@weavetab/mcp 2.5.0-beta.1 → 2.5.0-beta.4

package/dist/tools/navigate.js

@@ -12,7 +12,7 @@ import { resetFallbackIdCounter, clearShadowDomCache, clearAXTreeCache } from ".
 import { clearTabCache } from "../state/cache.js";
 import { bumpVisitCount } from "../intelligence/sessionMemory.js";
 import { sessionRegistry } from "../state/session.js";
-export async function weaveNavigate(session, url, config, targetId = "default", force = false, fast = false) {
+export async function weaveNavigate(session, url, config, targetId = "default", force = false, fast = false, appName) {
     logDebug(`[weaveNavigate] Attempting navigation to: ${url}`);
     let parsed;
     if (url.startsWith('Weavetab://')) {
@@ -40,16 +40,35 @@ export async function weaveNavigate(session, url, config, targetId = "default",
             return { success: false, error_code: "INVALID_URL", message: `[!] Invalid URL: ${url}` };
         }
     }
-    // Allow http(s), file (for local HTML debugging), and chrome-extension (handled below).
-    // Block script-execution protocols (javascript:, data:) that bypass the domain policy.
+    const active = sessionRegistry.getActive(config.agentId, appName);
+    const isElectron = !!(appName || active?.isElectron);
+    // Allowed web and desktop application protocols.
+    // Block script-execution protocols (javascript:, data:) that bypass safety policies.
     const proto = parsed.protocol.toLowerCase();
-    if (proto !== "http:" && proto !== "https:" && proto !== "file:" && proto !== "chrome-extension:") {
-        return { success: false, error_code: "BLOCKED_PROTOCOL", message: `[!] Blocked protocol '${proto}'. Only http, https, and file are allowed.` };
+    const allowedProtocols = new Set([
+        "http:",
+        "https:",
+        "file:",
+        "chrome-extension:",
+        "app:",
+        "vscode-webview:",
+        "vscode-file:",
+        "discord:",
+        "slack:",
+        "devtools:",
+        "chrome:",
+        "about:",
+    ]);
+    if (!allowedProtocols.has(proto)) {
+        return { success: false, error_code: "BLOCKED_PROTOCOL", message: `[!] Blocked protocol '${proto}'. Only web, file, and desktop app protocols are allowed.` };
     }
-    const domainCheck = checkDomain(parsed.href, config);
-    logDebug(`[weaveNavigate] Domain check for ${parsed.hostname}: ${JSON.stringify(domainCheck)}`);
-    if (!domainCheck.allowed) {
-        return { success: false, error_code: "DOMAIN_BLOCKED", message: `[!] Weave blocked: ${domainCheck.reason}` };
+    // Domain policy check only applies to standard web navigations
+    if (!isElectron && (proto === "http:" || proto === "https:")) {
+        const domainCheck = checkDomain(parsed.href, config);
+        logDebug(`[weaveNavigate] Domain check for ${parsed.hostname}: ${JSON.stringify(domainCheck)}`);
+        if (!domainCheck.allowed) {
+            return { success: false, error_code: "DOMAIN_BLOCKED", message: `[!] Weave blocked: ${domainCheck.reason}` };
+        }
     }
     // Extension pages: open in new tab instead of navigating current tab
     // (chrome-extension:// pages use a different process context — Page.navigate
@@ -88,7 +107,6 @@ export async function weaveNavigate(session, url, config, targetId = "default",
         };
     }
     // Resolve active tab id
-    const active = sessionRegistry.getActive(config.agentId);
     const resolvedTargetId = active?.targetId ?? targetId;
     // 1. Anchor Tab Protection
     let isAnchor = false;
@@ -97,7 +115,7 @@ export async function weaveNavigate(session, url, config, targetId = "default",
             expression: `new Promise((resolve) => {
         let done = false;
         const finish = (val) => { if (!done) { done = true; resolve(val); } };
-        setTimeout(() => finish(false), 500);
+        setTimeout(() => finish(false), 30);
         try {
