),
         url: z.string().optional().describe("URL to open (required for 'open' action)."),
+        app: z.string().optional().describe("Optional Electron app name configured in config.json under 'electron'."),
         tabId: z.string().optional().describe("Target Tab ID (required for 'switch' or 'close')."),
         tabIds: z.array(z.string()).optional().describe("Multiple Tab IDs for batch 'close' action."),
         force: z.boolean().optional().describe("Force close protected (anchor) tabs. Use with extreme caution."),
         windowId: z.number().optional().describe("Window ID to focus (required for 'focus_window')."),
         reuse: z.boolean().optional().describe("Default true. When opening a URL already loaded in another tab, focus that tab instead of opening a duplicate."),
-    }, async ({ action, url, tabId, tabIds, force, windowId, reuse }) => {
+    }, async ({ action, url, app, tabId, tabIds, force, windowId, reuse }) => {
         try {
+            const resolvedApp = inferTargetApp(app, url, tabId || (tabIds && tabIds.length > 0 ? tabIds[0] : undefined));
             return await withSecurity(config, "browser_tabs", async (_, liveConfig) => {
                 if (action === "list")
-                    return await WeavetabList(liveConfig);
+                    return await WeavetabList(liveConfig, resolvedApp);
                 if (action === "open") {
                     if (!url)
                         throw new Error("url is required for action: open");
-                    return await WeavetabOpen(url, liveConfig, reuse !== false);
+                    return await WeavetabOpen(url, liveConfig, reuse !== false, resolvedApp);
                 }
                 if (action === "switch") {
                     if (!tabId)
                         throw new Error("tabId is required for action: switch");
-                    return await WeavetabSwitch(tabId, liveConfig);
+                    return await WeavetabSwitch(tabId, liveConfig, resolvedApp);
                 }
                 if (action === "close") {
                     if (tabIds && tabIds.length > 0)
-                        return await WeavetabCloseBatch(tabIds, liveConfig, force);
+                        return await WeavetabCloseBatch(tabIds, liveConfig, force, resolvedApp);
                     if (!tabId)
                         throw new Error("tabId or tabIds is required for action: close");
-                    return await WeavetabClose(tabId, liveConfig, force);
+                    return await WeavetabClose(tabId, liveConfig, force, resolvedApp);
                 }
                 if (action === "list_windows") {
-                    return await weaveWindowList(liveConfig);
+                    return await weaveWindowList(liveConfig, resolvedApp);
                 }
                 if (action === "focus_window") {
                     if (windowId === undefined)
                         throw new Error("windowId is required for action: focus_window");
-                    return await weaveFocusWindow(windowId, liveConfig);
+                    return await weaveFocusWindow(windowId, liveConfig, resolvedApp);
                 }
                 if (action === "consolidate") {
-                    return await WeavetabConsolidate(liveConfig);
+                    return await WeavetabConsolidate(liveConfig, resolvedApp);
                 }
                 if (action === "heal") {
-                    return await WeavetabHeal(liveConfig);
+                    return await WeavetabHeal(liveConfig, resolvedApp);
                 }
                 throw new Error("Invalid action");
-            });
+            }, false, resolvedApp);
         }
         catch (e) {
             return wrapError(e);
@@ -663,17 +819,18 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         value: z.string().optional().describe("CSS selector, text string, or URL pattern. Not needed for 'stable'/'network'."),
         timeout: z.number().optional().describe("Max wait in ms (default 8000)."),
         tab_id: z.string().optional().describe("Execute in a specific tab instead of active."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_wait", async (session, liveConfig) => {
                 let targetSession = session;
                 if (args.tab_id) {
                     const { connectToTab } = await import("./cdp/connector.js");
-                    const client = await connectToTab(args.tab_id);
+                    const client = await connectToTab(args.tab_id, undefined, undefined, undefined, args.app);
                     targetSession = client.session;
                 }
                 return await browserWait(targetSession, args, liveConfig);
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -694,13 +851,27 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         }
     });
     // ── 12. browser_thoughts ─────────────────────────────────────────────────────────
-    server.tool("browser_thoughts", "Agent-to-user communication. Use 'question' mode to ask a free-text question. Use 'feedback' mode to provide status updates or analysis (green sticky feedback).", {
+    server.tool("browser_thoughts", "Agent-to-user communication. Renders in the middle down of the page. Use 'question' mode to ask a free-text question. Use 'feedback' mode to provide status updates, analysis, or decisions. Supports element anchoring (e.g. 'w:15') and presentation styles ('observation', 'decision', 'warning', 'question').", {
         action: z.enum(["question", "feedback"]).describe("Action to perform."),
         message: z.string().describe("The question to ask, or the feedback/analysis to log."),
+        anchor: z.string().optional().describe("Optional element Ref ID (e.g. 'w:15') or CSS selector to visually anchor this thought to on the page."),
+        style: z.enum(["observation", "decision", "warning", "question"]).optional().describe("Thought presentation style. Defaults to 'observation' for feedback and 'question' for question."),
         input: z.enum(["sentence", "paragraph"]).optional().describe("Input field type for question mode (default: sentence)."),
         timeout: z.number().optional().describe("Timeout in seconds for question mode before auto-cancel (default: 120)."),
+        app: z.string().optional().describe("Optional Electron app name. (Note: thought HUD overlay is browser-only)."),
     }, async (args) => {
         try {
+            const liveConfig = getCachedConfig();
+            const active = sessionRegistry.getActive(liveConfig.agentId, args.app);
+            if (args.app || active?.isElectron) {
+                const { logActionStructured } = await import("./audit/logger.js");
+                logActionStructured({
+                    timestamp: new Date().toISOString(),
+                    tool: "browser_thoughts",
+                    result: `[ELECTRON APP FEEDBACK]: ${args.message}`
+                });
+                return { content: [{ type: "text", text: "[Note] Thought/HUD overlay is disabled for Electron desktop apps (DOM-only execution). Feedback recorded in audit log." }] };
+            }
             return await withSecurity(config, "browser_thoughts", async (session) => {
                 if (args.action === "feedback") {
                     const { logActionStructured } = await import("./audit/logger.js");
@@ -709,10 +880,22 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
                         tool: "browser_thoughts",
                         result: `[AGENT FEEDBACK]: ${args.message}`
                     });
-                    await browserThought(session, { action: "feedback", message: args.message });
+                    await browserThought(session, {
+                        action: "feedback",
+                        message: args.message,
+                        anchor: args.anchor,
+                        style: args.style,
+                    });
                     return { content: [{ type: "text", text: "Feedback appended to mission log and HUD." }] };
