@weavetab/mcp 2.5.0-beta.1 → 2.5.0-beta.4

package/dist/tools/read.js

@@ -9,10 +9,13 @@ import { cacheActionMap, getCachedActionMap, getRawCachedActionMap } from "../st
 import { startReadingSimulation } from "../overlay/ghost.js";
 import { suppressOverlays, restoreOverlays } from "../cdp/extension.js";
 import { sendToExtension } from "../cdp/helpers.js";
+import { hideWeaveTabOverlay, restoreWeaveTabOverlay } from "../cdp/helpers.js";
 import { analyzeVisualFallback } from "../intelligence/vision.js";
+import { marksSet } from "../intelligence/marks.js";
 import { getConfigAgentId } from "../config/loader.js";
-// Cap at 80 elements; form/modal groups are always kept, utility trimmed last.
-const MAX_ELEMENTS = 80;
+// Cap at 35 elements by default to keep prompt tokens lean.
+// Form, modal, and primary interactive elements are prioritized first.
+const MAX_ELEMENTS = 35;
 function withTimeout(p, ms) {
     return Promise.race([
         p,
@@ -26,33 +29,121 @@ function formatLite(el, activeElementId, changedIds) {
         parts.push("disabled");
     if (activeElementId && el.id === activeElementId)
         parts.push("FOCUSED");
-    if (el.viewport && el.viewport !== "visible")
-        parts.push(`offscreen:${el.viewport}`);
+    if (el.viewport && el.viewport !== "visible" && el.viewport !== "in-viewport") {
+        parts.push(el.viewport);
+    }
     // ── Value / checked / placeholder ──────────────────────────────────────────
     const role = (el.role || '').toLowerCase();
     const type = (el.type || '').toLowerCase();
-    // Radio / checkbox checked state — critical for quiz forms
+    // Radio / checkbox checked state
     if ((role === 'radio' || role === 'checkbox' || type === 'radio' || type === 'checkbox') && el.value !== undefined) {
         parts.push(el.value === 'true' || el.value === 'checked' ? '✓ checked' : '○ unchecked');
     }
     else if (el.value) {
-        // Truncate long values to avoid token waste
-        const v = el.value.length > 60 ? el.value.slice(0, 57) + '…' : el.value;
-        parts.push(`"${v}"`);
+        const v = el.value.length > 45 ? el.value.slice(0, 42) + '…' : el.value;
+        parts.push(`val:"${v}"`);
     }
     else if (el.placeholder) {
-        parts.push(`placeholder: "${el.placeholder}"`);
+        const p = el.placeholder.length > 35 ? el.placeholder.slice(0, 32) + '…' : el.placeholder;
+        parts.push(`ph:"${p}"`);
     }
-    // ── Type suffix for inputs (e.g. input[email], input[date]) ────────────────
-    const typeLabel = (role === 'textbox' || role === 'searchbox' || role === 'combobox') && type
+    // ── Type suffix for inputs ──────────────────────────────────────────────────
+    const typeLabel = (role === 'textbox' || role === 'searchbox' || role === 'combobox') && type && type !== 'text'
         ? `/${type}` : '';
-    // ── Link hint ───────────────────────────────────────────────────────────────
-    if (role === 'link' && el.hrefType && el.hrefType !== 'same-origin') {
-        parts.push(el.hrefType);
+    // ── Link hint (only if external) ───────────────────────────────────────────
+    if (role === 'link' && el.hrefType === 'external') {
+        parts.push('ext');
     }
     const state = parts.length > 0 ? ` (${parts.join(', ')})` : '';
     const changed = changedIds?.has(el.id) ? ' ★' : '';
-    return `[${el.id}] ${el.role}${typeLabel} "${el.label}"${state}${changed}`;
+    const label = el.label.length > 50 ? el.label.slice(0, 47) + '…' : el.label;
+    return `[${el.id}] ${el.role}${typeLabel} "${label}"${state}${changed}`;
+}
+// ─── 3.0 High-density formatter helpers ──────────────────────────────────────
+/** Collapse a cluster of nav/footer links into a compact summary token. */