           const browserAPI = typeof browser !== 'undefined' ? browser : (typeof chrome !== 'undefined' ? chrome : null);
           if (browserAPI && browserAPI.runtime && browserAPI.runtime.id) {
@@ -111,7 +129,7 @@ export async function weaveNavigate(session, url, config, targetId = "default",
       })`,
             awaitPromise: true,
             returnByValue: true
-        });
+        }).catch(() => null);
         isAnchor = res?.result?.value === true;
     }
     catch (e) {
@@ -133,50 +151,45 @@ export async function weaveNavigate(session, url, config, targetId = "default",
     sendToExtension(session, { type: 'Weavetab_STATE', hud: { action: `navigating to ${parsed.hostname}...` } }).catch(() => { });
     sendToExtension(session, { type: 'Weavetab_STATE', cursor: { x: 10, y: 10 }, state: 'thinking' }).catch(() => { });
     await session.Page.navigate({ url: parsed.href });
-    // Proper navigation wait — DOM stability after load
+    // Fast navigation wait
     try {
         await awaitNavigation(session, config.navigationTimeout || 30000);
     }
     catch (navErr) {
         logDebug(`[weaveNavigate] Navigation timeout: ${navErr}`);
-        // Continue — page may be partially loaded
     }
-    // Clear delta snapshot — next weave_read will be a fresh full read
+    // Clear delta snapshot & caches
     clearSnapshot(resolvedTargetId);
     resetLoopCounter("navigation");
-    clearToolCallWindow(); // prevents cross-page STUCK_LOOP bricks
+    clearToolCallWindow();
     resetFallbackIdCounter();
     clearShadowDomCache(resolvedTargetId);
     clearAXTreeCache(resolvedTargetId);
     clearTabCache(resolvedTargetId);
-    // Dismiss common cookie banners / popups inline (popups.ts was removed)
-    await session.Runtime.evaluate({
-        expression: `
-      (function(){
-        var selectors = [
-          '[id*="cookie"] button','[class*="cookie"] button',
-          '[id*="consent"] button','[class*="consent"] button',
-          '[id*="gdpr"] button','[class*="gdpr"] button',
-          '[aria-label*="Accept"]','[aria-label*="Agree"]',
-          'button[data-cookiebanner]'
-        ];
-        for(var i=0;i<selectors.length;i++){
-          var el=document.querySelector(selectors[i]);
-          if(el){try{el.click();}catch(e){}break;}
-        }
-      })()
-    `
-    }).catch(() => { });
-    const { frameTree } = await session.Page.getFrameTree();
-    const finalUrl = frameTree.frame.url;
-    let title = parsed.hostname;
-    try {
-        const titleRes = await session.Runtime.evaluate({ expression: 'document.title', returnByValue: true });
-        if (titleRes?.result?.value) {
-            title = titleRes.result.value;
-        }
-    }
-    catch { }
+    // Parallelize post-navigation metadata & cookie banner dismissal
+    const [frameRes, titleRes] = await Promise.all([
+        session.Page.getFrameTree().catch(() => ({ frameTree: { frame: { url: parsed.href } } })),
+        session.Runtime.evaluate({ expression: 'document.title', returnByValue: true }).catch(() => null),
+        session.Runtime.evaluate({
+            expression: `
+        (function(){
+          var selectors = [
+            '[id*="cookie"] button','[class*="cookie"] button',
+            '[id*="consent"] button','[class*="consent"] button',
+            '[id*="gdpr"] button','[class*="gdpr"] button',
+            '[aria-label*="Accept"]','[aria-label*="Agree"]',
+            'button[data-cookiebanner]'
+          ];
+          for(var i=0;i<selectors.length;i++){
+            var el=document.querySelector(selectors[i]);
+            if(el){try{el.click();}catch(e){}break;}
+          }
+        })()
+      `
+        }).catch(() => { })
+    ]);
+    const finalUrl = frameRes?.frameTree?.frame?.url || parsed.href;
+    const title = titleRes?.result?.value || parsed.hostname;
     // Keep session registry in sync with the new URL
     if (active)
         active.url = finalUrl;