                 }
-                const result = await browserThought(session, { action: "question", message: args.message, input: args.input, timeout: args.timeout });
+                const result = await browserThought(session, {
+                    action: "question",
+                    message: args.message,
+                    anchor: args.anchor,
+                    style: args.style,
+                    input: args.input,
+                    timeout: args.timeout,
+                });
                 return { content: [{ type: "text", text: JSON.stringify(result) }] };
             });
         }
@@ -721,12 +904,13 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         }
     });
     // ── 13. browser_pointer ───────────────────────────────────────────────────────
-    server.tool("browser_pointer", "Advanced pointer control (hover, drag).", {
-        action: z.enum(["hover", "click", "double_click", "drag_and_drop"]).describe("Action to perform."),
+    server.tool("browser_pointer", "Advanced pointer control (hover, click, double_click, drag_and_drop, hover_chain). Use hover_chain for Photoshop/Photopea, Figma, and multi-level flyout submenus.", {
+        action: z.enum(["hover", "click", "double_click", "drag_and_drop", "hover_chain"]).optional().describe("Action to perform (default: click, or hover_chain if hover_chain array is provided)."),
         ref: z.string().optional().describe("Ref ID of the target element (e.g. w:42)."),
         id: z.string().optional().describe("Alternative element ID / Ref ID from browser_map."),
         selector: z.string().optional().describe("CSS Selector of the target element."),
         target: z.string().optional().describe("Alternative target element identifier or query."),
+        label: z.string().optional().describe("Target element label or text."),
         x: z.number().optional().describe("Raw X coordinate (fallback)."),
         y: z.number().optional().describe("Raw Y coordinate (fallback)."),
         end_ref: z.string().optional().describe("Destination Ref ID (only for drag_and_drop)."),
@@ -736,7 +920,11 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         end_x: z.number().optional().describe("Destination X coordinate (only for drag_and_drop)."),
         end_y: z.number().optional().describe("Destination Y coordinate (only for drag_and_drop)."),
         waitForChild: z.string().optional().describe("CSS Selector of a child element to wait for (only for hover)."),
-        holdMs: z.number().optional().describe("Milliseconds to hold the pointer down (only for hover).")
+        holdMs: z.number().optional().describe("Milliseconds to hold the pointer down (only for hover)."),
+        hover_chain: z.array(z.string()).optional().describe("Array of element ref IDs, selectors, or labels to hover sequentially and click the last one (e.g. ['File', 'Export As', 'PNG']). Perfect for Photoshop/Photopea, Figma, Canva, and multi-level flyout submenus."),
+        chain: z.array(z.any()).optional().describe("Advanced chain step array of { action, ref, label, selector, x, y, holdMs }."),
+        clickFinal: z.boolean().optional().describe("Default true. Whether to click the final element in the hover chain."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_pointer", async (session, liveConfig) => {
@@ -754,7 +942,7 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
                 if (args.end_target && !normalizedArgs.end_ref)
                     normalizedArgs.end_ref = args.end_target;
                 return await browserPointer(session, normalizedArgs, liveConfig);
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -765,41 +953,56 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         nodeId: z.number().optional().describe("CDP backendNodeId."),
         selector: z.string().optional().describe("CSS Selector."),
         value: z.string().describe("The exact text value to select."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_select", async (session, liveConfig) => {
                 return await browserSelect(session, args, liveConfig);
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
         }
     });
     // ── 14b. browser_fill ──────────────────────────────────────────────────────
-    server.tool("browser_fill", "Smart multi-field form-filling. Best for big complex forms to save round-trips.", {
+    server.tool("browser_fill", "Smart multi-field form-filling and input inspector. Call with scan:true (or empty) to get a lightweight list of all editable inputs on the page without dumping the full DOM. Fill multiple fields in a single turn.", {
         fields: z.array(z.object({
-            ref: z.string().describe("Element ref ID (w:NN) from browser_map."),
+            ref: z.string().optional().describe("Element ref ID (w:NN) from browser_map or input scan."),
+            selector: z.string().optional().describe("CSS selector of the field."),
+            target: z.string().optional().describe("Alternative selector or query."),
+            name: z.string().optional().describe("HTML name attribute of the field."),
+            label: z.string().optional().describe("Label or placeholder text."),
             value: z.string().describe("Value to fill/select/type into the field."),
-        })).describe("Array of field ref+value pairs to fill sequentially."),
+        })).optional().describe("Array of field ref+value pairs to fill sequentially."),
+        scan: z.boolean().optional().describe("Set true to discover and return all fillable inputs on the page (with ref IDs, types, and values) in ~30 tokens without full browser_map."),
+        inputs: z.boolean().optional().describe("Alias for scan."),
+        scan_only: z.boolean().optional().describe("Validate field types without mutating DOM."),
+        blast_mode: z.boolean().optional().describe("Fill all fields simultaneously in a single CDP eval round-trip."),
         submit: z.string().optional().describe("Optional ref ID (w:NN) of a submit button to click after filling all fields."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_fill", async (session, liveConfig) => {
                 return await agentAction(session, 'typing', () => browserFill(session, args, liveConfig), 'browser_fill');
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
         }
     });
     // ── 18. browser_highlight ───────────────────────────────────────────────────
-    server.tool("browser_highlight", "Highlight an element with a colored overlay.", {
+    server.tool("browser_highlight", "Highlight elements on page. Supports single or multiple candidates (refs) with styles ('consideration' for candidate evaluation, 'target' for lock-on, 'danger' for destructive actions, 'success', or 'shimmer'), floating badges, and configurable duration.", {
         selector: z.string().optional().describe("CSS Selector of the element to highlight."),
         id: z.string().optional().describe("Alternative element Ref ID from browser_map (e.g. 'w:42')."),
         ref: z.string().optional().describe("Alternative element Ref ID (e.g. 'w:42')."),
+        refs: z.array(z.string()).optional().describe("Array of element Ref IDs to highlight concurrently (e.g. ['w:12', 'w:15', 'w:23'])."),
         target: z.string().optional().describe("Alternative element identifier, CSS Selector, or query."),
+        style: z.enum(["consideration", "target", "danger", "success", "shimmer"]).optional().describe("Visual highlight style. Defaults to 'shimmer' (or 'consideration' when refs provided)."),
+        label: z.string().optional().describe("Floating label badge text to display above the element(s)."),
+        duration: z.number().optional().describe("Duration in ms to keep highlight visible (default: 2000ms for consideration/target, 600ms for shimmer)."),
         nodeId: z.number().optional().describe("CDP backendNodeId to highlight directly."),
-        color: z.string().optional().describe("CSS color to use for the overlay (e.g. 'rgba(255,0,0,0.5)').")