+function collapseNavCluster(cluster) {
+    if (cluster.length === 0)
+        return '';
+    if (cluster.length === 1)
+        return formatLite(cluster[0]);
+    const first = cluster[0].label.slice(0, 20);
+    const last = cluster[cluster.length - 1].label.slice(0, 20);
+    const ids = `${cluster[0].id}…${cluster[cluster.length - 1].id}`;
+    return `[${ids}] ${cluster.length} links: "${first}" … "${last}"`;
+}
+/**
+ * Format the main element list using 3.0 semantics:
+ * - Active modals hoisted to the top
+ * - Items under shared container headings grouped
+ * - Nav link clusters (4+ consecutive) collapsed
+ */
+function formatMap3(elements, activeElementId, changedIds) {
+    const lines = [];
+    // ── 1. Hoist active modal elements ───────────────────────────────────────
+    const modalEls = elements.filter(e => e.isModal);
+    const mainEls = elements.filter(e => !e.isModal);
+    if (modalEls.length > 0) {
+        const modalTitle = modalEls[0].modalTitle || 'Dialog';
+        lines.push(`╔═ ACTIVE DIALOG: "${modalTitle}" ${'═'.repeat(Math.max(0, 30 - modalTitle.length))}╗`);
+        for (const el of modalEls) {
+            lines.push('  ' + formatLite(el, activeElementId, changedIds));
+        }
+        lines.push(`╚${'═'.repeat(42)}╝`);
+        if (mainEls.length > 0)
+            lines.push('');
+    }
+    // ── 2. Main elements with entity grouping + nav cluster collapsing ────────
+    const SECTION_LABEL = {
+        navigation: "── NAV ──────────────────",
+        main_content: "── MAIN ─────────────────",
+        form: "── FORM ─────────────────",
+        sidebar: "── SIDEBAR ──────────────",
+        modal: "── MODAL ────────────────",
+        utility: "── OTHER ────────────────",
+    };
+    let currentSection = null;
+    let currentContainer = null;
+    let navCluster = [];
+    const flushNavCluster = () => {
+        if (navCluster.length >= 4) {
+            lines.push(collapseNavCluster(navCluster));
+        }
+        else {
+            for (const ne of navCluster) {
+                lines.push(formatLite(ne, activeElementId, changedIds));
+            }
+        }
+        navCluster = [];
+    };
+    for (const el of mainEls) {
+        // Section header
+        if (el.group !== currentSection) {
+            flushNavCluster();
+            currentSection = el.group;
+            currentContainer = null;
+            lines.push(SECTION_LABEL[currentSection]);
+        }
+        // Accumulate nav/utility link cluster for potential collapsing
+        const isNavLink = (el.group === 'navigation' || el.group === 'utility') && el.role === 'link';
+        if (isNavLink) {
+            navCluster.push(el);
+            continue;
+        }
+        else {
+            flushNavCluster();
+        }
+        // Container/entity heading
+        const ctx = el.containerContext || null;
+        if (ctx && ctx !== currentContainer) {
+            currentContainer = ctx;
+            const header = ctx.length > 55 ? ctx.slice(0, 52) + '…' : ctx;
+            lines.push(`  ┌ ${header}`);
+        }
+        const indent = ctx ? '  │ ' : '';
+        lines.push(indent + formatLite(el, activeElementId, changedIds));
+    }
+    flushNavCluster();
+    return lines;
 }
 /** Full markdown table mode — only used when full:true is explicitly passed */
 function formatFull(elements, url, title, hint) {
@@ -83,6 +174,99 @@ function formatFull(elements, url, title, hint) {
     }
     return lines.join('\n');
 }
+/**
+ * Inject numbered Set-of-Marks badges over all interactive elements,
+ * take a screenshot, then strip the badges. Returns structured mark data
+ * and the annotated image. Zero page pollution after completion.