package/dist/tools/pdf.js

@@ -1,7 +1,7 @@
 import { getOutputDir } from "../config/loader.js";
 import fs from "node:fs";
 import path from "node:path";
-import { hideWeaveTabOverlay, restoreWeaveTabOverlay } from "../cdp/helpers.js";
+import { hideWeaveTabOverlay, restoreWeaveTabOverlay, maskSecretFieldsForCapture, restoreSecretFieldsAfterCapture } from "../cdp/helpers.js";
 export async function browserPdf(session, options, config) {
     // Always hide the overlay before generating PDF (agent must never see it).
     // Set hideOverlay: false explicitly to keep overlays visible.
@@ -9,18 +9,26 @@ export async function browserPdf(session, options, config) {
     if (shouldHide) {
         await hideWeaveTabOverlay(session);
     }
-    const { data } = await session.Page.printToPDF({
-        landscape: options.landscape ?? false,
-        scale: options.scale ?? 1.0,
-        pageRanges: options.pageRanges ?? "",
-        marginTop: 0.4, // 1cm ish
-        marginBottom: 0.4,
-        marginLeft: 0.4,
-        marginRight: 0.4,
-        printBackground: true
-    });
-    if (shouldHide) {
-        await restoreWeaveTabOverlay(session);
+    await maskSecretFieldsForCapture(session);
+    let data;
+    try {
+        const pdfRes = await session.Page.printToPDF({
+            landscape: options.landscape ?? false,
+            scale: options.scale ?? 1.0,
+            pageRanges: options.pageRanges ?? "",
+            marginTop: 0.4, // 1cm ish
+            marginBottom: 0.4,
+            marginLeft: 0.4,
+            marginRight: 0.4,
+            printBackground: true
+        });
+        data = pdfRes.data;
+    }
+    finally {
+        await restoreSecretFieldsAfterCapture(session);
+        if (shouldHide) {
+            await restoreWeaveTabOverlay(session);
+        }
     }
     // Use configured PDF directory or default
     const pdfsDir = getOutputDir("pdfs", config);

package/dist/tools/pointer.d.ts

@@ -19,8 +19,18 @@ export interface PointerResult {
     url: string;
     dom_changed?: boolean;
 }
-export declare function browserPointer(session: CDP.Client, args: {
-    action: "click" | "double_click" | "hover" | "drag_and_drop";
+export interface PointerStep {
+    action?: "hover" | "click" | "double_click";
+    ref?: string;
+    selector?: string;
+    target?: string;
+    label?: string;
+    x?: number;
+    y?: number;
+    holdMs?: number;
+}
+export interface PointerArgs {
+    action?: "click" | "double_click" | "hover" | "drag_and_drop" | "hover_chain";
     ref?: string;
     selector?: string;
     target?: string;
@@ -32,4 +42,9 @@ export declare function browserPointer(session: CDP.Client, args: {
     end_y?: number;
     waitForChild?: string;
     holdMs?: number;
-}, config: Config): Promise<PointerResult>;
+    hover_chain?: Array<string | PointerStep>;
+    chain?: Array<string | PointerStep>;
+    clickFinal?: boolean;
+    [key: string]: unknown;
+}
+export declare function browserPointer(session: CDP.Client, args: PointerArgs, config: Config): Promise<PointerResult>;