+        color: z.string().optional().describe("Custom CSS color to use for the overlay (e.g. 'rgba(255,0,0,0.5)')."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_highlight", async (session, liveConfig) => {
@@ -817,7 +1020,7 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
                 delete normalizedArgs.ref;
                 delete normalizedArgs.target;
                 return await browserHighlight(session, normalizedArgs, liveConfig);
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -826,25 +1029,29 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
     // ── 20. browser_upload ──────────────────────────────────────────────────────
     server.tool("browser_upload", "Upload files to a file input.", {
         nodeId: z.number().describe("CDP backendNodeId of the target <input type='file'> element."),
-        filePaths: z.array(z.string()).describe("List of absolute system file paths to upload.")
+        filePaths: z.array(z.string()).describe("List of absolute system file paths to upload."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_upload", async (session, liveConfig) => {
                 return await browserUpload(session, args, liveConfig);
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
         }
     });
     // ── 22. browser_find ────────────────────────────────────────────────────────
-    server.tool("browser_find", "Sub-5ms CDP text search. Zero token waste. Best for locating specific keywords/text on page without a full DOM walk. No refs returned (use browser_map for refs). No shadow roots/regex.", {
-        query: z.string().describe("Exact text query to find on the page.")
+    server.tool("browser_find", "Instant text & keyword search across page text, labels, and placeholders. Returns matched element coordinates, selectors, and ref IDs.", {
+        query: z.string().describe("Text or keyword query to search for on the page."),
+        all: z.boolean().optional().describe("Set true to return all matching elements on the page (default false returns first match)."),
+        limit: z.number().optional().describe("Max number of matches to return when all: true (default 10)."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_find", async (session, liveConfig) => {
                 return await agentAction(session, 'reading', () => browserFind(session, args, liveConfig), 'browser_find');
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -856,11 +1063,12 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         action: z.enum(["get", "set", "clear"]).describe("Action to perform on the storage."),
         key: z.string().optional().describe("Key name (required for 'get' and 'set' actions)."),
         value: z.string().optional().describe("String value (required for 'set' action)."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_storage", async (session, liveConfig) => {
                 return await browserStorage(session, args, liveConfig);
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -872,11 +1080,12 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         pattern: z.string().optional().describe("URL glob pattern to intercept or filter telemetry (e.g. '*api/login*')."),
         mockStatus: z.number().optional().describe("HTTP status code to return when enabling mock (default 200)."),
         mockBody: z.string().optional().describe("JSON or plaintext body payload to return in the mocked response."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_network_intercept", async (session, liveConfig) => {
                 return await browserNetworkIntercept(session, args, liveConfig);
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -884,17 +1093,18 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
     });
     // ── 25. browser_console ─────────────────────────────────────────────────────
     server.tool("browser_console", "1-5ms latency. Read or clear buffered console API messages, JS exceptions, and network errors.", {
-        action: z.enum(["read", "clear"]).describe("Action to perform on the console buffer.")
+        action: z.enum(["read", "clear"]).describe("Action to perform on the console buffer."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_console", async (session, liveConfig) => {
                 let targetId = "default";
                 const { sessionRegistry } = await import("./state/session.js");
-                const active = sessionRegistry.getActive(liveConfig.agentId);
+                const active = sessionRegistry.getActive(liveConfig.agentId, args.app);
                 if (active)
                     targetId = active.targetId;
                 return await browserConsole(session, args, liveConfig, targetId);
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -906,11 +1116,12 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         landscape: z.boolean().optional().describe("Print in landscape orientation (default false)."),
         scale: z.number().optional().describe("Scale factor (default 1.0)."),
         pageRanges: z.string().optional().describe("Page ranges to print (e.g. '1-5'). Leave empty for all pages."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_pdf", async (session, liveConfig) => {
                 return await browserPdf(session, args, liveConfig);
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -919,12 +1130,13 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
     // ── 27. browser_eval ────────────────────────────────────────────────────────
     server.tool("browser_eval", "Run arbitrary JS via CDP. Good for extracting app state. Cannot traverse shadow DOM/cross-origin iframes.", {
         expression: z.string().describe("JavaScript code to evaluate in the context of the page."),
-        timeout: z.number().optional().describe("Timeout in ms (default 5000).")
+        timeout: z.number().optional().describe("Timeout in ms (default 5000)."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_eval", async (session, liveConfig) => {
                 return await agentAction(session, 'reading', () => browserEval(session, args, liveConfig), 'browser_eval');
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -938,11 +1150,12 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         domain: z.string().optional().describe("Domain for the cookie."),
         path: z.string().optional().describe("Path for the cookie."),
         url: z.string().optional().describe("URL scope for 'get' action (defaults to current page)."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_cookies", async (session, liveConfig) => {
                 return await browserCookies(session, args, liveConfig);
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -956,12 +1169,13 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         label: z.string().optional().describe("Visible text or aria-label of the canvas element."),
         ref: z.string().optional().describe("Alternative ref identifier for the canvas element."),
         backendNodeId: z.number().optional().describe("Raw CDP backendNodeId for direct targeting."),
-        points: z.array(z.object({ x: z.number(), y: z.number() })).optional().describe("Array of {x,y} points relative to canvas viewport for 'draw' action. Simulates a drag path across the canvas.")
+        points: z.array(z.object({ x: z.number(), y: z.number() })).optional().describe("Array of {x,y} points relative to canvas viewport for 'draw' action. Simulates a drag path across the canvas."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_canvas", async (session, liveConfig) => {
                 return await browserCanvas(session, args, liveConfig);
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -972,12 +1186,13 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         query: z.string().describe("CSS Selector or XPath query to extract."),
         type: z.enum(["css", "xpath"]).optional().describe("Query type (default 'css')."),
         attributes: z.array(z.string()).optional().describe("Attributes to extract (e.g. ['textContent', 'href'], default ['textContent'])."),
-        multiple: z.boolean().optional().describe("Whether to extract multiple elements (default true).")