+ */
+async function buildVisualGrounding(session, targetId, elements) {
+    try {
+        // Build mark data from DOM elements that have coordinates
+        const domMarks = [];
+        for (const el of elements) {
+            if (el.x === undefined || el.y === undefined)
+                continue;
+            const w = el.width ?? 80;
+            const h = el.height ?? 24;
+            domMarks.push({
+                mark: domMarks.length + 1,
+                x: el.x,
+                y: el.y,
+                width: w,
+                height: h,
+                ref: el.id,
+                label: el.label || undefined,
+                type: el.role === "link" ? "link"
+                    : el.role === "button" ? "button"
+                        : (el.role === "textbox" || el.role === "searchbox" || el.role === "combobox") ? "input"
+                            : el.role === "canvas" ? "canvas_region"
+                                : "unknown",
+            });
+        }
+        // Also discover canvas elements that may not be in the DOM map
+        const { result: canvasRes } = await session.Runtime.evaluate({
+            expression: `(function(){
+        var canvases = [...document.querySelectorAll('canvas')];
+        return JSON.stringify(canvases.map(function(c){
+          var r = c.getBoundingClientRect();
+          return r.width > 0 && r.height > 0 ? {
+            x: Math.round(r.left + r.width/2), y: Math.round(r.top + r.height/2),
+            w: Math.round(r.width), h: Math.round(r.height)
+          } : null;
+        }).filter(Boolean));
+      })()`,
+            returnByValue: true,
+        }).catch(() => ({ result: { value: '[]' } }));
+        const extraCanvas = JSON.parse(canvasRes.value ?? '[]');
+        // Add canvas regions not already covered by a nearby DOM mark
+        for (const c of extraCanvas) {
+            const alreadyCovered = domMarks.some(m => Math.abs(m.x - c.x) < 40 && Math.abs(m.y - c.y) < 40);
+            if (!alreadyCovered) {
+                domMarks.push({ mark: domMarks.length + 1, x: c.x, y: c.y, width: c.w, height: c.h, type: "canvas_region" });
+            }
+        }
+        if (domMarks.length === 0)
+            return null;
+        // Inject badges — fixed-position, shadow-safe, above everything
+        const injectExpr = `(function(marks){
+      var BADGE_KEY = '__wt_som_badges__';
+      if (window[BADGE_KEY]) window[BADGE_KEY].forEach(function(d){ d.parentNode && d.parentNode.removeChild(d); });
+      window[BADGE_KEY] = [];
+      marks.forEach(function(m){
+        var d = document.createElement('div');
+        d.setAttribute('data-wt-som', String(m.mark));
+        d.style.cssText = 'position:fixed;left:'+(m.x - 10)+'px;top:'+(m.y - 10)+'px;width:20px;height:20px;z-index:2147483647;pointer-events:none;background:#7c3aed;color:#fff;font:bold 11px/20px monospace;text-align:center;border-radius:50%;box-shadow:0 1px 4px rgba(0,0,0,.5);';
+        d.textContent = String(m.mark);
+        document.documentElement.appendChild(d);
+        window[BADGE_KEY].push(d);
+      });
+      return true;
+    })(${JSON.stringify(domMarks)})`;
+        await session.Runtime.evaluate({ expression: injectExpr, returnByValue: true }).catch(() => { });
+        // Hide Weavetab overlay so badges are the only overlay in the shot
+        await hideWeaveTabOverlay(session).catch(() => { });
+        // Capture screenshot
+        const { data } = await session.Page.captureScreenshot({ format: 'jpeg', quality: 75 });
+        // Restore overlay
+        await restoreWeaveTabOverlay(session).catch(() => { });
+        // Strip badges immediately
+        await session.Runtime.evaluate({
+            expression: `(function(){ var b=window['__wt_som_badges__']; if(b) b.forEach(function(d){ d.parentNode&&d.parentNode.removeChild(d); }); window['__wt_som_badges__']=[]; })()`,
+            returnByValue: true,
+        }).catch(() => { });
+        // Persist in mark cache for browser_click({ mark: N }) resolution
+        const markMap = new Map();
+        for (const m of domMarks) {
+            markMap.set(m.mark, { x: m.x, y: m.y, width: m.width, height: m.height, ref: m.ref, label: m.label, type: m.type });
+        }
+        marksSet(targetId, markMap);
+        return { marks: domMarks, imageBase64: data };
+    }
+    catch (err) {
+        logDebug(`[buildVisualGrounding] failed: ${err}`);
+        return null;
+    }
+}
 export async function browserMap(session, options = {}, targetId = "default", config) {
     logDebug(`[browserMap] Initiating read for targetId: ${targetId}, options: ${JSON.stringify(options)}`);