package/dist/tools/pointer.js

@@ -117,7 +117,95 @@ async function resolveRefToCoords(session, targetId, ref, currentUrl) {
     return null;
 }
 export async function browserPointer(session, args, config) {
-    let { action, ref, selector, label, x, y, end_ref, end_x, end_y, waitForChild, holdMs = 300 } = args;
+    let { action = "click", ref, selector, label, x, y, end_ref, end_x, end_y, waitForChild, holdMs = 200 } = args;
+    // ── HOVER CHAIN / SUBMENU NAVIGATION (Photopea, Figma, Photoshop, Flyout Menus) ──
+    const rawChain = args.hover_chain || args.chain;
+    if (action === "hover_chain" || (rawChain && rawChain.length > 0)) {
+        const chainItems = (rawChain || []).map((step, idx, arr) => {
+            if (typeof step === "string") {
+                const isLast = idx === arr.length - 1;
+                return {
+                    action: isLast && args.clickFinal !== false ? "click" : "hover",
+                    ref: step,
+                    label: step,
+                    target: step
+                };
+            }
+            return step;
+        });
+        const startMs = Date.now();
+        const { Page, Input } = session;
+        let targetId = "default";
+        const active = sessionRegistry.getActive(getConfigAgentId(config));
+        if (active)
+            targetId = active.targetId;
+        let lastX = 0, lastY = 0;
+        for (let i = 0; i < chainItems.length; i++) {
+            const step = chainItems[i];
+            const stepTarget = step.ref || step.selector || step.target || step.label;
+            let stepCoords = null;
+            if (step.x !== undefined && step.y !== undefined) {
+                stepCoords = { x: step.x, y: step.y, selector: step.selector || '' };
+            }
+            else if (stepTarget) {
+                stepCoords = await resolveRefToCoords(session, targetId, stepTarget).catch(() => null);
+                if (!stepCoords) {
+                    // Submenu might have rendered after previous hover; quick retry with fresh map
+                    await new Promise(r => setTimeout(r, 80));
+                    await buildActionMap(session, { lite: true }, targetId).then(m => cacheActionMap(targetId, m)).catch(() => { });
+                    stepCoords = await resolveRefToCoords(session, targetId, stepTarget).catch(() => null);
+                }
+            }
+            if (!stepCoords) {
+                throw new Error(`[browser_pointer hover_chain] Could not resolve coordinates for chain step [${i}]: '${stepTarget}'`);
+            }
+            lastX = stepCoords.x;
+            lastY = stepCoords.y;
+            // Move pointer smoothly to element
+            await ghostMove(session, stepCoords.x, stepCoords.y, config, step.label, "fast");
+            await Input.dispatchMouseEvent({ type: "mouseMoved", x: stepCoords.x, y: stepCoords.y, pointerType: "mouse" });
+            // Dispatch mouseenter/mouseover events for dynamic flyout/hover menus
+            if (stepCoords.selector) {
+                await session.Runtime.evaluate({
+                    expression: `(function(sel, cx, cy) {
+            const el = document.querySelector(sel) || (window.__Weavetab_shadowQuery ? window.__Weavetab_shadowQuery(sel) : null);
+            if (!el) return;
+            el.dispatchEvent(new MouseEvent('mouseenter', { bubbles: false, cancelable: true, clientX: cx, clientY: cy }));
+            el.dispatchEvent(new MouseEvent('mouseover',  { bubbles: true,  cancelable: true, clientX: cx, clientY: cy }));
+            el.dispatchEvent(new MouseEvent('mousemove',  { bubbles: true,  cancelable: true, clientX: cx, clientY: cy }));
+          })(${JSON.stringify(stepCoords.selector)}, ${stepCoords.x}, ${stepCoords.y})`,
+                    returnByValue: false
+                }).catch(() => { });
+            }
+            const stepHold = step.holdMs ?? (i === chainItems.length - 1 ? 40 : 100);
+            await new Promise(r => setTimeout(r, stepHold));
+            // If action is click (e.g. final step in chain)
+            if (step.action === "click") {
+                await Input.dispatchMouseEvent({ type: "mousePressed", x: stepCoords.x, y: stepCoords.y, button: "left", clickCount: 1, pointerType: "mouse" });
+                await new Promise(r => setTimeout(r, 40));
+                await Input.dispatchMouseEvent({ type: "mouseReleased", x: stepCoords.x, y: stepCoords.y, button: "left", clickCount: 1, pointerType: "mouse" });
+            }
+            else if (step.action === "double_click") {
+                await Input.dispatchMouseEvent({ type: "mousePressed", x: stepCoords.x, y: stepCoords.y, button: "left", clickCount: 1, pointerType: "mouse" });
+                await Input.dispatchMouseEvent({ type: "mouseReleased", x: stepCoords.x, y: stepCoords.y, button: "left", clickCount: 1, pointerType: "mouse" });
+                await new Promise(r => setTimeout(r, 60));
+                await Input.dispatchMouseEvent({ type: "mousePressed", x: stepCoords.x, y: stepCoords.y, button: "left", clickCount: 2, pointerType: "mouse" });
+                await Input.dispatchMouseEvent({ type: "mouseReleased", x: stepCoords.x, y: stepCoords.y, button: "left", clickCount: 2, pointerType: "mouse" });
+            }
+        }
+        const execMs = Date.now() - startMs;
+        const { frameTree: postFrameTree } = await Page.getFrameTree().catch(() => ({ frameTree: { frame: { url: '' } } }));
+        return {
+            success: true,
+            action: "hover_chain",
+            x: lastX,
+            y: lastY,
+            execution_ms: execMs,
+            tab_id: targetId,
+            url: postFrameTree.frame.url,
+            dom_changed: true,
+        };
+    }
     if (selector && !ref) {
         ref = selector;
     }