+        multiple: z.boolean().optional().describe("Whether to extract multiple elements (default true)."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_scrape", async (session, liveConfig) => {
                 return await agentAction(session, 'reading', () => browserScrape(session, args, liveConfig), 'browser_scrape');
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -986,12 +1201,13 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
     // ── 32. browser_snapshot ────────────────────────────────────────────────────
     server.tool("browser_snapshot", "Capture or restore an MHTML snapshot. Best for offline archival, replay testing, and compliance audits.", {
         action: z.enum(["capture", "restore"]).describe("Action to perform."),
-        filePath: z.string().describe("Absolute file path to save/load the .mhtml snapshot.")
+        filePath: z.string().describe("Absolute file path to save/load the .mhtml snapshot."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_snapshot", async (session, liveConfig) => {
                 return await browserSnapshot(session, args, liveConfig);
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -1007,12 +1223,13 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
             y: z.number().describe("Y coordinate of clip region."),
             width: z.number().describe("Width of clip region."),
             height: z.number().describe("Height of clip region.")
-        }).optional().describe("Clip region. Use to capture only part of the page (e.g. just a chart area) to reduce token cost.")
+        }).optional().describe("Clip region. Use to capture only part of the page (e.g. just a chart area) to reduce token cost."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_screenshot", async (session, liveConfig) => {
                 return await agentAction(session, 'reading', () => browserScreenshot(session, args, liveConfig), 'browser_screenshot');
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -1024,12 +1241,13 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         width: z.number().optional().describe("Viewport width in pixels."),
         height: z.number().optional().describe("Viewport height in pixels."),
         deviceScaleFactor: z.number().optional().describe("Device Pixel Ratio (default 1)."),
-        mobile: z.boolean().optional().describe("Whether to emulate a mobile device (default false).")
+        mobile: z.boolean().optional().describe("Whether to emulate a mobile device (default false)."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_viewport", async (session, liveConfig) => {
                 return await browserViewport(session, args, liveConfig);
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -1040,27 +1258,29 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         action: z.enum(["read", "write"]).describe("Action to perform."),
         text: z.string().optional().describe("Text to write to clipboard (for write action)."),
         dataUrl: z.string().optional().describe("Base64 data URL of an image to write to clipboard (e.g. 'data:image/png;base64,...')."),
-        mimeType: z.string().optional().describe("MIME type override for image write (auto-detected from dataUrl by default, e.g. 'image/png').")
+        mimeType: z.string().optional().describe("MIME type override for image write (auto-detected from dataUrl by default, e.g. 'image/png')."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_clipboard", async (session, liveConfig) => {
                 return await browserClipboard(session, args, liveConfig);
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
         }
     });
     // ── 36. browser_inspect ─────────────────────────────────────────────────────
-    server.tool("browser_inspect", "15-35ms latency, zero waste. Deep DOM inspection. Crucial for debugging why a click failed, verifying z-index & visibility, or computed styles.", {
+    server.tool("browser_inspect", "15-35ms latency, zero waste. Deep DOM inspection. Useful for debugging failed clicks, verifying z-index & visibility, or computed styles.", {
         nodeId: z.number().optional().describe("CDP backendNodeId."),
         selector: z.string().optional().describe("CSS Selector."),
-        ref: z.string().optional().describe("Ref ID (e.g. 'w:42').")
+        ref: z.string().optional().describe("Ref ID (e.g. 'w:42')."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_inspect", async (session, liveConfig) => {
                 return await agentAction(session, 'reading', () => browserInspect(session, args, liveConfig), 'browser_inspect');
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -1073,12 +1293,13 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         outputDir: z.string().optional().describe("Optional custom directory to write extracted files into. If omitted, uses configured designDir (~/.weavetab/designs/<domain>-<timestamp>/)."),
         name: z.string().optional().describe("Optional custom name for the saved design folder (e.g. 'resend-hero', 'pricing-section')."),
         includeAssets: z.boolean().optional().describe("Whether to capture inline SVGs and asset references (default true)."),
-        hideOverlay: z.boolean().optional().describe("Whether to hide Weavetab overlay during capture (default true).")
+        hideOverlay: z.boolean().optional().describe("Whether to hide Weavetab overlay during capture (default true)."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_extract_design", async (session, liveConfig) => {
                 return await agentAction(session, 'reading', () => browserExtractDesign(session, args, liveConfig), 'browser_extract_design');
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -1091,12 +1312,13 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         script: z.string().optional().describe("JavaScript code to inject and run (required for start)."),
         persistent: z.boolean().optional().describe("If true, the script re-runs in a loop (default false)."),
         onResult: z.enum(["notify_agent", "store", "ignore"]).optional().describe("How to handle script results (default 'store')."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_automation", async (session, liveConfig) => {
                 const result = await browserAutomation(session, args, liveConfig);
                 return { content: [{ type: "text", text: JSON.stringify(result) }] };
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
@@ -1110,28 +1332,22 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         maxFrames: z.number().optional().describe("Maximum frames to capture (default 500)."),
         format: z.enum(["webp", "gif", "webm", "mp4", "frames"]).optional().describe("Output video format when stopping recording. Default 'webp' (pure Node native compilation)."),
         keepFrames: z.boolean().optional().describe("If true, keeps raw JPEG frames after video compilation (default false)."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_recording", async (session, liveConfig) => {
                 const result = await browserRecording(session, args, liveConfig);
                 return { content: [{ type: "text", text: JSON.stringify(result) }] };
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
         }
     });
-    // ── 38. browser_reset_loop_counter ─────────────────────────────────────────
-    server.tool("browser_reset_loop_counter", "Reset the loop detection counter.", {
-        reason: z.string().optional().describe("Optional reason for the reset (e.g. 'new_task', 'manual_recovery')."),
-    }, async (args) => {
-        resetLoopCounter(args.reason || "manual_tool_call");
-        return { content: [{ type: "text", text: JSON.stringify({ success: true, reason: args.reason || "manual_tool_call" }) }] };
-    });
     // ── 37. browser_detect ─────────────────────────────────────────────────────
-    server.tool("browser_detect", "Detect available browsers on the machine.", {}, async () => {
+    server.tool("browser_detect", "CRITICAL INITIALIZATION TOOL. Detect available browsers and configured desktop apps (Discord, Slack, etc.). Call this FIRST before interacting with the environment to know if apps are online/offline and what tabs they have open.", {}, async () => {
         try {
-            const result = detectBrowsers(getActiveEngine());
+            const result = await detectBrowsers(getActiveEngine());
             return { content: [{ type: "text", text: JSON.stringify(result) }] };
         }
         catch (e) {
@@ -1139,84 +1355,126 @@ export async function startServer(config, transportMode = "stdio", wsPort = 3000
         }
     });
     // ── browser_performance ───────────────────────────────────────────────────
-    server.tool("browser_performance", "Retrieve page performance metrics.", {}, async () => {
+    server.tool("browser_performance", "Retrieve page performance metrics.", {
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
+    }, async (args) => {
         try {
             return await withSecurity(config, "browser_performance", async (session, liveConfig) => {
                 const result = await browserPerformance(session, liveConfig);
                 return { content: [{ type: "text", text: JSON.stringify(result) }] };
-            });
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
         }
     });
-    // ── browser_macro_compile ─────────────────────────────────────────────────
-    server.tool("browser_macro_compile", "Compile a recent trail into a burst macro.", {
-        trail_steps: z.array(z.any()).describe("An array of TrailStep objects representing successful steps.")