     // ── Wait for DOM and Visual Stability ──────────────────────────────────────
@@ -174,7 +358,7 @@ export async function browserMap(session, options = {}, targetId = "default", co
                 query: options.query,
                 limit: options.limit,
                 deep: options.deep,
-                prune: options.prune,
+                prune: options.prune !== false,
             }, targetId), 8000).catch(() => _emptyMap);
             logDebug(`[browserMap] buildActionMap completed. Elements found: ${map.elements.length}`);
             // Auto-fallback to AX tree when DOM walker returns sparse or unlabeled-heavy results
@@ -335,19 +519,24 @@ export async function browserMap(session, options = {}, targetId = "default", co
     if (map.elements.length > 0 && newRefs.length === 0) {
         newRefs.push(...toRefEntries(map.elements));
     }
-    // ── Delta mode ─────────────────────────────────────────────────────────────
-    if (options.delta) {
+    // ── Delta / Auto-Delta mode ────────────────────────────────────────────────
+    // If delta is explicit OR if the user is re-reading the same page without full/force options,
+    // auto-delta returns only what changed (saving up to 95% prompt tokens).
+    const autoDeltaEligible = options.delta === true || (options.delta !== false &&
+        !options.full &&
+        !options.query &&
+        !options.scope);
+    if (autoDeltaEligible) {
         const richDiff = await computeRichDelta(targetId, map.url, map.elements);
-        if (richDiff) {
-            if ("delta_timeout" in richDiff) {
-                // Delta mode timed out — fall through to full read
-            }
-            else {
+        if (richDiff && !("delta_timeout" in richDiff)) {
+            const totalChanges = richDiff.added.length + richDiff.changed.length + richDiff.removed.length;
+            // Auto-delta: if 0 changes or <= 15 changes, return the diff directly
+            if (options.delta === true || totalChanges <= 15) {
                 const lines = [];
                 const header = `Page: ${map.title || map.url} | ${map.elements.length} elements`;
                 lines.push(header);
-                if (richDiff.added.length === 0 && richDiff.changed.length === 0 && richDiff.removed.length === 0 && (!richDiff.iframes || richDiff.iframes.length === 0)) {
-                    lines.push("stable — no changes detected");
+                if (totalChanges === 0 && (!richDiff.iframes || richDiff.iframes.length === 0)) {
+                    lines.push("stable — no DOM changes since last map (use existing refs)");
                 }
                 else {
                     for (const r of richDiff.added)
@@ -372,7 +561,6 @@ export async function browserMap(session, options = {}, targetId = "default", co
                 return lines.join("\n");
             }
         }
-        // No prior snapshot → fall through to full read
     }
     storeSnapshot(targetId, map.url, newRefs);
     seedRichSnapshot(targetId, map.url, map.elements);
@@ -428,15 +616,7 @@ export async function browserMap(session, options = {}, targetId = "default", co
             ? ` (pruned ${beforePruneCount - map.elements.length})`
             : ""));
     lines.push("");
-    // ── Semantic section grouping ────────────────────────────────────────────────
-    const SECTION_LABEL = {
-        navigation: "── NAV ──────────────────",
-        main_content: "── MAIN ─────────────────",
-        form: "── FORM ─────────────────",
-        sidebar: "── SIDEBAR ──────────────",
-        modal: "── MODAL ────────────────",
-        utility: "── OTHER ────────────────",
-    };
+    // ── Semantic section grouping (3.0) ────────────────────────────────────────
     let activeElementId;
     try {
         const { result } = await session.Runtime.evaluate({
@@ -452,36 +632,30 @@ export async function browserMap(session, options = {}, targetId = "default", co
         }
     }
     catch { }
-    let currentSection = null;
-    for (const el of capped) {
-        if (el.group !== currentSection) {
-            currentSection = el.group;
-            lines.push(SECTION_LABEL[currentSection]);
-        }
-        lines.push(formatLite(el, activeElementId, changedIds));
-    }
+    lines.push(...formatMap3(capped, activeElementId, changedIds));
     if (overflowCount > 0) {
         lines.push(`(+${overflowCount} more below fold — call browser_scroll down to reveal)`);
     }
     if (visualFallback)
         lines.push(visualFallback);
-    // Context-scoped tool hint — collapse 34-tool surface to ~12 relevant tools.