package/dist/tools/read.d.ts

@@ -4,7 +4,25 @@
  * Weavetab by fy2ne
  */
 import CDP from "chrome-remote-interface";
+import { type MarkEntry } from "../intelligence/marks.js";
 import type { Config } from "../config/loader.js";
+export interface VisualMark {
+    mark: number;
+    x: number;
+    y: number;
+    width: number;
+    height: number;
+    ref?: string;
+    label?: string;
+    type?: MarkEntry["type"];
+}
+export interface BrowserMapResult {
+    text: string;
+    /** Base64 JPEG of the page annotated with numbered SoM badges. Only present in visual mode. */
+    imageBase64?: string;
+    /** Structured mark list — numbers match badges visible on the screenshot. */
+    marks?: VisualMark[];
+}
 export interface ReadOptions {
     lite?: boolean;
     full?: boolean;
@@ -14,17 +32,19 @@ export interface ReadOptions {
     delta?: boolean;
     intent?: string;
     ax_tree?: boolean;
-    /** Debug: draws colored element borders via extension. The screen glow (blue edge fade) is the standard visual indicator, shown automatically during reading states. */
+    /** Debug: draws colored element borders via extension. */
     show_overlays?: boolean;
-    /** Force deep shadow DOM traversal (crosses all shadow boundaries to find elements). Auto-enabled when flat query returns sparse results. */
+    /** Force deep shadow DOM traversal. */
     deep?: boolean;
+    /** Semantic DOM pruning. Defaults to true to drop non-interactive noise and SVGs. */
+    prune?: boolean;
     /**
-     * Run one-shot semantic DOM pruning before returning elements.
-     * Drops hidden elements with no interactive descendants and no known toggle-trigger.
-     * Replaces SVG icons with [SVG Icon: label] tokens.
-     * NOTE: distinct from delta — delta diffs across time, prune compresses the current snapshot once.
+     * Visual grounding mode (Set-of-Marks).
+     * - true  → always inject numbered badges + screenshot.
+     * - "auto" → activate only when DOM interactive count < 5 (canvas/WebGL pages).
+     * Use browser_click({ mark: N }) to interact with numbered marks.
      */
-    prune?: boolean;
+    visual?: boolean | "auto";
 }
-export declare function browserMap(session: CDP.Client, options: ReadOptions | undefined, targetId: string | undefined, config: Config): Promise<string>;
+export declare function browserMap(session: CDP.Client, options: ReadOptions | undefined, targetId: string | undefined, config: Config): Promise<string | BrowserMapResult>;
 export { browserMap as weaveRead };