-    }, async (args) => {
-        try {
-            const result = compileTraceToMacro(args.trail_steps);
-            return { content: [{ type: "text", text: JSON.stringify(result) }] };
-        }
-        catch (e) {
-            return wrapError(e);
-        }
-    });
-    // ── GitHub Tools (v2.5.0 Core Inclusion) ──────────────────────────────────
-    server.tool("github_analyze", "Analyze a GitHub repository.", {
-        repo: z.string().optional().describe("Optional 'owner/repo' slug. If omitted, uses the active tab's repository.")
-    }, async (args) => {
-        try {
-            return await withSecurity(config, "github_analyze", async (session, liveConfig) => {
-                // Defence-in-depth: coerce to string | undefined at the server boundary.
-                // Zod marks `repo` as optional(string) but (args as any) bypasses that
-                // guarantee, so we normalise here before forwarding to githubAnalyze.
-                const rawRepo = args.repo;
-                const repo = typeof rawRepo === "string" && rawRepo.trim() !== ""
-                    ? rawRepo.trim()
-                    : undefined;
-                return await githubAnalyze(session, liveConfig, repo);
-            });
-        }
-        catch (e) {
-            return wrapError(e);
-        }
-    });
-    server.tool("github_read", "Read file contents from a GitHub repository.", {
-        paths: z.array(z.string()).describe("List of file paths to read, relative to the repository root."),
-        line_range: z.array(z.number()).length(2).optional().describe("Optional [start, end] line range to read specific lines instead of the default first 200 lines. 1-indexed.")
-    }, async (args) => {
-        try {
-            return await withSecurity(config, "github_read", async (session, liveConfig) => {
-                return await githubRead(session, args, liveConfig);
-            });
-        }
-        catch (e) {
-            return wrapError(e);
-        }
-    });
-    server.tool("github_issues", "Interact with GitHub issues.", {
-        search: z.string().optional().describe("Search query to find issues."),
-        number: z.number().optional().describe("Specific issue number to fetch details and comments for."),
-        labels: z.array(z.string()).optional().describe("Filter issues by labels."),
-        state: z.enum(["open", "closed", "all"]).optional().describe("Filter issues by state."),
-        limit: z.number().optional().describe("Max number of issues to list. Default 5.")
+    // ── browser_pattern_learn ─────────────────────────────────────────────────
+    server.tool("browser_pattern_learn", "Read, register, update, and record execution outcomes for named workflow patterns and site quirks in ~/.weavetab-system/memory/sites/. Use action='get' at session start to inspect a site profile and decide between fast-path replay (reliability ≥ 0.8) or exploratory navigation. Use action='learn' after completing a multi-step flow to persist it. Use action='record_execution' to update reliability scores after replay attempts.", {
+        origin: z.string().optional().describe("Full origin associated with the pattern, e.g. 'https://github.com'. Required for write actions. If omitted with action='get', reads the active tab origin."),
+        action: z.enum(["get", "learn", "record_execution", "record_quirk"]).default("learn").describe("'get': inspect site profile and known workflow patterns. 'learn': create/update a named pattern. 'record_execution': update reliability after replay. 'record_quirk': store a site quirk."),
+        pattern: z.string().optional().describe("With action='get': returns reliability score for this specific named pattern only."),
+        name: z.string().optional().describe("Pattern name in snake_case (required for 'learn' and 'record_execution')."),
+        steps: z.array(z.object({
+            tool: z.string().describe("MCP tool name, e.g. 'browser_click'."),
+            target: z.string().optional().describe("Selector or URL."),
+            value: z.string().optional().describe("Value for browser_type/browser_fill/browser_select."),
+            extra: z.record(z.any()).optional().describe("Additional tool arguments.")
+        })).optional().describe("Ordered workflow steps (required for 'learn')."),
+        success_indicator: z.string().optional().describe("CSS selector or URL fragment confirming workflow success."),
+        entry: z.string().optional().describe("URL path or pattern where this workflow starts."),
+        success: z.boolean().optional().describe("Whether the execution succeeded (required for 'record_execution')."),
+        duration_ms: z.number().optional().describe("Execution duration in ms (optional for 'record_execution')."),
+        quirk_key: z.string().optional().describe("Quirk key: 'cookie_banner', 'rate_limit', or 'modal_popups' (required for 'record_quirk')."),
+        quirk_data: z.record(z.any()).optional().describe("Quirk payload object (required for 'record_quirk').")