-    // Detected from map elements already computed above — zero extra latency.
-    const hasForm = map.elements.some(e => e.group === "form" || e.role === "input" || e.role === "combobox" || e.role === "checkbox" || e.role === "radio");
-    const hasSelect = map.elements.some(e => e.role === "combobox" || e.role === "listbox");
-    const hasCanvas = map.url?.includes("canvas") || false;
-    const isGithub = map.url?.includes("github.com") ?? false;
-    const baseTools = ["browser_click", "browser_type", "browser_key", "browser_scroll", "browser_wait", "browser_navigate", "browser_tabs"];
-    const formTools = hasForm ? ["browser_select", "browser_type_secret", "browser_find"] : [];
-    const githubTools = isGithub ? ["github_analyze", "github_read", "github_issues", "github_get_pr"] : [];
-    const canvasTools = hasCanvas ? ["browser_canvas", "browser_screenshot"] : ["browser_screenshot"];
-    const diagTools = ["browser_inspect", "browser_highlight", "browser_scrape", "browser_burst"];
-    const contextTools = [...new Set([...baseTools, ...formTools, ...githubTools, ...canvasTools, ...diagTools])];
-    lines.push(`\n_tools [${contextTools.join(", ")}]`);
     const output = lines.join("\n");
     const wordCount = output.split(/\s+/).length;
     startReadingSimulation(session, wordCount, config);
     sendToExtension(session, { type: 'Weavetab_STATE', hud: { action: '' } }).catch(() => { });
+    // ── Visual Grounding (Set-of-Marks) ────────────────────────────────────────
+    // Trigger when: visual:true (always) OR visual:"auto" (DOM element count < 5).
+    const shouldVisual = options.visual === true ||
+        (options.visual === "auto" && capped.length < 5);
+    if (shouldVisual) {
+        const vg = await buildVisualGrounding(session, targetId, map.elements);
+        if (vg) {
+            const markSummary = vg.marks
+                .map(m => `  [${m.mark}] ${m.type ?? "unknown"}${m.ref ? ` ${m.ref}` : ""} "${m.label ?? ""}" @(${m.x},${m.y})`)
+                .join("\n");
+            const annotatedText = output + `\n\n── Visual Marks (use browser_click({ mark: N })) ──\n${markSummary}`;
+            return { text: annotatedText, imageBase64: vg.imageBase64, marks: vg.marks };
+        }
+    }
     return output;
 }
 // Backward-compat alias

package/dist/tools/scrape.js

@@ -1,3 +1,6 @@
+import { getConfigAgentId } from "../config/loader.js";
+import { SessionSecretTracker } from "../security/secrets.js";
+import { sessionRegistry } from "../state/session.js";
 export async function browserScrape(session, options, _config) {
     const { query, type = "css", attributes = ["textContent"], multiple = true } = options;
     const res = await session.Runtime.evaluate({
@@ -34,14 +37,20 @@ export async function browserScrape(session, options, _config) {
       }
 
       const attrs = ${JSON.stringify(attributes)};
+      var secretRegex = /password|passcode|pin|passphrase|secret|token|auth.?key|access.?code|mot.?de.?passe|contrase[nñ]a|kennwort|senha/i;
       nodes.forEach(node => {
         const item = {};
 
         // Secret containment: redact any element marked as sensitive.
-        // data-wt-secret is set by browser_type_secret at injection time.
         const isSecret = node.hasAttribute && (
           node.hasAttribute('data-wt-secret') ||
-          (node.tagName === 'INPUT' && node.type === 'password')
+          (node.tagName === 'INPUT' && (
+            node.type === 'password' ||
+            secretRegex.test(node.getAttribute('autocomplete') || '') ||
+            secretRegex.test(node.getAttribute('name') || '') ||
+            secretRegex.test(node.getAttribute('id') || '') ||
+            secretRegex.test(node.getAttribute('aria-label') || '')
+          ))
         );
 
         if (isSecret) {
@@ -53,6 +62,9 @@ export async function browserScrape(session, options, _config) {
               item[attr] = node[attr]?.trim() || '';
             } else if (attr === 'outerHTML') {
               item[attr] = node.outerHTML;
+            } else if (attr === 'value') {
+              // Read live DOM property (not HTML attribute) so getter overrides work
+              item[attr] = node.value !== undefined ? String(node.value) : '';
             } else {
               item[attr] = node.getAttribute(attr) || node[attr] || '';
             }
@@ -98,6 +110,7 @@ export async function browserScrape(session, options, _config) {
             const fullExpr = type === 'xpath'
                 ? `(function(){
             var attrs = ${JSON.stringify(attributes)};
+            var secretRegex = /password|passcode|pin|passphrase|secret|token|auth.?key|access.?code|mot.?de.?passe|contrase[nñ]a|kennwort|senha/i;
             var snap = document.evaluate(${JSON.stringify(query)}, document, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE, null);
             var limit = ${multiple} ? snap.snapshotLength : Math.min(snap.snapshotLength, 1);
             var results = [];
@@ -105,11 +118,25 @@ export async function browserScrape(session, options, _config) {
               var node = snap.snapshotItem(i);
               if (!node || node.nodeType !== 1) continue;
               var item = {};
-              attrs.forEach(function(attr) {
-                if (attr === 'textContent' || attr === 'innerText') { item[attr] = (node[attr] || '').trim(); }
-                else if (attr === 'outerHTML') { item[attr] = node.outerHTML; }
-                else { item[attr] = node.getAttribute ? (node.getAttribute(attr) || node[attr] || '') : ''; }
-              });
+              var isSecret = node.hasAttribute && (
+                node.hasAttribute('data-wt-secret') ||
+                (node.tagName === 'INPUT' && (
+                  node.type === 'password' ||
+                  secretRegex.test(node.getAttribute('autocomplete') || '') ||
+                  secretRegex.test(node.getAttribute('name') || '') ||
+                  secretRegex.test(node.getAttribute('id') || '') ||
+                  secretRegex.test(node.getAttribute('aria-label') || '')
+                ))
+              );
+              if (isSecret) {
+                attrs.forEach(function(attr) { item[attr] = '[REDACTED]'; });
+              } else {
+                attrs.forEach(function(attr) {
+                  if (attr === 'textContent' || attr === 'innerText') { item[attr] = (node[attr] || '').trim(); }
+                  else if (attr === 'outerHTML') { item[attr] = node.outerHTML; }
+                  else { item[attr] = node.getAttribute ? (node.getAttribute(attr) || node[attr] || '') : ''; }
+                });
+              }
               results.push(item);
             }
             return { data: results };
@@ -120,13 +147,28 @@ export async function browserScrape(session, options, _config) {
               try { nodes = Array.from(window.__Weavetab_shadowQuery_all(${JSON.stringify(query)})); } catch(_){}