     }, async (args) => {
         try {
-            return await withSecurity(config, "github_issues", async (session) => {
-                return await githubIssues(session, args);
-            });
+            if (args.action === "get") {
+                let resolvedOrigin = args.origin;
+                if (!resolvedOrigin) {
+                    return await withSecurity(config, "browser_pattern_learn", async (session, _liveConfig) => {
+                        try {
+                            const res = await session.Runtime.evaluate({
+                                expression: "window.location.origin",
+                                returnByValue: true,
+                            });
+                            resolvedOrigin = res?.result?.value;
+                        }
+                        catch { /* fall through */ }
+                        if (!resolvedOrigin) {
+                            return { content: [{ type: "text", text: JSON.stringify({ error: "Could not determine origin from active tab. Pass origin explicitly." }) }] };
+                        }
+                        if (args.pattern) {
+                            const reliability = await getPatternReliability(resolvedOrigin, args.pattern);
+                            return { content: [{ type: "text", text: JSON.stringify({ origin: resolvedOrigin, pattern: args.pattern, reliability }) }] };
+                        }
+                        const profile = await getSiteProfile(resolvedOrigin);
+                        if (!profile) {
+                            return { content: [{ type: "text", text: JSON.stringify({ origin: resolvedOrigin, known: false, message: "No site profile found. This site has not been profiled yet." }) }] };
+                        }
+                        const hint = formatSiteProfileHint(profile);
+                        return { content: [{ type: "text", text: JSON.stringify({ ...profile, _hint: hint }) }] };
+                    });
+                }
+                if (args.pattern) {
+                    const reliability = await getPatternReliability(resolvedOrigin, args.pattern);
+                    return { content: [{ type: "text", text: JSON.stringify({ origin: resolvedOrigin, pattern: args.pattern, reliability }) }] };
+                }
+                const profile = await getSiteProfile(resolvedOrigin);
+                if (!profile) {
+                    return { content: [{ type: "text", text: JSON.stringify({ origin: resolvedOrigin, known: false, message: "No site profile found. This site has not been profiled yet." }) }] };
+                }
+                const hint = formatSiteProfileHint(profile);
+                return { content: [{ type: "text", text: JSON.stringify({ ...profile, _hint: hint }) }] };
+            }
+            if (!args.origin)
+                return { content: [{ type: "text", text: JSON.stringify({ error: "origin is required for write actions" }) }] };
+            if (args.action === "learn") {
+                if (!args.name)
+                    return { content: [{ type: "text", text: JSON.stringify({ error: "name is required for action='learn'" }) }] };
+                const pattern = await learnPattern(args.origin, args.name, {
+                    steps: args.steps ?? [],
+                    success_indicator: args.success_indicator,
+                    entry: args.entry,
+                });
+                return { content: [{ type: "text", text: JSON.stringify({ ok: true, pattern }) }] };
+            }
+            if (args.action === "record_execution") {
+                if (!args.name)
+                    return { content: [{ type: "text", text: JSON.stringify({ error: "name is required for action='record_execution'" }) }] };
+                if (args.success === undefined)
+                    return { content: [{ type: "text", text: JSON.stringify({ error: "success (boolean) is required for action='record_execution'" }) }] };
+                const updated = await recordPatternExecution(args.origin, args.name, args.success, args.duration_ms);
+                return { content: [{ type: "text", text: JSON.stringify({ ok: true, pattern: updated }) }] };
+            }
+            if (args.action === "record_quirk") {
+                if (!args.quirk_key)
+                    return { content: [{ type: "text", text: JSON.stringify({ error: "quirk_key is required for action='record_quirk'" }) }] };
+                if (!args.quirk_data)
+                    return { content: [{ type: "text", text: JSON.stringify({ error: "quirk_data is required for action='record_quirk'" }) }] };
+                await recordQuirk(args.origin, args.quirk_key, args.quirk_data);
+                return { content: [{ type: "text", text: JSON.stringify({ ok: true, origin: args.origin, quirk_key: args.quirk_key }) }] };
+            }
+            return { content: [{ type: "text", text: JSON.stringify({ error: "Unknown action" }) }] };
         }
         catch (e) {
             return wrapError(e);
         }
     });
-    server.tool("github_get_pr", "Interact with GitHub pull requests.", {
-        number: z.number().optional().describe("Specific pull request number to fetch details, changed files, and comments for. If omitted, lists recent PRs.")
+    // ── GitHub Tool (v2.5.0 Consolidated) ──────────────────────────────────
+    server.tool("browser_github", "Interact with GitHub repositories without burning browser turns. Analyze repo trees, read raw source files, search/inspect issues, and examine PR diffs and review comments.", {
+        action: z.enum(["analyze", "read", "issues", "pr"]).describe("GitHub operation: 'analyze' (repo structure & README), 'read' (raw file contents), 'issues' (list/search/inspect issues), 'pr' (PR details, diff files & comments)."),
+        repo: z.string().optional().describe("Optional 'owner/repo' slug or GitHub URL. If omitted, uses active tab's repository."),
+        paths: z.array(z.string()).optional().describe("For action: 'read'. File paths relative to repo root."),
+        line_range: z.array(z.number()).length(2).optional().describe("For action: 'read'. Optional [start, end] line range (1-indexed)."),
+        number: z.number().optional().describe("For action: 'issues' or 'pr'. Issue or PR number to fetch details and comments."),
+        search: z.string().optional().describe("For action: 'issues'. Search query to find issues."),
+        labels: z.array(z.string()).optional().describe("For action: 'issues'. Filter issues by labels."),
+        state: z.enum(["open", "closed", "all"]).optional().describe("For action: 'issues'. Filter issues by state."),
+        limit: z.number().optional().describe("For action: 'issues'. Max number of issues to list (default 5).")
     }, async (args) => {
         try {
-            return await withSecurity(config, "github_get_pr", async (session) => {
-                return await githubGetPr(session, args);
+            return await withSecurity(config, "browser_github", async (session, liveConfig) => {
+                return await browserGithub(session, args, liveConfig);
             });
         }
         catch (e) {
@@ -1285,17 +1543,33 @@ DO NOT use browser_scrape or browser_map for binary documents — they cannot re
         }).optional().describe("Override geolocation coordinates"),
         timezoneId: z.string().optional().describe("Override browser timezone (e.g. 'America/New_York')"),
         userAgent: z.string().optional().describe("Override User Agent string"),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
     }, async (args) => {
         try {
             return await withSecurity(config, "browser_emulate", async (session, liveConfig) => {
                 return await browserEmulate(session, args, liveConfig);
-            });
+            }, false, args.app);
+        }
+        catch (e) {
+            return wrapError(e);
+        }
+    });
+    // ── 45. browser_checkpoint ─────────────────────────────────────────────────
+    server.tool("browser_checkpoint", "Snapshot and restore browser state (cookies, localStorage, sessionStorage, and scroll/URL) into named checkpoints to time-travel and rollback failed automation branches.", {
+        action: z.enum(["save", "restore", "list", "delete"]).describe("Action to perform: 'save' a new checkpoint, 'restore' an existing checkpoint, 'list' all checkpoints, or 'delete' a checkpoint."),
+        name: z.string().optional().describe("Checkpoint name identifier (required for 'save', 'restore', 'delete')."),
+        includeDom: z.boolean().optional().describe("Whether to include a lightweight DOM snapshot during 'save' (default false)."),
+        app: z.string().optional().describe("Electron app name configured in config.json under 'electron'."),
+    }, async (args) => {
+        try {
+            return await withSecurity(config, "browser_checkpoint", async (session, liveConfig) => {
+                return await browserCheckpoint(session, args, liveConfig);
+            }, false, args.app);
         }
         catch (e) {
             return wrapError(e);
         }
     });
-    // ── Prompts ──────────────────────────────────────────────────────────────────
     // page_context: zero-shot context injection. Invoke with /page_context
     // in any MCP client that supports prompts (Claude Desktop, etc.).