             }
             var attrs = ${JSON.stringify(attributes)};
+            var secretRegex = /password|passcode|pin|passphrase|secret|token|auth.?key|access.?code|mot.?de.?passe|contrase[nñ]a|kennwort|senha/i;
             return { data: nodes.map(function(node) {
               var item = {};
-              attrs.forEach(function(attr) {
-                if (attr === 'textContent' || attr === 'innerText') { item[attr] = (node[attr] || '').trim(); }
-                else if (attr === 'outerHTML') { item[attr] = node.outerHTML; }
-                else { item[attr] = node.getAttribute(attr) || node[attr] || ''; }
-              });
+              var isSecret = node.hasAttribute && (
+                node.hasAttribute('data-wt-secret') ||
+                (node.tagName === 'INPUT' && (
+                  node.type === 'password' ||
+                  secretRegex.test(node.getAttribute('autocomplete') || '') ||
+                  secretRegex.test(node.getAttribute('name') || '') ||
+                  secretRegex.test(node.getAttribute('id') || '') ||
+                  secretRegex.test(node.getAttribute('aria-label') || '')
+                ))
+              );
+              if (isSecret) {
+                attrs.forEach(function(attr) { item[attr] = '[REDACTED]'; });
+              } else {
+                attrs.forEach(function(attr) {
+                  if (attr === 'textContent' || attr === 'innerText') { item[attr] = (node[attr] || '').trim(); }
+                  else if (attr === 'outerHTML') { item[attr] = node.outerHTML; }
+                  else { item[attr] = node.getAttribute(attr) || node[attr] || ''; }
+                });
+              }
               return item;
             })};
           })()`;
@@ -136,5 +178,17 @@ export async function browserScrape(session, options, _config) {
             }
         }
     }
-    return { success: true, data: val?.data || [], message: `Extracted ${val?.data?.length || 0} elements` };
+    let targetId = "default";
+    const active = sessionRegistry.getActive(getConfigAgentId(_config));
+    if (active)
+        targetId = active.targetId;
+    const rawData = (val?.data || []);
+    const sanitizedData = rawData.map(item => {
+        const sanitizedItem = {};
+        for (const [k, v] of Object.entries(item)) {
+            sanitizedItem[k] = typeof v === 'string' ? SessionSecretTracker.redact(targetId, v) : v;
+        }
+        return sanitizedItem;
+    });
+    return { success: true, data: sanitizedData, message: `Extracted ${sanitizedData.length} elements` };
 }

package/dist/tools/screenshot.js

@@ -1,4 +1,4 @@
-import { hideWeaveTabOverlay, restoreWeaveTabOverlay } from "../cdp/helpers.js";
+import { hideWeaveTabOverlay, restoreWeaveTabOverlay, maskSecretFieldsForCapture, restoreSecretFieldsAfterCapture } from "../cdp/helpers.js";
 export async function browserScreenshot(session, options = {}, _config) {
     const format = options.format ?? "png";
     const quality = format === "jpeg" ? (options.quality ?? 90) : undefined;
@@ -42,33 +42,38 @@ export async function browserScreenshot(session, options = {}, _config) {
         if (clip)
             params.clip = clip;
     }
-    // ── AI-blind: hide Weavetab overlay elements before screenshot ──────────────
+    // ── AI-blind: hide Weavetab overlay elements and mask secrets before screenshot ─
     // The chat panel, ghost cursor, thought bubble, HUD iframe, and all scripted
-    // UI are FOR THE USER only. The AI must never see or interact with them.
-    // hideOverlay defaults to true — only set to false if explicitly requested.
+    // UI are FOR THE USER only. Secret values are masked to prevent visual leaks.