     server.prompt("page_context", "Analyze the current active tab. Use this to give the agent instant context about the page without wasting tool calls.", async () => {
@@ -1409,29 +1683,35 @@ DO NOT use browser_scrape or browser_map for binary documents — they cannot re
                 }]
         };
     });
-    // ── Plugins Lifecycle (Add / Override / Remove) ───────────────────────────
-    const plugins = discoverPlugins();
+    // ── Plugins Lifecycle & Dynamic Registry ───────────────────────────
     const { getVerifiedPackages, resolvePluginTrust } = await import("./plugin/registry.js");
     const verifiedPackages = await getVerifiedPackages();
-    let pluginAddedCount = 0;
-    let pluginOverrideCount = 0;
-    let pluginRemovedCount = 0;
-    for (const plugin of plugins) {
+    const loadedPluginNames = new Set();
+    const registerPluginTools = async (plugin) => {
+        if (loadedPluginNames.has(plugin.name))
+            return;
         const trust = resolvePluginTrust(plugin.name, verifiedPackages);
         const isOfficial = trust.tier === "official";
         const addedNames = [];
         const overriddenNames = [];
         const removedNames = [];
+        // Register any hooks declared in the plugin
+        if (plugin.hooks) {
+            hookPipeline.registerPluginHooks(plugin.name, plugin.hooks);
+        }
         // 1. Tool Removals (disable built-in tools)
+        const manifestPerms = plugin.manifest?.permissions;
+        const manifestToolsRemove = Array.isArray(manifestPerms)
+            ? []
+            : manifestPerms?.tools?.remove || [];
         const toRemove = [
             ...(plugin.removeTools || []),
-            ...(plugin.manifest?.permissions?.tools?.remove || []),
+            ...manifestToolsRemove,
         ];
         for (const toolName of toRemove) {
             if (server._registeredTools?.[toolName]) {
                 delete server._registeredTools[toolName];
                 removedNames.push(toolName);
-                pluginRemovedCount++;
             }
         }
         // 2. Tool Overrides (replace or wrap built-in tools)
@@ -1447,13 +1727,15 @@ DO NOT use browser_scrape or browser_map for binary documents — they cannot re
                 try {
                     return await withSecurity(config, ov.name, async (session, liveConfig) => {
                         const wrappedOrig = existingTool
-                            ? async (origArgs, _sess, _cfg) => {
-                                const res = await existingTool.handler(origArgs, {});
+                            ? async (origArgs, origSess, origCfg) => {
+                                const finalSess = origSess || session;
+                                const finalCfg = origCfg || liveConfig;
+                                const res = await existingTool.handler(origArgs, finalSess, finalCfg);
                                 return res;
                             }
                             : undefined;
                         const result = await ov.handler(args, session, liveConfig, wrappedOrig);
-                        return { content: [{ type: "text", text: JSON.stringify(result) }] };
+                        return result;
                     }, isOfficial);
                 }
                 catch (e) {
@@ -1461,19 +1743,19 @@ DO NOT use browser_scrape or browser_map for binary documents — they cannot re
                 }
             });
             overriddenNames.push(ov.name);
-            pluginOverrideCount++;
         }
         // 3. Tool Additions (new tools)
         const newTools = plugin.tools || [];
         for (const td of newTools) {
             if (server._registeredTools?.[td.name]) {
+                process.stderr.write(`  \x1b[33m[!] Plugin ${plugin.name} registered tool "${td.name}" which replaced an existing tool.\x1b[0m\n`);
                 delete server._registeredTools[td.name];
             }
-            server.tool(td.name, td.description, td.schema, async (args) => {
+            server.tool(td.name, td.description, td.schema || td.parameters || {}, async (args) => {
                 try {
                     return await withSecurity(config, td.name, async (session, liveConfig) => {
                         const result = await td.handler(args, session, liveConfig);
-                        return { content: [{ type: "text", text: JSON.stringify(result) }] };
+                        return result;
                     }, isOfficial);
                 }
                 catch (e) {
@@ -1481,45 +1763,105 @@ DO NOT use browser_scrape or browser_map for binary documents — they cannot re
                 }
             });
             addedNames.push(td.name);
-            pluginAddedCount++;
         }
-        // Execute plugin onLoad hook if present
+        // Pass the rich SDK context so dynamic tool registrations receive full security & session
+        const fullPluginCtx = plugin._context;
+        if (fullPluginCtx && fullPluginCtx.mcp) {
+            fullPluginCtx.mcp.registerTool = (tool) => {
+                if (server._registeredTools?.[tool.name]) {
+                    process.stderr.write(`  \x1b[33m[!] Plugin ${plugin.name} dynamic tool "${tool.name}" replaced an existing tool.\x1b[0m\n`);
+                    delete server._registeredTools[tool.name];
+                }
+                server.tool(tool.name, tool.description || "", tool.schema || tool.parameters || {}, async (args) => {
+                    return await withSecurity(config, tool.name, async (session, liveConfig) => {
+                        const result = await tool.handler(args, session, liveConfig);
+                        return result;
+                    }, isOfficial);
+                });
+            };
+            fullPluginCtx.mcp.overrideTool = (toolName, overrideHandler) => {
+                const existingTool = server._registeredTools?.[toolName];
+                if (existingTool) {
+                    delete server._registeredTools[toolName];
+                }
+                server.tool(toolName, `Tool overridden by ${plugin.name}`, {}, async (args) => {
+                    return await withSecurity(config, toolName, async (session, liveConfig) => {
+                        const wrappedOrig = existingTool
+                            ? async (origArgs, origSess, origCfg) => {
+                                const finalSess = origSess || session;
+                                const finalCfg = origCfg || liveConfig;
+                                return await existingTool.handler(origArgs, finalSess, finalCfg);
+                            }
+                            : undefined;
+                        const result = await overrideHandler(args, session, liveConfig, wrappedOrig);
+                        return result;
+                    }, isOfficial);
+                });
+            };
+            fullPluginCtx.mcp.removeTool = (toolName) => {
+                if (server._registeredTools?.[toolName]) {
+                    delete server._registeredTools[toolName];
+                }
+            };
+            fullPluginCtx.mcp.unregisterTool = (toolName) => {
+                if (server._registeredTools?.[toolName]) {
+                    delete server._registeredTools[toolName];
+                }
+            };
+        }
         if (typeof plugin.onLoad === "function") {
             try {
-                await plugin.onLoad();
+                await plugin.onLoad(fullPluginCtx || plugin._context);
             }
             catch (err) {
                 process.stderr.write(`  \u001b[31m[!] Plugin ${plugin.name} onLoad failed: ${err?.message}\u001b[0m\n`);
             }
         }
-        // Build permission and operations warning string
-        const ops = [];
-        if (addedNames.length > 0)
-            ops.push(`+${addedNames.length} added`);
-        if (overriddenNames.length > 0)
-            ops.push(`⚡overrode [${overriddenNames.join(", ")}]`);
-        if (removedNames.length > 0)
-            ops.push(`✖removed [${removedNames.join(", ")}]`);
-        const opsStr = ops.length > 0 ? ` (${ops.join(", ")})` : "";
-        let permWarning = "";
-        if (trust.tier === "unverified" && plugin.manifest?.permissions) {
-            const perms = plugin.manifest.permissions;
-            const flags = [];
-            if (perms.network)
-                flags.push("network");
-            if (perms.cdp)
-                flags.push("cdp");
-            if (perms.fs)
-                flags.push("fs");
-            if (perms.tools?.override?.length)
-                flags.push(`override:${perms.tools.override.join(",")}`);
-            if (perms.tools?.remove?.length)
-                flags.push(`remove:${perms.tools.remove.join(",")}`);
-            if (flags.length > 0) {
-                permWarning = ` \u001b[33m— requests: ${flags.join(", ")}\u001b[0m`;
+        loadedPluginNames.add(plugin.name);
+        activeLoadedPlugins.set(plugin.name, plugin);
+        process.stderr.write(`  [Plugin Loaded] ${plugin.name} v${plugin.version}\n`);
+        // Notify the client that tools have changed
+        try {
+            if (server.server && typeof server.server.sendToolListChanged === "function") {
+                server.server.sendToolListChanged();
             }
         }
-        process.stderr.write(`  ${trust.badge} ${plugin.name} v${plugin.version}${opsStr}${permWarning}\n`);
+        catch {
+            // Ignore if client doesn't support it or not connected yet
+        }
+    };
+    // Add the built-in ecosystem tools
+    server.tool("list_plugins", "List all available Weavetab plugins that can be loaded.", {}, async () => {
+        const installed = listInstalledPlugins();
+        const available = installed
+            .filter(info => !loadedPluginNames.has(info.packageName))
+            .map(info => `- ${info.packageName}: ${info.manifest?.description || "No description"}`);
+        if (available.length === 0) {
+            return { content: [{ type: "text", text: "No un-loaded plugins available." }] };
+        }
+        return { content: [{ type: "text", text: `Available plugins:\n${available.join("\n")}\n\nUse load_plugin with the plugin package name to load one.` }] };
+    });
+    server.tool("load_plugin", "Load any Weavetab plugin dynamically by npm package name (e.g. '@fy2ne/wt-youtube', 'my-plugin').", {
+        name: z.string().describe("The exact npm package name of the plugin to load (e.g. '@fy2ne/wt-youtube', 'my-plugin')")
+    }, async ({ name }) => {
+        if (loadedPluginNames.has(name)) {
+            return { content: [{ type: "text", text: `Plugin ${name} is already loaded.` }] };
+        }
+        const plugin = loadPluginByName(name);
+        if (!plugin) {
+            return { content: [{ type: "text", text: `Plugin "${name}" not found. Make sure it is installed via "weavetab plugin add ${name}".` }] };
+        }
+        await registerPluginTools(plugin);
+        const toolsList = (plugin.tools || []).map((t) => t.name).join(", ");
+        return { content: [{ type: "text", text: `loaded plugin ${name}. Tools registered: ${toolsList || "(dynamic tools registered)"}` }] };
+    });
+    // Auto-load plugins by default unless explicitly marked with lazy: true
+    const allPlugins = discoverPlugins();
+    for (const plugin of allPlugins) {
+        const isExplicitlyLazy = plugin.manifest?.lazy === true;
+        if (!isExplicitlyLazy) {
+            await registerPluginTools(plugin);
+        }
     }
     let transport;
     if (transportMode === "ws") {
@@ -1570,6 +1912,28 @@ async function cleanup() {
     if (cleanupCalled)
         return;
     cleanupCalled = true;
+    // Run plugin onUnload hooks and clear hook pipeline
+    try {
+        for (const plugin of activeLoadedPlugins.values()) {
+            if (typeof plugin.onUnload === "function") {
+                try {
+                    plugin.onUnload(plugin._context);
+                }
+                catch (e) {
+                    process.stderr.write(`[Weavetab] Error in plugin "${plugin.name}" onUnload: ${e?.message || e}\n`);
+                }
+            }
+        }
+        activeLoadedPlugins.clear();
+        hookPipeline.clearAllHooks();
+    }
+    catch { /* non-fatal */ }
+    // Stop config file watcher handle
+    try {
+        const { stopConfigWatcher } = await import("./config/loader.js");
+        stopConfigWatcher();
+    }
+    catch { /* non-fatal */ }
     if (global.__wt_is_server) {
         // In server mode the browser must survive server restarts. Only cancel
         // analytics intervals and close CDP WebSocket connections. Never call