     const shouldHide = options.hideOverlay !== false;
     if (shouldHide) {
         await hideWeaveTabOverlay(session);
     }
+    await maskSecretFieldsForCapture(session);
     let data;
     try {
-        const res = await session.Page.captureScreenshot(params);
-        data = res.data;
-    }
-    catch (e) {
-        if (params.captureBeyondViewport) {
-            params.captureBeyondViewport = false;
-            delete params.clip;
+        try {
             const res = await session.Page.captureScreenshot(params);
             data = res.data;
         }
-        else {
-            throw e;
+        catch (e) {
+            if (params.captureBeyondViewport) {
+                params.captureBeyondViewport = false;
+                delete params.clip;
+                const res = await session.Page.captureScreenshot(params);
+                data = res.data;
+            }
+            else {
+                throw e;
+            }
         }
     }
-    // Restore overlay visibility immediately after capture
-    if (shouldHide) {
-        await restoreWeaveTabOverlay(session);
+    finally {
+        // Restore secret fields and overlay visibility immediately after capture
+        await restoreSecretFieldsAfterCapture(session);
+        if (shouldHide) {
+            await restoreWeaveTabOverlay(session);
+        }
     }
     // ─────────────────────────────────────────────────────────────────────────────
     const width = clip ? clip.width : vp.w;

package/dist/tools/scroll.js

@@ -5,8 +5,7 @@
  */
 import { buildActionMap, findBestMatch, safeSelector } from "../cdp/walker.js";
 import { getCachedActionMap, cacheActionMap } from "../state/cache.js";
-import { computeDelta, storeSnapshot } from "../state/delta.js";
-import { waitForDOMStable } from "../sensors/guard.js";
+import { storeSnapshot } from "../state/delta.js";
 import { sessionRegistry } from "../state/session.js";
 import { logAction } from "../audit/logger.js";
 import { getConfigAgentId } from "../config/loader.js";
@@ -175,22 +174,18 @@ export async function browserScroll(session, args, config) {
                 x: vp.x, y: vp.y,
                 deltaX: chunkX, deltaY: chunkY
             });
-            await sleep(profile.baseDelay + Math.random() * 8);
+            await sleep(profile.baseDelay + Math.random() * 4);
         }
     }
-    await waitForDOMStable(session, 80, 600).catch(() => { });
-    await sendToExtension(session, { type: 'Weavetab_STATE', hud: { action: '' } });
-    const nextMap = await buildActionMap(session, { lite: true }, targetId);
-    cacheActionMap(targetId, nextMap);
-    const diff = computeDelta(targetId, nextMap.url, nextMap.elements);
-    const changesCount = diff ? diff.added.length + diff.removed.length + diff.changed.length : 0;
+    await sleep(40);
+    await sendToExtension(session, { type: 'Weavetab_STATE', hud: { action: '' } }).catch(() => { });
     logAction("browser_scroll", direction, `${distance}px`);
     return {
         success: true,
         scrolled: id ?? label ?? "window",
         direction,
         distance,
-        new_visible_count: nextMap.elements.length,
-        dom_changed: changesCount > 0,
+        new_visible_count: 0,
+        dom_changed: true,
     };
 }

package/dist/tools/select.js

@@ -9,6 +9,12 @@ async function getSelector(session, options, config) {
         return options.selector;
     if (options.ref || options.id) {
         const ref = (options.ref || options.id);
+        if (ref.startsWith("w:")) {
+            return `[data-wt-id="${ref.slice(2)}"]`;
+        }
+        if (ref.startsWith("#") || ref.startsWith(".") || ref.startsWith("[")) {
+            return ref;
+        }
         let targetId = "default";
         const active = sessionRegistry.getActive(getConfigAgentId(config));
         if (active)
@@ -20,13 +26,13 @@ async function getSelector(session, options, config) {
             map = await buildActionMap(session, { lite: true }, targetId);
             cacheActionMap(targetId, map);
         }
-        const element = map.elements.find(el => el.id === ref || el.id.endsWith(ref.startsWith("w:") ? ref.slice(2) : ref));
+        const element = map.elements.find(el => el.id === ref || el.label === ref || el.id.endsWith(ref.startsWith("w:") ? ref.slice(2) : ref));
         if (element) {
             const sel = safeSelector(element);
             if (sel)
                 return sel;
         }
-        throw new Error(`Could not resolve element for ref/id: ${ref}`);
+        return `[name="${ref}"], #${ref}, [aria-label="${ref}"]`;
     }
     if (options.nodeId) {
         const { nodeIds } = await session.DOM.pushNodesByBackendIdsToFrontend({ backendNodeIds: [options.nodeId] });